Security Community Reacts to Microsoft Announcement

A number of readers have collected stories concerning the change of focus by Bill Gates to security. Bruce Schneier and Adam Shostack have written a piece, while Crag Mundie of MSFT has also chimed in, along with some commentary from ZD folks. SecurityFocus has other words, as does InfoWarrior.

Comments

I'll belive it

[Evanrude]

When I see it. So far Microsofts security focus has been like looking through beer goggles.

It would be nice.

[Schwamm]

It would be nice if Windows, in addition to being the world's most popular/used OS, also happened to be *secure*. I look forward to that day, but until then... Well, let's just leave it at I won't be holding my breath.

Re:It would be nice.

[Anonymous Coward]

who is the imbecile that modded this "informative"?

Re:It would be nice.

[jawahar]

Well, I hope MS would realize that open source is one of the key attributes to building trustworthy systems.

Re:It would be nice.

[Schwamm]

I don't know that OS necessarily is one of the key attributes. I can see why it may help, but I don't know that an OS has to be OS in order for it to be secure. (mmm... dueling abbreviations)

MSFT?

[crow_t_robot]

I watch that MSFT3K all the time and they never talk about computer stuff... I am suspicious of the validity of this reference...

Re:MSFT?

[Anonymous Coward]

Which one is Bill Gates? The human or the talking gumball machine?

It seems to me

[OpCode42]

It seems to me like MS are doing this just to counteract the recent bad press they have got in the security area.

I have said it in the past, and I'll spew it backup now for those who missed it, MS do not make the best software - bu they do have the best marketing department and business sense.

Re:It seems to me

[Proaxiom]

It seems to me like MS are doing this just to counteract the recent bad press they have got in the security area.

Well, duh!

It's the timing that gets me. They made the announcement shortly after a major OS release. So whenever somebody points out a bug in existing software (XP or earlier), they can shrug and say "That was the old Microsoft, the new Microsoft no longer makes those mistakes."

And since it'll be sometime before they release another highly-vulnerable product, nobody will be able to contradict them.

Re:It seems to me

[Archanagor]

As it turns out, MS Security is not as bad as Sun's or IBM's The article is toward the bottom of the page. It's mostly about exploits via buffer overflow. But, as a Linux Zealot may not know, MS actually writes some of the more solid code.

I'll probably be modded down as troll or flaimbait, but then it just shows the /. mentality.

Re:It seems to me

[doorbot.com]

And since it'll be sometime before they release another highly-vulnerable product, nobody will be able to contradict them.

Let's not forget it's a known fact XP was rushed to market in the first place, due to the various pending litigation against MS...

Re:It seems to me

[jlower]

But Microsoft's primary security failings don't come from bad programming. Rather they come from bad marketing decisions.

Decisions such as hiding known file type extensions from users. Like executing scripts attached to emails, even in a preview pane. Like enabling services (UPnP) that nobody currently has a use for.

These are what has caused MS the most embarassement, the most publicity, even if they aren't the most serious security issues.

My take is these are also the issues MS aims to 'fix', because they are easy, visible, and promotable.

Bill even hinted at this direction in his email to all the MS employees. The only thing he specifically mentioned (that I recall) as an example was their recent security enhancement to Outlook (tightening the security by default).

Re:It seems to me

[gmack]

"In the battle between Unix/Linux and Microsoft, scalability, performance, and unit of work costs all favor the Microsoft platform."

This should be the first hint at what the rest of this is worth. I won't aregue price but MS *used* to be more scaleable. Linux has much improved since the famous Mindcraft stats.

As for the rest of it they almost had me.. up until I realised that they dind't mention all of the exploits for Windows2000. CERT is not a good place to find exploit stats.

And then theres the problem of the author spending all of it's time blasting SUN and IBM then sort of linking Linux in by saying Unix/Linux and going on to call RedHat a worst offender.

The artical also oversimplifies how easy it is to find buffer overflows. I wonder how long that bug in telnetd has been there. It took them how many years to find it?

Re:It seems to me

[coyul]

As it turns out, MS Security is not as bad as Sun's or IBM's [objectwatch.com] The article is toward the bottom of the page. It's mostly about exploits via buffer overflow. But, as a Linux Zealot may not know, MS actually writes some of the more solid code.

That is, to put it politely, complete bunk.

Microsoft's biggest problem is not buffer overflows. You don't need to sneak a virus through the basement window when you can drive it in through the front door, waving merrily as you go. Many of Microsoft's biggest security problems have been with viruses that simply take advantage of what they're explicitly allowed to do. Most Outlook viruses don't exploit low-level coding errors, they exploit the high-level error of allowing arbitrary foreign executables free access to the system. Ditto with Office macro viruses. I wouldn't call that solid coding. Solid coding means preparing for the eventuality that your users are naive and making it as hard as possible for them to shoot themselves (or their neighbours, in the case of Melissa, et. al.) in the foot.

I'm not saying that Sun or IBM are any better, but saying that Microsoft writes solid code is absolutely ludicrous.

Re:It seems to me

[Anonymous Coward]

Don't forget that they had to rig a poll to make people believe that .Net was being accepted. I'm sure companies are extremely wary of MS's ability to control confidential data. .Net is going to fail miserably if they can't change folk's minds about their commitment to security.

Re:It seems to me

[bark76]

As it turns out, MS Security is not as bad as Sun's or IBM's The article is toward the bottom of
the page. It's mostly about exploits via buffer overflow. But, as a Linux Zealot may not know, MS actually writes some of the more solid code.

From the article you linked to:

The company most frequently criticized for its SPSPs is Microsoft. And based on my analysis of the last two years of infrastructure related CERT/CC advisories, I would have to agree that this criticism is not unfounded.

Microsoft has stumbled in the area of security. Two advisories in particular make one question Microsoft's competence in software quality control. Let's take a look at each of these.

I think you took one part of that article waaaaay out of context. They didn't say Microsoft was better, just that some of the UNIXes can be just as guilty on some counts.

This quote should be seen as 'IBM and SUN can be just as bad as Microsoft' not as 'Microsoft writes solid code':

If buffer overflows are symptomatic of sloppy system programming, Microsoft may be guilty as charged, but compared to Sun and IBM, Microsoft is a paragon of programming virtue!

Now can someone mod this guy down as a troll please.

Re:It seems to me

[Anonymous Coward]

Silly you

The poll was about the .NET programming framework. you are talking about the Passport framework.... passport does have .net in it. but .net does not mean a specific thing.. it is a general term for all their toys right now...

Passport yea a little scary. .NET programming? this rocks man look into it read up on it.. the .net framework is quite pimp yo

-peace

Re:It seems to me

[frozenray]

>> As it turns out, MS Security is not as bad as Sun's or IBM's [objectwatch.com]

I think that's not a very good example you're giving to support your argument. From the website you're linking to:

"Roger Sessions is highly respected within Microsoft. He has given many keynote talks at Microsoft sponsored conferences. Thousands of copies of his book have been given away by Microsoft."

That alone is of course not sufficient to question Mr. Session's bias or professional qualifications, but let's just say I got a little bit leery after reading this.

Furthermore, your logic seems fundamentally flawed to me. According to your chain of reasoning:

1. Microsoft has security problems
2. Other's have security problems, too
therefore
3. Microsoft is not so bad as everybody says.

This looks to me like a classical "tu quoque" fallacy. I see it again and again on /., and when I have modpoints I always mod those posts down as trolls - not because they're contrarian to /. groupthink but because they're using faulty logic and are either trolls or just clueless.

>> I'll probably be modded down as troll or flaimbait, but then it just shows the /. mentality.

Moderators, whenever you see a sentence similar to the above ("C'mon, mod me down, I have karma to burn..."), please think hard if the poster really made a soundproof argument or is just doing some social engineering on you by doing an appeal to pity in order to gather/avoid losing some karma.

Raymond

Re:It seems to me

[Archanagor]

Did you even bother to read the article? Or are you just doing an editorial comment on my post?

I'm not arguing one way or another. I'm just pointing to an article that contrasts Microsoft's supposed gaping secrity holes against others rife with errors. As for people who run attachments inside emails from unknown/strange people. They get what they deserve. Anyone with half a brain woild realise the attachment was bogus. So that, inherently is not a security problem, but a dumb user problem. Perhaps Microsoft should protect users from themselves. You're so clouded by your hatred for MS that you can't bother to accept opinions that are contrary to your own belief.

And yes, that line at the bottom was addressing the likes of you.

Re:It seems to me

[frozenray]

Archanagor,

Strong reaction, I didn't intend to upset you - attack the facts, not the person, please.

My points were

1. That the article you've linked to comes from a source who may (!) have some bias in favor of Microsoft

2. That the logic in the argument is faulty (the "tu quoque" argument part)

3. That the "Oh well, I'll probably be modded down for going against groupthink" is a form of social engineering and, unfortunately, gets rewarded a little too often on slashdot.

Just because I disagreed with your original post doesn't prove that I'm "clouded by my hatred for MS" as you say - I make a comfortable living in a big Microsoft shop.

I'm also a member or the local IRT, and believe me, sleeping in the office for three nights straight while mopping up behind the ILOVEYOU disaster is an experience I don't want to repeat (yeah, we really got caught, the experience has made us wiser).

If they really succeed in making their products more secure, I'll be more than happy. As I said, I prefer my bed to a sleeping bag in the office.

Raymond

Re:It seems to me

[quintessent]

Most Outlook viruses don't exploit low-level coding errors, they exploit the high-level error of allowing arbitrary foreign executables free access to the system.

However, if you have used Office XP, you will notice that it prevents you from executing attachments, by default.

Re:It seems to me

[Anonymous Coward]

They don't? MS lied to me!

Speedreader's summary of all 6 articles

[Score0, Overrated]

It will be good if they succeed; we hope they try as hard as their PR says they will.

Have a nice day.

Re:Speedreader's summary of all 6 articles

[Tackhead]

> [Speedreader's Summary:] It will be good if they succeed; we hope they try as hard as their PR says they will.

Tackhead's One-Liner:

If they put 10% of today's PR budget into the next release's security budget, they might have a chance.

Re:Speedreader's summary of all 6 articles

[Anonymous Coward]

Wow, what a cool internet feature. All that discussion about the Slashdot effect, caching and mirroring ideas, and then you solve it all with the speedreader summary. You should work for Microsoft!

Re:Speedreader's summary of all 6 articles

[Anonymous Coward]

OSDN are hiring. I don't see 'human mirror' on their list of openings though.

Security is everyone's problem

[crumbz]

It seems that the various tones of the above mentioned pieces reflect a Microsoft good or Microsoft bad attitude. Unfortunately, the problem being discussed transcends the usual polemics of such a debate. Good security, whether from Microsoft, Sun, Novell, Cisco or others, is in everyone's best interest. If Microsoft has finally awoken to this fact, good for them. Their previous security through obfusication was a travesty and insulting. If my personal information is going to be stored on a computer that is linked to a network, I want the best damn security money can buy. For that computer, for the database software, for the firewall, for the remote machine at the local insurance agency that is accessing the info, et. all.
True Names are important for a reason.

Re:Security is everyone's problem

[Anonymous Coward]

Well there is a reason people look at Microsoft as good or bad. They have a history of saying one thing and doing another- even to the DoJ- remember the IE settlement? "No, we won't bundle our browser anymore. We're 'integrating' it."

Anyone who looks at that attitude and doesn't think Microsoft is 'evil' is an apologist who reasons "but all the good things they've done make up for it, don't they?"

Nothing makes up for slaughtering stability and security in the name of individual profits. And that's exactly what Bill Gates has done.

Re:Security is everyone's problem

[Anonymous Coward]

If my personal information is going to be stored on a computer that is linked to a network, I want the best damn security money can buy.

http://www.openbsd.org/

Take two, burn to CDR, and call me in the morning. ;-)

Craig's article...

[ImaLamer]

...says:

But we're still in the early years of the computer revolution, and there are many technological, social and regulatory hurdles we must overcome before computers truly become a ubiquitous--and essential--technology.


The early years? No. When you've got one person on top who can't get their sh*t together...

I mean, we could be farther along in this 'revolution' he speaks of. Why aren't we? Because the Big Guys [read:Microsoft] are doing what they want to do. Why are they now only focusing on security?

Oh! Pick me! I know! --- Because they do what they want to do, and that's it. They don't give in to customer demand; most of their product is cooked up by visions that Bill and others have.

Re:Craig's article...

[yatest5]

Because they do what they want to do, and that's it

Are you saying they *shouldn't* be doing what they want to do? Should they do what you want them to do?

Re:Craig's article...

[ecc0]

Yes, probably, to some extent. If I pay for their products, I, as a Microsoft consumer, would want them to listen to what I have to say about what's wrong with the software. People have been complaining about Microsoft Windows security for ages, and not much has really been done. Microsoft was too busy integrating Internet Explorer into Windows and such, they did not really care about fixing the security.

Re:Craig's article...

[xonker]

Are you saying they *shouldn't* be doing what they want to do? Should they do what you want them to do?

If he's a Microsoft customer, yes.

Microsoft is very unusual in the sense that it doesn't follow the adage that the customer is always right. If any normal (read -- business that doesn't have a monopoly and can rest on the fact that >95% of the home users and >40% of businesses will buy their products because they see no alternative) business employed Microsoft's attitude, they'd soon be out of business.

Say you went down to your local grocery store to buy some Extra-Triple Fudge Fatty Ice Cream and they said "no, we're only going to let you buy plain Neopolitian -- and by the way, we're going to be changing the policy here, if you want ice cream, you'll take it whenever we want to sell it to you and we'll be instituting annual billing for 52 Gallons of ice cream a year. Oh, and if you want to give your kids some, you'll have to buy extra containers for them, only one user per container. Oh, and our profit margins are below what our shareholders are used to, so we'll be raising the price every few months and thinking of new ways to require that you only buy Microsoft Ice Cream."

How long would you remain a customer? In effect, this is what M$ is doing and as a customer you can't do a damn thing about it as long as you continue using Windows.

It isn't normal for the majority of a businesses customers to hate the product that make, but have to accept it anyway.

Security and stability are things that Microsoft's customers have been screaming for for years, so yes -- they should be doing it whether it's something that they want to do or not.

Unfortunately, the main focus of their development has been to add features that lock people into the Microsoft platform.

Security is only becoming a focus now because the biggest potential Microsoft lock-ins won't be adopted unless Microsoft can convince the public that they are secure. I don't think this is a genuine effort, except on the part of the PR department -- it's a sincere effort to convince everyone that they're going to be more secure, but I don't believe that it's going to happen -- well, they may become *more* secure, but that won't take much.

Re:Craig's article...

[CoyoteGuy]

You don't know what you are talking about.

You, as a consumer have options. Everyone, as a consumer has options. What makes you want to buy a Microsoft OS every time? What takes your wallet, runs you to the store, and makes you pick up a box with that dreaded logo on it? You don't have to buy it, there is no legal constraint for someone to make an OS to suit your needs, or, for that matter, anyone else's needs. I wish people would understand this.

If all you can do is sit in a *nix community bashing MS because YOU paid for an OS that didn't suit YOUR needs, then you, sir, are an idiot.

On the other hand, if you would really like to help us *nix people develop an operating system that doesn't BSOD every 5 minutes, then how about you pick up a book on OOP and c++ or C, and help us develop it?

It is one thing to constantly hear people bash MS, but this guy just admitted to buying the software.

IF IT SUX WHY DID YOU BUY IT??
Oh, the pretty logo, i see.

Re:Craig's article...

[archen]

Think what he means is that what MS does isn't usually what we need.

MS does whatever it wants to

Linux developers do whatever is best for Linux

It seems like only Apple is actually interested in it's users.

Re:Craig's article...

[shepd]

>IF IT SUX WHY DID YOU BUY IT?

Simple. If I didn't I couldn't get a job, and I couldn't pass college.

I think everyone deserves a job, don't you?

Re:Craig's article...

[Anonymous Coward]

Bullsh*t! You don't need MS to get a job you loser. There are many jobs that deal nothing with consumer OS's. What you should have said was that you're too stupid to figure anything else out.

Re:Craig's article...

[MrTaz65]

I think you typo'd

You meant "It seems like only Apple is actually interested in it's users' _money_."

Re:Craig's article...

[alecks]

If he's a Microsoft customer, yes

Well they actually do! You're just not looking at the bigger picture. MS's biggest market is the corporate world, so that's who they listen to the most. And the corp world wants things like centralized management, all-in-one solutions, etc.... MS spent a lot of effort making Active Directory happen, and they have done so quite successfully. It may not be perfect, I'll give you that, but neither is your *nix.

Plus, you guys don't realize how much shit MS really puts out.
Their entire back office solution, to come from one company alone, is quite a feat.
Their stuff is VERY well integrated and backward compatibal.

And my favorite feature:
The fact that I don't have to compile source code when I download any upgrades/patches/software....

Corporations like that too! Most of the world does, because we want to buy a ready solution, not something we need to put further effort into.

Re:Craig's article...

[Anonymous Coward]

Actually, Einstein, there are a LOT of jobs that require people to know how to use Microsoft products. I work as an engineer in a very large company that only uses Microsoft. Some of our design applications are written only for MS. I have NO choice. All of my suppliers use Microsoft. All of their suppliers use Microsoft. Our plants use Microsoft. I'm not going to hunt for a job at a company just because they don't use Microsoft. I imagine in the IT field it's even more imperitive.

Granted, the burger-flipping jobs you're qualified for don't require it, but some of us have higher aspirations...

Re:Craig's article...

[Anonymous Coward]

"...[Microsoft] may become *more* secure, but that won't take much."

No, not much at all.

rm -Rf /mnt/windows/*

There, now my Windows partition is secure.

Re:Craig's article...

[xonker]

MS's biggest market is the corporate world, so that's who they listen to the most.

They do? The corporate admins have been begging for more stability and security for quite some time. I don't recall ANYONE asking for .Not.

It may not be perfect, I'll give you that, but neither is your *nix.

It's a damn sight better than Windows, though. No OS is perfect -- very, very, very true. Microsoft, however (or at least various people at M$) have admitted that perfection isn't even a goal. In fact, it's contrary to their number one goal, which is ever-increasing profits.

If you are a Microsoft customer, you have to understand that the goals of M$ are totally contrary to the goals of any of their customers -- the goal of any IT department should be to implement solutions that are stable, secure and cost-effective while solving the problems that they're using computers for and doing so as cheaply as possible without compromising the other goals. Microsoft's goal is to continue to sell more and more and more and more -- which is directly contrary to the goals of IT.

I'd also rather spend money on personnel than software licenses any day. Anyone looking for dumbed-down solutions is either a wanna-be admin who doesn't have the chops to do *nix, or a PHB who wants to hire cheaper help.

And my favorite feature:

The fact that I don't have to compile source code when I download any upgrades/patches/software....

My least favorite feature:

The fact that I can't get source code for Microsoft systems.

Most of the world does, because we want to buy a ready solution, not something we need to put further effort into.

Which is exactly why someone like you should not be in charge of a corporation's computers. Ready-made solutions are great for simple problems, but they also dumb down things to the point where it's nearly impossible to do anything other than what the vendor (in this case, M$) thought you might want to do -- or should do. Very few companies are happy with the constraints that using Windows puts on them, which is why Linux has gone as far as it has.

If you're too stupid or lazy (or both) to compile software, get a job in marketing. I wouldn't let someone with your attitude near my computers.

Enterprise computing shouldn't be dumbed down. I'm not saying it should be needlessly complicated, but with so much riding on corporate computer systems the emphasis should be on being completely secure, stable, and well-documented. While I grant you that no OS is 100% there, no one is farther behind than Microsoft.

Re:Craig's article...

[aardvarkjoe]

(This is exactly what an AC said, but he's right. He's also at Score: 0, and that's not going to change, so I'll repeat what he said:)

That's completely untrue. Only a minority of jobs, and of college programs, require you to buy Microsoft software. The vast majority of the time, you never even have to touch the stuff.

The truth of the matter is that you went to a stupid school (where they require you to use M$ products), entered a degree program (for which the aforementioned stupid school required the use of M$ products), and then took a job (again, one where you have to use M$ products.) Any of these could have been avoided, had you a desire to do so rather than whine about being 'forced' to use software you don't like. Even if you're dead-set on pursuing a CS degree or something where you're going to have to work with Microsoft software to some degree, you can use the school resources available. There's absolutely no excuse for paying good money for something you think is useless, unless you're just a glutton for punishment.

Re:Craig's article...

[BESTouff]

Say you went down to your local grocery store to buy some Extra-Triple Fudge Fatty Ice Cream and they said "no, we're only going to let you buy plain Neopolitian -- and by the way, we're going to be changing the policy here, if you want ice cream, you'll take it whenever we want to sell it to you and we'll be instituting annual billing for 52 Gallons of ice cream a year. Oh, and if you want to give your kids some, you'll have to buy extra containers for them, only one user per container. Oh, and our profit margins are below what our shareholders are used to, so we'll be raising the price every few months and thinking of new ways to require that you only buy Microsoft Ice Cream."

Excuse me, but you just described MacDonald's ...

Re:Craig's article...

[Anonymous Coward]

"The fact that I don't have to compile source code when I download any upgrades/patches/software...."

Well, I'd say you'd better have a computer which already knows what drivers to install during you are at the local comp dealer buying new stuff for it if you don't want to do it yourself. Lazy boy.

- Voice of Ambience -

Re:Craig's article...

[xonker]

Excuse me, but you just described MacDonald's ...

There's a pretty big difference between McDonald's and Microsoft. McDonald's doesn't hold a monopoly, McDonald's offers choices to its customers -- admittedly, McDonald's still sucks, but you don't have to eat there. They can't force you to eat there. You can order only the items on the menu that you want, and the last time I checked they had plenty of competition.

The only thing they have in common is both companies start with "M" and they both suck.

When Microsoft buys McDonald's then it's REALLY time to worry...

Re:Craig's article...

[mcjulio]

Holy fuck you're brilliant. The proper syntax for an rm command. AC, have my baby!

Re:Craig's article...

[shepd]

>That's completely untrue. Only a minority of jobs, and of college programs, require you to buy Microsoft software.

If anything is untrue, you're above statement is. It is baseless.

Allow me to provide a base for you: The most common language for beginners to learn is BASIC. Visual Basic. As much as my opinions are strong, it is the most popular beginner's language. People going to college for computer programming courses don't understand programming and are beginners (or why would you sign up?). So they teach that. They also teach Access, since its a very simple way to introduce new programmers to building databases. And they teach C++ in a windows environment since the majority of C++ programming done for profit is done for windows.

These are hard facts that I'm sure I can back up with numbers. I don't like them, and I'd rather do nothing but GNU, but I have to face the facts.

>The truth of the matter is that you went to a stupid school (where they require you to use M$ products)

A stupid school would leave students unprepared for the real world. In the real world they use M$ software.

> entered a degree program (for which the aforementioned stupid school required the use of M$ products)

Sure didn't take a degree program. I am at college though -- I think they call them vocational institutes or something like that elsewhere. I really couldn't care less, though, since the job placement rate is very high for gradutes from my college.

>and then took a job (again, one where you have to use M$ products.)

My job is as an assistant systems administrator for the aforementioned college. We have to support M$ products not only because of my classes, but also because we offer courses in Office applications, and many other programs that run in a Windows enviroment.

All the servers that I know of at my college, with the exception of a single windows box, are Novell or a Unix variant. But, because my job includes real life work, I have to fix windows boxes.

As you'll see, I use windows just as much as anyone else. I'm very surprised your job never required the use of windows. I'm sure your stupid job requires the use of RPG/400, or COBOL, or something else equally inane. I don't think being a software janitor is a job anyone should aspire to be doing, though. I suppose you could be one of the very few who still have jobs programming for open source projects, but I find that unlikely.

>Any of these could have been avoided, had you a desire to do so rather than whine about being 'forced' to use software you don't like.

Well, let's see:

- Burger flipping: There's a good chance at some joint the cash registers run Windows NT. Nope, won't work
- Computer repairs: Uhhh, you have to install windows. Nope.
- Computer Consulting: Most questions I've got are about windows. Nope.
- Programming: All the jobs in my newspaper require windows experience of some type. Nope.
- Bank machine repair: A surprising number of bank machines run Win NT. Nope.
- Sign repair: Nope. Most all the electronic signs out there run Win NT.
- Secretary: Nope.
- Dentist: Nope.
- Doctor: Nope.
- Car Mechanic: A lot of car repair systems run Win NT. Nope.
- Phys ed teacher: Have to receive emails, most use Win NT. Nope.
- Salesman: Sales terminals run Win NT.
- TV/VCR Repair: Sales terminals running Win NT. Not to mention the windows based diagnostics software.
- Hardware engineering: You might spend most of your time on a Unix box designing ICs, but just wait 'till the head of the company emails everyone their monthly .doc file. Will you tell them that you won't read it because you don't support M$?

Any single job you can think of will require me to use windows unless I'm lucky. And, even though I've listed many non-computer jobs, I'd prefer to stick to the field I actually enjoy working in.

The fact is I need to eat, and to ensure I can lead a life outside of leeching from the government, I have to learn and use windows. As soon as I go to college to learn windows (ie: get a certificate of computer literacy so I can get that non-computer professional job I never dreamed of) I've already paid for it, as you'll see below.

>Even if you're dead-set on pursuing a CS degree or something where you're going to have to work with Microsoft software to some degree, you can use the school resources available.

Do you think when I paid my tuition I didn't pay for the school resources?

So just by going to college and sitting down at a machine I bought into the M$ monopoly. I paid for M$ windows not indirectly, but directly. Part of the cash I plonked down was earmarked for Microsoft. I know, I work there.

>There's absolutely no excuse for paying good money for something you think is useless, unless you're just a glutton for punishment.

I think a lot of government services are useless, but when I don't pay my taxes Revenue Canada knocks on my door.

M$, the goverment registered computer software monopolist is no different.

If you are employed, and your company switches to M$, are you willing to quit?

Or, if you are self-employed, and a $1m client tells you they are switching to M$ and want your help in it, will you say no?

The fact is I'm not Gandhi, and I'm not willing to destroy myself to avoid paying Bill Gates his money. If my job requires M$, I'm sorry, but I'm not going to quit, since I know I'll never find a job not requring the use of it at some point.

Re:Craig's article...

[aardvarkjoe]

Well, let's see.

My last job was developing (and doing other work with) device drivers; primarily working with Linux, Solaris, and AIX. The group I was with did do Windows as well, but I wasn't a part of that. The only thing I ever used my Windows workstation for was to open up telnet sessions to the lab ... and usually I didn't even bother to use my workstation. I certainly didn't need training in M$ operating systems to do that, and was I inclined to do so, I could have simply not used my Windows machine. So the jobs definately exist, though you might not be looking hard enough.

I have never been required to use Windows, for anything, at the school I am attending ... in fact, the only times I have used Windows in the last several months have been to use my roommate's computer a few times in order to print something, because I don't have a printer hooked up to mine. Again, should I have chosen to do so, I could have avoided it completely.

Not everything can go your way. You've got lots of choices; the fact is that some of those choices lead to specific consequences. The education and career path you chose to follow has Microsoft's software in it. If you cared all that much about it, you would have made different choices, rather than just complaining about how unfair life is.

Re:Craig's article...

[shepd]

>My last job was developing (and doing other work with) device drivers; primarily working with Linux, Solaris, and AIX.

Unfortunately, there's a very small job market for device driver writing. I've never even once seen such a job advertised in the newspapers. I don't doubt they exist, but there are only so many device drivers that need writing (one per product with ports to each OS unless the developers royally screw up), and (AFAIK) while they are more challenging to write, they don't take nearly as long to write, which explains why you don't need the same amount of developers for that as opposed to application development.

I don't disagree that I personally can (and often do) avoid using windows, but when it's no-M$ vs. passing college, the latter always wins.

>If you cared all that much about it, you would have made different choices, rather than just complaining about how unfair life is.

I don't complain. I understand. And I did make other choices. I took EET for a couple of years before what I'm taking now. Now, if there's anything that should take you away from Microsoft products, this would be it. Well, it wasn't. They wanted us to use OrCad, and, for those who know that software, even though they made a Linux version, a lifetime subscription to Microsoft products is cheaper than an "educational" version. That's just the beginning -- Turbo C DOS drivers and all sorts. They supported Unix development whenever possible, but too many microprocessor companies would only release their devlopment tools in Windows.

Now, I put it to you: If the company you were working for asked you to develop for windows, would you quit your job? Sure seems like in these .bomb times they would have asked. I suppose you could ask them to provide you with money so you can go to college and learn device driver programming for windows, but wouldn't your life be easier at that point to play about with doing it with windows at home?

What I'm trying to get at is that perhaps where you stand things have worked well for you, and you've got the "dream job" of never having to work with microsoft products while still working in the technology field. In most places, though, if you refuse to use M$ you are refusing work. If you refuse to work, you get welfare for a few months until the government tells you to clean toilets. Of course, you'd be surprised how many toilet cleaner's timecard systems are Windows based...

Explaining a fact of life to someone who doesn't believe you is no more complaining than explaining to someone who can't stop their car properly that they need to use snow tires even after they repeatedly tell you that they've used all seasons all their life is boring.

Oh, what the hell, let me throw another monkey into the wrench: The laptop I bought just to avoid having to do all my work in a windows environment at college came with windows. I'd have gotten one from a Canadian linux-laptop dealer, but shipping and poor online pricing actually made it cheaper for me to buy it, with windows, offline.

I just figured I'd see what IT jobs I could get in my general location (without moving to another country) without windows experience, that pay a worth amount. I just checked at monster.ca for jobs in my area. 4 matches. Jobs which don't require windows experience (or that simply imply it by making one of the requirements windows software): 1. And their company has strong ties with a lot of M$ using companies, and the job is being a VP of Interactive Development. Doesn't seem like a good position to be in if you want to tell the clients "No, we don't do M$".

So, tell me, what do you reccomend? The streets, or toilet scrubbing for me?

Re:Craig's article...

[aardvarkjoe]

Device drivers aren't the only things developed for *NIX platforms -- that just happens to be what I did. Even if you're set on programming, there are lots of things that need to be done for those systems, and a lot of jobs. If you're not, then there are even more. (We've had several stories on /. lately of businesses that have moved from Windows to Linux. You might try one of them.)

If you only spend a few minutes hunting, of course you won't find much. Glancing at your newspaper and not finding one immediately is no proof that the jobs don't exist. It's simply proof that you give up too easily. Why not call some of these places and ask if they might have other jobs available? Same with the school -- just because the one you're at requires Windows doesn't mean all of them do.

As far as "whether I would quit my job" goes -- I'm not the one complaining about the evil M$ monopoly. I might quit, I might not. However, if I didn't, I would realize that it was my choice to stay, rather than trying to convince everyone that Microsoft is the ultimate evil. You, on the other hand, keep on asserting that it's "Use M$ or nothing" -- an obvious fallacy.

Re:Craig's article...

[Anonymous Coward]

In other words, if Microsoft makes things too easy, your fat ass will be out of a job?

Re:Craig's article...

[yomegaman]

All computer companies are interested in money, except maybe for all of the Linux-oriented ones that are now out of business.

Re:Craig's article...

[xonker]

In other words, if Microsoft makes things too easy, your fat ass will be out of a job?

No. If the Microsoft trend continues the quality of corporate systems will match the quality of those qualified to maintain them. In other words, they'll be piss-poor.

Those qualified to work with real technology will have their hands tied when saddled with broken operating systems and binary-only distribution that forbids them from making any changes not sanctioned and though of in advance by the drones at Microsoft.

Companies will continue to spend more and more on their licensing fees in the dream that they'll be able to save money on qualified admins while they wonder why reliability and security have gone down the toilet.

Cringely, too

[what_the_heck]

Cringley has a good piece up on this as well.

Re:Cringely, too

[Mysticalfruit]

I agree with Cringley on this. Microsoft is just using this as a PR bit to capitalize on our fears about security...

I also agree when it comes to the whole "microsoftizing" the whole security thing and using as a way to back more people into a corner...

Wow!

[returnofthe_spork]

How very fascinating!

How to secure Microsoft Windows:

[Proaxiom]

Schneier and Shostack say:
Separate Data and Control Paths
Use Secure Default Configurations
Separate Protocols and Products
Choose for Security over Features
Make it Transparent and Auditable
Give advance notice of Protocols and Designs
Engage the community

All that stuff sounds great, but I can say the same thing in far fewer words:
Start from scratch. Do it right this time.

Re:How to secure Microsoft Windows:

[rikkards]

Start from scratch. Do it right this time

(insert sarcastic wit)
But wasn't there an interview with the former Project Manager for Excel who said why some of their competitors failed was because they restarted from scratch (i.e netscape). Now if that opinion is prevalent through MS do you really think they will start from scratch??

Re:How to secure Microsoft Windows:

[Proaxiom]

Now if that opinion is prevalent through MS do you really think they will start from scratch??

No, I don't. But I don't think they'll succeed with this security initiative either.

It's easier to say than to do. We all know this already. But I'm not sure Microsoft does. It's not like the sudden Internet shift.

Security is about adding limitations and restrictions. This is converse to the entire corporate direction, which has been stripping those away while trying to apply band-aid solutions to address security issues. It's a fundamental problem.

And you are right. They can't really go back. They can't completely rewrite Windows, IIS, or Office. The new products would be released with glaring omissions from past functionality. It would be missing things Microsoft never should have added in the first place (UPnP, for instance).

Perhaps they'll try to do it right. In fact I believe they will. But when it finally comes down to scrapping products and features with insecure fundamentals, I can't see them carrying through.

It'll be back to band-aids and PR coverups. The temptation is just too great.

Re:How to secure Microsoft Windows:

[ergo98]

Starting from scratch is what bad programmers do when they don't have the intelligence or patience to figure out what has been done and what has been learned previously. Well, let me state that there are cases where starting from scratch makes sense, but there are the far more prevelant "It's all crap, I'm starting from scratch" mentality, which roughly translates to "It's easier for me to impose my will and start with what I know than to try to figure out what the prior person did and learned". Beware a programmer who ever claims that they need to rewrite something: 9 times out of 10 it's because they are lazy, or they're just not smart enough to figure it out.

BTW: Who you are talking about is Joel, i.e. http://joel.editthispage.com. HA! Just visited there and hilariously enough he has a co-rewriting story up. You're thinking of this article.

Re:How to secure Microsoft Windows:

[jeffy124]

what about apple and the max os x? seems to me they restarted almost from scratch and came out quite high up on the positive end of things.

Re:How to secure Microsoft Windows:

[ergo98]

By taking some basic steps Microsoft could dramatically improve the security of their code. The fact is that about 95% of the security faults in MS code haven't been faults with the underlying OS' design (which actually has pervasive security throughout. Indeed the ACL security model in NT/2000/XP is the best or among the best out there) per se, but rather with trivial C++ banality like buffer overflows (which has been REMARKABLY common in their code). It is simply a case of auditing code and saying "hey look here I do an strcpy(dest,source) and I don't make sure the source is smaller than the desk...". That simple check throughout their code, and the use of variables on the heap rather than the stack, would have eliminated most of the black eyes MS has gotten.

Re:How to secure Microsoft Windows:

[gmack]

The ACL security moddle they ripped from VMS is great. What I really wish is that they would actually USE it. I don't like all daemons running as administrator and good luck trying to get IIS to work as anything else.

Re:How to secure Microsoft Windows:

[SpaceLifeForm]

Beware a programmer who ever claims that they need to rewrite something: 9 times out of 10 it's because they are lazy, or they're just not smart enough to figure it out.

Apparently you've encountered quite alot of clean, well documented code. Lucky you.

Re:How to secure Microsoft Windows:

[SpaceLifeForm]

It is simply a case of auditing code and saying "hey look here I do an strcpy(dest,source) and I don't make sure the source is smaller than the desk...".

At first I thought that was a typo, but then I realized you were referring to CodeRed.

Re:How to secure Microsoft Windows:

[The Lord of Chaos]

Its interesting to note that a couple of Joel's examples of code which is tempting to chuck are do to MicroSoft-isms:

"That LoadLibrary call is ugly but it makes the code work on old versions of Windows 95."
"One of them fixes that bug that Nancy had when she tried to install the thing on a computer that didn't have Internet Explorer."

Maybe Microsoft has a better chance of starting from scratch since they don't have a nasty layer of software to write on top of (except the legacy BIOS of course).

Re:How to secure Microsoft Windows:

[A Big Gnu Thrush]

Actually, they did just the oppostite... and things turned out badly. For years they worked on the Copland project which was a from scratch rewrite of the OS, but finally canned it, bought a fully functional OS and wrote a GUI, emulator, and API. Even so, the years of delay took them right out of the market.

Re:How to secure Microsoft Windows:

[Anonymous Coward]

not always true. I wrote a program, checked my methods for doing everything, inspected the code it ran fine, the program size was 2 megs. I went in and optimized some functions inlined some others.. 1.7 megs. So i went back again and looked at the design. Merged a bunch of classes, rewrote all of the code for the classes but kept the same function names so the main code would work, essentially rewriting nearly the whole program. program size sat at around 460k. I think sometimes rewriting is good for making a better architecture than the one you originally thought was a good idea.

Re:How to secure Microsoft Windows:

[WeaselGod]

Actually a lot of that sounds bad. The Bruce Schneier and Adam Shostack piece would have us return to a computing environment from the 80s. Sure it was simpler, and thus prone to less securities holes, but it also removes a hell of a lot of useful functionality. For example they suggest that MS remove ActiveX controls that are safe to script from Internet Explorer, which is a hideous idea. Sure, it allows some one who is malicious to fuxor a system, but it also allows companies to role out very complex and dynamic applications from within the web browser, removing the need for an admin to install software on every machine (or setup sms or some other style of push software). It also allows the controls to be scripted against in the web browser allowing application developers options that would never be possible in a netscape style plugin. The benifits far outway the drawbacks (and abuse of this system rarely happens). Essantially the authors want to take a way functionality that users expect. There is no way someone would go back to windows 3.1 and ie 2 (or netscape anything below 6.1) after playing around with XP. By the way, thats also why no average desktop user switches to linux. I am sorry but its true, users don't like having to go and install and configure everything seperately (as the authors would have them do). It is just to much a pain in the ass for users.

Re:How to secure Microsoft Windows:

[MarkLR]

They could leave in Active X but make the process of running Active X controls more explicit. For example never load or run Active X controls automatically. Make it that the user must explicit authorization each download of an Active X contol subject tosystem admins making a list of controls that can run.

Don't allow scripting to use any controls on the machine unless the script itself is certified by a system admin.

The idea of killing SOAP would annoy David Winer of Userland Software however.

Re:How to secure Microsoft Windows:

[ergo98]

Rewriting by "refactoring" is very much different than throwing out the baby with the bathwater and saying "Let's start from scratch". I constantly rewrite classes, improve functions, pull out common code, and at the end of the day I might have actually replaced every single line, but I haven't actually rewritten it. While it seems odd to differentiate, there is a major difference. See the latest Joel article for an example of that.

Re:How to secure Microsoft Windows:

[ClosedSource]

"Starting from scratch is what bad programmers do when they don't have the intelligence or patience to figure out what has been done and what has been learned previously."

While looking at old code can eventually lead to understanding what has been done, it can't inform you of what has been learned previously - that's the role of documentation. It's because most systems are poorly documented that programmers are forced to modify old code even when there are compelling reasons to start over.

The decision to modify or start over should be based on the answer to a number of questions: How long will it take to adequately understand the old code? Which will get the job done faster? Cheaper? Which is the easier to maintain? Are any of the original authors still with the company? Can you get adequate performance out of the old code? How much of the old code is relevent to the new product?

This is not a complete list, but the point is that the decision has to be made on a case-by-case basis. Of course, if the old code is highly modular you may be able to have the best of both worlds. You can create a new code structure that is appropriate for the new product while reusing already debugged components.

Re:How to secure Microsoft Windows:

[LadyLucky]

Windows IS started again. Only they did it right, it took them 6 years (+/-) for them to phase out their old version (win 9x line) and replace it with their brand sparkly new one (the NT line). They managed what normally kills a software company, a complete re-write by being smart about it.

The backwards compatibility is only necessary to a point. Old DOS stuff isnt very well supported on 2k etc, you can try and it might work, but probably not.

Starting from scratch is usually one of the worst things you can do if you write software. You wouldnt want to start the Linux kernel, XWindows from scratch, now would you?

Re:How to secure Microsoft Windows:

[jeffy124]

you havent used OSX, have you?

apple scrapped all their OS 9 and previous stuff, took Mach and FreeBSD and put a revised Mac GUI on top and came up with something extremely easy-to-use, secure (as in nothing turned on by default, with settings are all in one place), fast, stable, etc.

And on top of all that - a command line.

Re:How to secure Microsoft Windows:

[Anonymous Coward]

"but rather with trivial C++ banality like buffer overflows" ... "hey look here I do an strcpy(dest,source)"

Look, if you don't know what you're talking about, just don't post. There is no reason why you MUST post when you have nothing to add to the discussion.

strcpy is C's string copy command. C++ has bounded strings and is thus requires careful thought to cause a buffer overrun. Note that the vast majority of the recent MS buffer overruns have been in C code, not C++: ISAPI modules and such. One more time, in the hopes that it will sink in this time: Just because you ignorantly put "C/C++" together on your resume doesn't make them the same thing.

And putting variables on the heap will just slow execution speed down with little to no security gain: heap overflows can be exploited too, just not as easily by cut-and-paste exploit writers.

Re:How to secure Microsoft Windows:

[ChadN]

He also said that if you do start from scratch, you continue to develop and support the old system to keep it relevant. Easier to do with deep pockets...

Re:How to secure Microsoft Windows:

[matroid]

I think the point of the article was not that software shouldn't have this sort of functionality, but rather that software should not have such non-security-conscience enabled by default, allowing Users or Administrators to choose whether to turn the functionality on if they deem the benefits outweigh the costs.

Take OpenBSD as an example. The good folks at OpenBSD review their code, flush out the bugs, and turn off non-essential stuff in their default install. BUT, they also document everything well and make configuration easy enough so that if you want to turn on something risky you can. Also, they have great linux emulation and an excellent port system so that you can install tons of software, both secure and insecure. They leave it up to the admin to decide between functionality and security, but the overwhelming default is security over functionality.

I think this is essentially what Schneier envisions.

Re:How to secure Microsoft Windows:

[ergo98]

Look, if you don't know what you're talking about, just don't post

Uh huh...Let me introduce you to the pot...

C++ has bounded strings

It does? Wow, news to me. Oh, you must mean that there are various different standard templates and proprietary classes to handle strings, that happened to be implemented in C++! Ah, okay, thanks for updating me on the obvious, but unfortunately you're wrong, and even in C++ code most developers shun the class strings for good old fashioned char * due to performance reasons. Or do you consider CString and the STL "C++"?

Note that the vast majority of the recent MS buffer overruns have been in C code, not C++

Wow you really make quite the differentiation between C++ and C, don't you? Perhaps you're not aware, but C++ is largely backwards compatible and is a superset of C, rather than a whole new ballgame : Most of those ISAPI modules are C++ programs that use C features like char * and strcpy: That doesn't preclude them from having classes or using template libraries in addition. The fact that I said "C++" was merely because it's a "no shit" type conclusion that they're using C++ features, but it is the C remnants that are usually the causation (but the code is still in C++).

And putting variables on the heap will just slow execution speed down with little to no security gain: heap overflows can be exploited too, just not as easily by cut-and-paste exploit writers.

Heap overflows are significantly more difficult to control in a deterministic fashion that stack overflows. i.e. night and day. Of course they shouldn't happen in the first place (it should have the possibility of happening), but simply brushing it off is laughable.

Re:How to secure Microsoft Windows:

[ciole]

Well, let me state that there are cases where starting from scratch makes sense...
Beware a programmer who ever claims that they need to rewrite something: 9 times out of 10 it's because they are lazy, or they're just not smart enough to figure it out.

Yep, there are cases when starting from scratch makes sense. And there are reasons unrelated to a coder's lack of skill that can push projects to that point. The determination as to if a prior work should be scrapped ought to be left to the person most familiar with the project. If you hire good programmers and good workers, and later need to rely upon them to make this decision, you won't need to "beware" them.

Re:How to secure Microsoft Windows:

[A Big Gnu Thrush]

I have used Mac OS X.

I agree with everything you said... but they scrapped OS 9 and started -- not from scratch -- but from proven technology and a proven codebase and built on that.

They still made the mistake of spending _years_ developing their very own "we invented it" operating system in Copland that was never released or completed. With my quip about things turning out badly, I mean the time wasted with Copland can't be recovered and cost them dearly in their competition with Windows. OS X is a great example of this. It's a great operating system but no one cares because they've been using Windows so long they don't even think about it anymore.

I hope Apple does well.

Re:How to secure Microsoft Windows:

[Anonymous Coward]

Linux is on year 11, and still sucks. What gives?

Re:How to secure Microsoft Windows:

[Anonymous Coward]

One would think that coding software that runs on everthing from NetBSD to AIX would also lead to some warty code (and since the topic is security, consider the maintainability of the old stuff like sendmail).

Re:How to secure Microsoft Windows:

[Anonymous Coward]

Copeland wasn't a "from scratch" rewrite at all. It was a major Win95-style overhaul of the existing OS.

The main problem (despite being years late) was that it would have broken virtually everything and still not provided a fully pre-emptive and protected memory system.

Apple did try several other "from scratch" projects that never went anywhere -- Pink and Taligent, for example.

Re:How to secure Microsoft Windows:

[Zeinfeld]

The ACL security moddle they ripped from VMS is great.

Try adding one to each letter in VMS...

The similarities between WNT and VMS are well known and hardly suprising since Dave Cutler was lead architect on both. I seem to recall ACLs are earlier, didn't Butler Lampson invent them in Multics or something?

Anyway the point Butler always makes when ACLs are discussed is that they are too granular. What you really want to be able to do is to associate a named security policy with the actual resources (files, devices, etc. etc.) and then have the ACL rules stored in the policy. This has two major effects, first it makes the system more manageable since you don't have to spend time propagating out all your ACL changes, secondly the O/S can cache the result of evaluating the ACL which saves a lot of time when doing things like directory copy operations.

VMS actually introduced a structure like this called a rights identifier, however it appeared after Cutler left so it may have been one of the features he always hated and had kept out as long as possible.

Re:How to secure Microsoft Windows:

[jeffy124]

ok, now i know what you're talking about. thanks

This is too funny.....MS Security ROFL ....

[CDWert]

MS is NOT a security driven developemnt enviroment.

This kills me every time I read it, almost as much as the Linux sales memo, Can you see all the MS developers huddling around saying Ok were going to tighten the security up here,..... HA, they obviously didnt have a clue on the security side of things to begin with, the MS project managers preaching security over all. this is the blind leading the blind and the deaf.

Its great for marketing, well that is if it dosent backfire, if theeir stuff dosent get a whole lot tighter a whole lot quicker its going to make them look yet worse, they (MS) acts as if secuity didnt need to be a main goal. Shit, the Govt has judges ordering other govt websites down because of inadequite security on MS servers (Dept Interior?)

MS is going to push now, more than ever to limit disclosure, through this they can APPEAR to be accomplising their lofty goal set by BG.

This should be a funny story to watch , as they say it aint over till the fat lady sings ;)

GOTT MIT LINUX

Re:This is too funny.....MS Security ROFL ....

[Anonymous Coward]

awake this early in the day

Where the FUCK do you live?

It's very late in the afternoon and I going to get totally pissed in a local pub soon. It's been a hard day and I've been working like a dog.

Re:This is too funny.....MS Security ROFL ....

[schon]

they obviously didnt have a clue on the security side of things to begin with, the MS project managers preaching security over all. this is the blind leading the blind and the deaf.

This is 100% true, although I would have phrased it differently.

I saw an interview with Scott Culp, who said that security for Win2K was a "show stopper" (yes, I know he's using the term incorrectly) - any developer who spotted a security bug could stop the release so that the bug could be fixed.

When this was mentioned to people in the security community, the response was generally "I'm skeptical about this".. but I believe Mr. Culp.

The problem isn't that MS doesn't take security seriously, it's that they don't know how to write secure code. It's one thing to say "If you see a securty problem, report it", but what if the person doesn't know how to recognize a security problem in the first place?

This truly is the blonde leading the blonde.

Really good or really bad.

[st0rmshad0w]

Considering the amazing amount of interest at hammering away on MS products, this new "shift in focus" will either wind up producing one of the most sercure set of products ever(highly doubtful, IMO) or it will be a long, drawn out, yet abysmal failure as each new change becomes defeated as fast as its implemented.

Either way, its going to take quite a while to tell.

Re:Really good or really bad.

[shani]

Maybe what we need is.... the War on Security. :)

Re:Really good or really bad.

[Anonymous Coward]

It just figures that a pro-MS comment, no matter how true, would get rated as Flamebait here. Apparently most Slashdotters can't handle facts, unless they support their own narrow linux-centric viewpoints. Competition's only good when it makes Microsoft look bad, right?

Microsoft's First Security Policy

[gspeare]

The first thing Microsoft is going to do under their new "security first" paradigm will be to announce that due to security concerns, they can't tell us what any of their security upgrades actually are.

Re:Microsoft's First Security Policy

[ackthpt]

Their specially trained Microsoft Certified Security Specialists will show you where it says "AS-IS" on the license for which your company shelled out a significant percentage of all company/enterprise purchases.

Why is it people will easily spend >$100,000 for software licences with include the cop-out "Software is Provided AS-IS", but if you saw a Ferrari and a Buick beside each other, they'd shy toward the Buick if there was an "AS-IS" sign in the window of the Ferrari? (Rhetorical question)

Re:Microsoft's First Security Policy

[LittleGuy]

This is eerily true. it's been over a month since the last MS Security Patch, MS01-060. The only other "Service Pack/Security Patch" has been XP-SP1.

Re:Microsoft's First Security Policy

[Anonymous Coward]

This link prolly deserves it's own story:

What about the potential implications for Linux?

[Shoeboy]

Ok, I think we can all agree that M$ has been making life hard on Linux advocates. First off they come out with Windows 2000 which doesn't crash and then they follow it up with Windows XP which also doesn't crash.

Of course, this hasn't stopped us from complaining about Windows stability (a true zealot is never deterred by facts), but it has made us look a bit ridiculous.
So what happens when Windows becomes secure (assuming this happens). It'll be a sad day for Linux advocates everywhere is what will happen. Window will then join VMS, OSX and FreeBSD in being basically superiour to Linux. Thank god for BeOS going extinct, because, as a Linux advocate I jsut don't think I could bear that.

Anyway, Micro$haft (he he, aren't I original), please don't make a secure product. Please, I'm begging you.

Your former employee,
--Shoeboy

You say paranoia, I say FUD

[Happy go Lucky]

A whole bunch of people, a few days ago, seemed to think that Billy's statement only made sense in the context of the settlement. He and MS wouldn't be required to give out so much information if they claimed a security concern.

I mostly think it's advertising. XP didn't sell nearly as well as they had hoped, and a bunch of people flying around with Madonna playing in the background didn't seem to send their message. And I'd be willing to bet that security concerns were most of the reason-they WERE the reason with my employer.

The tech world is full of reviewers and publishers who will publish Gates' statements as thought they were spoken from the burning bush. God only knows, they shill for advertisers just as bad as gun magazines.

Re:You say paranoia, I say FUD

[gmack]

Personally I think this was all about truth in advertising.

What was the message with the song they used for windows 95 ? Oh yea "she makes a grown man cryyy"

Now we move on to XP and they use an artist known for sleeping around. I think it's allegory someone somewhere was sending the message "anyone who wants in can have me"

Re:You say paranoia, I say FUD

[Anonymous Coward]

AARRRGGHHH!

Your post is Slashdot group-think at its worse.

XP sold just fine. It's the most advanced Windows so far. It's fast, it's reliable (it hasn't crashed for the last four months I've booted into it every morning) and looks good.

Don't forget that it's a de facto standard too. How many of those client Word file attachments can you open with your Linux?

Re:You say paranoia, I say FUD

[Happy go Lucky]

Personally I think this was all about truth in advertising.

What was the message with the song they used for windows 95 ? Oh yea "she makes a grown man cryyy"

Truth in advertising my ass. That song also includes the lines "If you start me up, start me up and I'll never stop."

Just for clarification...

Re:You say paranoia, I say FUD

[Anonymous Coward]

These particular assertions would hold a lot more water if you hadn't been making them continuously since the early 1990s :)

Re:You say paranoia, I say FUD

[(void*)]

If you start me up, start me up and I'll never stop crashing.

Windows needs a clean break

[Dephex Twin]

Windows is too backwards compatible, IMO. Too much building off of old stuff. Microsoft needs to make a new version more or less from scratch, like Apple's transition from the old Mac OS to OS X. It isn't a quick or easy transition, but it will pay off in the long run.

I guess that's the problem when you are a huge software company trying to appeal to everyone. You end up supporting everything and it turns into a big mess.

mark

Re:Windows needs a clean break

[Gogl]

You are right in the sense that doing that would be the best for Windows, especially in the long run. However, that scenario terrifies me more then anything.

My box has a Linux partition and a Win2k partition. I keep Windows for games, and because in all honesty 2k isn't that bad. It's got all the stability and such of XP, but none of the Big Brother. 2k is also quite secure if you know what you're doing. And I like playing games. I have vowed to not update to XP however, as the whole embedded passport thing and such really scares me.

However, if say, 2 years from now Windows RG (Really Good edition) comes out and is NOT backwards compatible, now new games only come out for it. I'd presume that if anything this hypothetical WinRG will be worse then WinXP in terms of Big Brother-ness, ergo I'd be even more hesitant to upgrade. That and it'll be even more eye-candy and more dumbed-down and all that stuff. But if I want my games, I'll have to upgrade.

So that's why it's scaring me. I hope they keep their backwards compatibility, as I would personally like to just keep running 2k for as long as I can. Or at least if they do lose the backwards compatibility, wait until Linux gets enough market for games to be more available for it.

And yes I realize the irony in talking about Linux games in the wake of the death of Loki.

Re:Windows needs a clean break

[Mr. Piccolo]

You do realize that backwards compatibility is holding computer technology in general back, right? Otherwise we would have Star Trek computers already.

Re:Windows needs a clean break

[WildBeast]

They can't, they don't have any say in the matter. Many consumers still want to be able to run DOS and legacy software especially for accounting software.

If Windows isn't too backwards compatible, people will complain like hell and use another OS.

Having a huge marketshare certainly have its advantages but it sure have a lot of disavantages.

Re:Windows needs a clean break

[mmaddox]

Can you provide some specific instance that illustrates your point? It appears to me that the backwards-compatibility bits of Win2K and XP have provided a more secure Windows environment, rather than less. For instance, the Virtual Machine used to house 16 bit Windows applications provides a sandbox for ill-behaving applications.

Backwards-compatibility is at the core of none of the current security problems currently within Win platforms - at least none of those I can bring to mind. Please, prove me wrong.

Re:Windows needs a clean break

[L-Wave]

You make a good point, but its also contrtadictory, you are saying that if Microsoft breaks old software and consumers still want to use DOS, they will switch a new new operating system (thus STILL not being able to run DOS programs...)

"If Windows isn't too backwards compatible, people will complain like hell and use another OS"

A little bit of backwards compatibility is better than NO compatibility =)

just my 2cents =)

Re:Windows needs a clean break

[perky]

I can think of another OS that has a lot of legacy gubbins in it. In fact it's based on a design that's been around far longer than windows.
I'll give you a clue: it begins with the letter L.;)

Re:Windows needs a clean break

[cvd6262]

Microsoft needs to make a new version more or less from scratch

I agree to a point.

What MSFT need to do is migrate to a more modular structure. If they just rewrite their entire codebase, they may wind up with better security in that iteration, but they will still need to rewrite for their next version, possibly opening up new holes.

Unix has been tested through time, and not rewritten from scratch every version. Because of its modular nature, only the effected pieces must be rewritten each revision, in theory, keeping the security form on generation to the next.

Apple's move to OSX has created this modularity and MSFT would benefit more from that than from just totally re-creating their code.

Re:Windows needs a clean break

[Anonymous Coward]

Yeah, but it takes MS about 5 years to steal from Apple, ...er, I mean innovate.

A BSD-based WindowsX won't be available until around 2007. (At which time, Gates will trumpet it like he invented UNIX).

Anonymous Kev
Proudly posting as AC since 1997

Re: Windows needs a clean break

[Anonymous Coward]

> Windows is too backwards compatible, IMO. Too much building off of old stuff.

I'm not sure that's the basis of their notorious security problems. All OSes have bugs that cause security problems.

What makes MS stand out from the crowd is their insecurity-by-design "click here for the latest virus" attempts at ease-of-use. Essentially they have tried to make EDI available to Joe User by removing all the controls that make real EDI safe to use.

And of course, they will never take away this kind of "ease of use" feature, because the idiots that get bit hardest by the viruses will also be the idiots who scream loudest when someone tries to take it away.

[B.P., posting from P&M's Windows machine.]

Re:Windows needs a clean break

[TeamSPAM]

I would like to point out as a long time Mac user and curent OS X user, I'm still running pre-OS X applications in the Classic env (Some PhotoShop and Mac Office 98 mostly). Moving foward with Apple doesn't mean I have to dump all the applications I was using on Mac OS (Granted some apps may not be compatible with the Classic env.) Apple has been pretty good about providing some backwards compatibility. This includes the 68K emulation on PowerPCs, and Classic env on OS X. I would like to think that this compatibility is easy because programmers generally have to write apps to Apple's APIs. These APIs keeps the programmers at a slighty higher level and gives Apple more freedom to change/improve the underlying OS /hardware. Examples of this are the move from a CISC CPUs to RISC CPUs and from the Mac OS to a BSD core OS.

Back to the security aspect, the Mac OS was pretty secure because of it's small market share and was a single user OS with few to no services running to exploit. Generally, the user had to install and run the service for it to be active. While OS X seems to be pretty secure, I expect that some of the exploits for *BSD will apply to OS X also. Most services seemed to be turned off by default, they can be turned on and possibly open the user to expolits. Where as on Windows, services seem to run weather you wanted them to or not.

Re:Windows needs a clean break

[Geeyzus]

Windows is too backwards compatible, IMO.

Backwards compatibility is bad.... why?

I hope you just mean they should start with new source instead of patching up the old (which I agree with).

Office 95 will still run on my Windows 2000 machine (yeah yeah I use Windows, sue me). This is a bad thing? If Windows XP was NOT backwards compatible with software, all we would hear about on Slashdot is how they are forcing users to buy new software.

Mark

Re:Windows needs a clean break

[Monkelectric]

What if all this security talk is ... Preperation for building a DRM (digital rights management) OS? The insecurities of the current MS OS's is what makes a DRM os impossible ... Right now I get around alot of DRM stuff with my 10 channel sound card ( m-audio delta 1010), by routing sounds out the digital outs and sending a copy to its internal mixer ... then I can record the mixer (digitally) :) ... of course Im a true pirate, mostly I use this technique to save (real player) NPR broadcasts for my father :) But I think that wont be possible soon

Re:Windows needs a clean break

[darkwhite]

"Embedded Passport thing"?

I mean, I use XP, and turning off the Big Brother features is as easy as getting a corporate edition (ok, not very easy for those who want to actually buy it) and turning off a bunch of services, setting a few policies, and uninstalling Messenger after install. Oh, and configure Media Player and IE, or just don't use them.

After that, it's pretty much the same as win2k in terms of spyware. In other areas, though, it has some notable improvements.

Re:Windows needs a clean break

[Dephex Twin]

I don't mean that Windows shouldn't be backwards compatible, they just went overboard with it.

With my OS X machine, I can still run pre-OS X software. I can either run it in "classic" mode, or boot up into the OS 9 system. Both of which, by the way, are extremely simple to do.

That's the way to go, I think.

mark

Re:Windows needs a clean break

[Tackhead]

> However, if say, 2 years from now Windows RG (Really Good edition) comes out and is NOT backwards compatible, now new games only come out for it. I'd presume that if anything this hypothetical WinRG will be worse then WinXP in terms of Big Brother-ness, ergo I'd be even more hesitant to upgrade. That and it'll be even more eye-candy and more dumbed-down and all that stuff. But if I want my games, I'll have to upgrade.

Three words: Removable drive racks.

As long as IDE exists (which should be good for another 2-3 years), if you must use Windows, keep an old '98, W2K, or Linux/FreeBSD install on separate a hard drive with your data and applications, and install Windows RG on another drive.

Wanna work? Use the main drive. Wanna play the l33t new game? Yank it out and boot RG. No Gatesian DRM tech or spyware will ever be capable of corrupting or leaking data stored on an unpowered hard drive that's been physically disconnected from your machine.

Re:Windows needs a clean break

[archen]

Star Trek computers already

You mean computers with lots of flashing lights and unlabeled buttons that people just seem to know what to push? We already have those in casinos.

Re:Windows needs a clean break

[bokmann]

Much like the way OS9 apps run in a 'sandbox' in OSX, This hypothetical WindowsRG could run a sandbox for legacy apps.

So, following Apple's lead, Microsoft should make a new gui environment running on top of a unix, that runs older apps in a sandbox...

Wait a minute... Sounds like Linux, KDE/Gnome, and Wine! Problem solved!

Re:Windows needs a clean break

[Sloppy]

Legacy is Windows most important feature. All other considerations are secondary. If you don't have a legacy, you have no reason to use Windows.

If they made a clean break, then they would be on a level playing field with competitors. Is improving their product, which people are buying anyway regardless of its flaws, worth losing customers?

Re:Windows needs a clean break

[Aqualung]

You mean computers with lots of flashing lights and unlabeled buttons that people just seem to know what to push? We already have those in casinos.

AHAHAHAHAHAHA! Oh, if only I had mod points... give the man some +1 FUNNY!

Re:Windows needs a clean break

[Cuthalion]

What's this passport deal?

I mean it. I've been using XP for a good number of months. I don't have a passport account. I haven't even been prompted to make one. If I wanted to use MSN Messenger, I would have been, but I don't, and I uninstalled it (you have to poke around a bit to do that, but it's not impossible, or even difficult).

Did it secretly make a Passport account and not tell me? Is this all just a load of crap? What's going on here?

Re:Windows needs a clean break

[Dephex Twin]

That is why I think Apple's OS X does things well. It's tough to move onto a totally new form of your OS. After OS X initially came out, machines were set to dual boot, with OS 9 as the default. The dual booting process is easy. For those using OS X, one can also run "classic" mode and get OS 9 within OS X.

But there needs to be a separation between the old and the new-- that is the most important thing.

mark

Re:Windows needs a clean break

[bfree]

No Gatesian DRM tech or spyware will ever be capable of corrupting or leaking data stored on an unpowered hard drive that's been physically disconnected from your machine.

Well if this is the "Gatesian" DRMOS then it will probably require a DMR Bios which will corrupt your HDD when you insert it (unauthorised hardware, format in progress ... done!)

Re:Windows needs a clean break

[moogla]

Yes and no.

The model is still the same, this is true. A lot of shell scripts and code will still work on a new Linux system. If you must ask why, because it was pretty good to begin with. Can anyone think of a good reason to get rid of the BSD sockets API?

On the other hand everything under the hood has been changed and is decidedly not backwards compatible. The jump from Linux 1.0 to 2.0, the jump from libc5 to GLIBC 2.x, these are all breaking points. All new driver architectures, APIs, even executable formats. I don't think Linux is being held back. Having old API compatibility is not a bad thing, but even then, they often must say: This is it, this old stuff is deprecated, we're not supporting it anymore. For example, the RAID system is neither forwards nor backwards compatible in any way between 2.2 and 2.4. Stuff like that.

Plus, there's a difference between designing an OS to have legacy support and actually emulating the legacy system. Forcing someone to recompile or edit the aging code slightly can give someone freedom to implement the compatibility layer any way they see fit, instead of having to keep it "in place" and organize new features "around it".

Re:Windows needs a clean break

[Anonymous Coward]

Would that be sorta like how WindowsNT runs Windows 3.1 apps in a sandbox? Or is it time to start over again and invents something else so that we can run NT apps in a sandbox?

Re:Windows needs a clean break

[Anonymous Coward]

Apple has been pretty good about providing some backwards compatibility.

I'm sorry, but relative to Windows, Apple's backwards compatibilty just sucks. Every major change (System 7, PPC, PCI/OT, OS 8, OS X) breaks some percentage of apps, and after a few years, none of your old apps work any more.

Take any random business app from 1992 and install it on Windows XP. 9 times out of 10, it will work.

Mac users are just used to praising the great Steves whenever some change doesn't break 100% of their applications. Windows users have much higher expectations (their businesses depend on it).

Re:Windows needs a clean break

[ethereal]

Exactly - by basing backwards-compatibility at the source rather than the binary level, Linux is leaps and bounds ahead of Windows in terms of providing new features but still providing backwards compatibility. 30-year-old Unix code runs on Linux with a recompile.

And the source expectation has let the core Linux developers not worry about backwards compatibility so much. If you read the kernel mailing list or the KT articles, Linus will pretty much switch to a new interface at the drop of the hat if he thinks it's the right thing to do, and often will even allow things that slightly break backwards compatibility if they will force developers to start doing things the Right Way(tm). This would be suicide for a commercial OS/tools vendor, but it's one of Linux's strengths IMHO - it can change quickly if necessary, but anyone can still hack up the code to work with their legacy apps if they want to.

Re:Windows needs a clean break

[Iguanaphobic]

You are right in the sense that doing that would be the best for Windows, especially in the long run. However, that scenario terrifies me more then anything.



Wrong. This would be the absolute worse thing for Windows. The whole monopoly is based on being the only system that will run legacy MS 32 bit code well. If people are faced with a clean break (new OS, new apps, new paradigm) they would NEVER choose MS based on merit. This will never happen for this reason. It's too big a risk for MS and their whole corporate strategy is based on offering LESS choice to consumers, not more.

Re:Windows needs a clean break

[ZxCv]

It is a load of crap. Just because they put it right there in your face to try and get everyone to do it, people think that they have to. I did the same thing you did--said No to a passport account and uninstalled messenger. But somehow it isn't exactly common knowledge, so I can see the scenario where someone just gets so fed up with seeing the little thing ask if they want a passport that they finally do it just to make the little nag go away.

Re:Windows needs a clean break

[Reziac]

M$ already tried this. It's called WinXP. 'Nuf said. :)

Re:Windows needs a clean break

[Anonymous Coward]

They could defeat your soundcard with the DRM features in Windows today. Windows Media requests absolute security, the midlayer checks to see if your soundcard driver is certified (signed), and if not, it refuses to play (if so, it disables loopback).

Re:Windows needs a clean break

[Zoots]

Apple has been pretty good about providing some backwards compatibility. This includes the 68K emulation on PowerPCs

Apple did this out of necessity, not kind benevolence to their users. Most of the MacOS was written for the 68K Instruction set when Apple shipped the first PowerMacs. It wouldn't surprise me if half of the OS9x code is not PowerPC native. OSX, in the spirit of backwards compatility, will not install out of the box on my 4 year old clone. *sigh* I wonder if the predictors of the computer "revolution" envisioned disposable machinery.

Re:Windows needs a clean break

[yomegaman]

Don't forget the little hole for shining blue light on the user's face.

Re:Windows needs a clean break

[yomegaman]

The users wouldn't necessarily switch to a new OS, they would probably just stick with what they already have. Of course, from Microsoft's point of view this is every bit as bad.

Announcements....

[tcc]

Let's wait and see, announcement are just words, let's see how they will react when there's going to be another big security hole (because there always are going to be, and that on just about any platforms, but especially with Microsoft), if they've really changed philosophy, they will react more quickly (as in programmer-wise and not PR-marketting-wise), and not handle this as a press release taking their customers for complete idiots and reacting immaturely blaming people that finds the bugs as "terrorists".

And anyways, for those of us that are on some security mailing lists like NTbugtraq, we'll see how the people got their discovery handled by Microsoft, if they change for real, maybe we won't read as many "We notified microsoft 3 weeks ago about this matter and nothing was done, now it's time to bring it public" and then having the Microsoft PR and legal team on their back.

I think they are starting to feel the heat of people that are really not satisfied and claiming that buisness damage due to insecure OS should be fined to the creator of the OS, especially when they claim it's secure. Heh.. good thing.

Getting ready for the setlement

[bitty]

Someone brought this up in another article, so I can't take credit.

The settlement with the DOJ specifically allows Microsoft to exclude documentation of APIs that relate to security. This new initiative makes damn near anything in some way relate to security. Gotta love it.

Re:Getting ready for the setlement

[Anonymous Coward]

The settlement with the DOJ specifically allows Microsoft to exclude documentation of APIs that relate to security.

Are these dudes completely out of their fu**ing mind?! WRT security those are the most important API's to document!

Re:Getting ready for the setlement

[geekoid]

Bingo!

Re:Getting ready for the setlement

[nathanm]

The settlement with the DOJ specifically allows Microsoft to exclude documentation of APIs that relate to security. This new initiative makes damn near anything in some way relate to security.

You've hit the nail on the head. After reading the articles and many of the comments, I still wasn't convinced one way or the other what the purpose behind their new security push was. Now I am.

The settlement requires them to disclose APIs to competitors, unless it has to do with security. Now they'll add to/change their APIs at will, and claim it's for security reasons. Business as usual for MS, this settlement is even weaker than I thought.

If it affects the share price, MS will move fast

[Ars-Fartsica]

I think people are generally wise to be jaded about security in current MS products, but this company has demonstrated over the years that they will go into overkill mode on issues that appear to have a profound affect on the share price.

I would look for MS to make at least two major acquisitions in order to shore up their security offerings - they have used acquisitions in the past to shore up problem areas.

Of course the caveat is that they are not so much concerned with security as an intrinsic value but in the selling of security, and there is an important distinction here. As with any growing software market, you can't underestiamte Microsoft's efforts, and I think it is largely naive for the readership here to snicker and write off MS in this regard.

MS security = oxymoron

[peter303]

oxymoron: (def) A two word phrase in which the meaning of the first word contraditions the meaning of the second word.

Re:MS security = oxymoron

[yatest5]

Linux Zealot: (def) A two word phrase describing someone with a life so empty they haven dedicated themselves to trying to change the OS that everyone else uses in the mistaken belief that other people actually want to be told what OS to use my a 14-year old virgin fat sweaty fool.

Re:MS security = oxymoron

[Anonymous Coward]

The moderation on this comment is typical slashdot mentality. This is, in my opinion a funny comment!

In Other News....

[wo1verin3]

... All Pig Flight Training School Opens

Re:What about the potential implications for Linux

[Tim C]

First off they come out with Windows 2000 which doesn't crash

It doesn't crash as often, and is a vast improvement over 98, but it does crash. Of course, this is a bog-standard Professional install with Service Packs 1 and 2 and a few fixes from Windows update applied, used mostly to play games, so YMMV. (In fact, once every few boots, it boots to a black screen and sits there indefinitely (this defined as being "beyond the limit of my patience", ie significantly longer than on a successful boot.)

To say that it doesn't crash at all, however, is as inaccurate as saying that Linux never crashes.

Cheers,

Tim

dont expect much

[LiquidPC]

Microsoft has no plans of beefing up security; they just wanted to give slashdot-users some more stories to submit and things to flame about.

Preservationist

[ttimes]

Given what seems to be a backroom deal with the current administration designed to protect a convicted monopoly, the main chink in Microsofts armor is its lack of security. Hopefully this latest rhetoric will be seen as the hot air it is and in the least, remembered so as to hold them accountable at a later date.

Leaked memo!

[NetRanger]

Here's a memo leaked to me from Bill Gates himself:

January 25, 2002
Fr: Gates, Bill (Microsoft-Redmond, WA)
To: All Mail Users
Re: New Security Focus

I'm sure that everyone here has read our previous announcements in reference to the new security focus here at Microsoft. Let me be the first to make sure it is clear that these announcements will be followed up by actions, not just words.

Of course new technology is what Microsoft is all about, so I am dictating this letter to you as you read it.

Of course you know we have already taken the initiative to instruct the Windows team to cease development of new features, and focus on using existing technology from our competitor's software for placement into Windows, over ten years ago.

Now it seems that some of the "glue" holding all these technologies together has, shall we say... uh, cracked.

Therefore it is imperitive that we cease adding new functionality not relevant to squashing those little bastards who think they have a better haircut than me!!!! and... uh...

I mean, we really need to focus on stability and security, I mean, after all, to meet our vaporware deadlines we didn't really get the chance to read the code we stole... I mean, to reincorporate new ideas properly into Windows.

You know, I'm turning this damn dictation off now ASH!*%(#@$

[End of File]

Re:Leaked memo!

[Anonymous Coward]

> Here's a memo leaked to me from Bill Gates himself:
...
> [End of File]

You forgot the most important part of the entire message:

Please click the attachment for more information!

[B.P., posting from P&M's Windows machine.]

Re:I'll belive it - heh

[jgerman]

Obligatory Simpson's quote:
"You're charming the pants off of me"
"What did you say Aunt Selma"
"I said take thos damn glasses off!"

The register ...

[MrBandersnatch]

www.theregister.co.uk also covered this with editorial this week.

My stance is that if they dont treat security seriously then it WILL only be a matter of time until more secure operating systems erode their market share. Pure lower cost of ownership and reduced administration hassles will drive this.

However they have a HUGE problem in that current versions of windows are so riddled with holes of one shape, size or form so much so that they realistically should be providing free upgrades to every user to make their systems secure.

Microsoft give a free upgrade though? Lol choke - wheres the ambulance?

How to make your Windows box secure

[quantaman]

Step 1. Disconnect the phone line, ethernet cable or whatever other device you use to connect to the internet.
Step 2. Drag all documents that you consider a risk to exposure to the recycling bin, recycle them, then use a disk utility to cover up all traces.
Step 3. Delete IE, MS Office, Outlook Express, and the Windows operating system from your computer.
Step 4. Take a large can of gasoline, a sledgehammer, and a match, and tape a photo of Bill Gates to the side of your machine.
Step 5. Follow your instincts.

One other reason

[ouija147]

They have always gotten people to upgrade software for the newest features. This will be the way they can get people to buy the latest software. Their products are so bloated with useless features that no one sees a reason to upgrade what they have, but to stay secure? People might buy that "feature"

The revenue stream has to stay flowing and this will force IT people to upgrade. If they don't and they get hit by some nasty bug/virus/worm the CEOs will have their heads.

But does this leave MS open to lawsuits...nah not likely what with their EULA

Oh well

Re:One other reason

[yatest5]

Their products are so bloated with useless features that no one sees a reason to upgrade what they have

Whoa there horsie, way to slip in a lame dig at Microsoft there! I think what you meant to say was 'Because their software contains all the features their users need, they see no reason to upgrade'. Having extra useless features is not going to discourage anyone from upgrading. This makes you a biased idiot, but way to karma-whore.

Re:One other reason

[yatest5]

Note to moderator: You are a fucking idiot. Who was I trolling? All those pro-MS people who read this site???

Re:One other reason

[Anonymous Coward]

Who was I trolling? All those pro-MS people who read this site???

So, you think it's OK to troll pro-MS people but not Linux people?

What a bigot.

For your information, I am a pro-MS guy and read Slashdot on a daily basis.

Re:One other reason

[Anonymous Coward]

Same here, Anyone else. (I don't hate microsoft, I LOVE Windows XP and I LOVE Mandrake 8.1)

Schnier co-writes a bad column!

[petej]

Usually, Bruce Schnier writes good stuff, and I enjoy reading it. This time, though, the piece is riddled with misinformation and poor advice. I'm surprised.

SOAP isn't just a Microsoft protocol, for one, but the main problem with that paragraph is that SOAP was not designed to elude firewalls, any more than RPC was. SOAP is just an RPC mechanism that happens to flow over HTTP, mostly because Dave Winer only knows one protocol -- HTTP. Mr. Winer didn't try to evade protocols, he just couldn't conceive of creating a different protocol for this application -- an error of omission, not commission.

In terms of file and media distribution, the function of a HTTP server, FTP server and gopher server are very similar, so there's actually some sense in bundling the three together (and MS isn't the only group to do this). The security problems come when dynamic execution is added to the mix in HTTP. Mssrs. Schnier and Shostack desperately want to undo this, but they don't have the right answer -- the problem isn't stocking the three protocols together; it's that the Internet gave us three ways to do the same thing. To really address the security issue here, we should probably go back and redo the protocols so that dynamic content and media content flow over separate protocols, but there's no chance of this happening -- HTTP didn't kill FTP, and even gopher is making a mild comeback, so we're stuck with this mess for a long time.

There's some good advice regarding security in that article, but the authors' notions of product design are off-target, and contrary to the direction a lot of folks (even those beyond MS) are taking.

Re:Schnier co-writes a bad column!

[boltar]

Neither HTTP nor Gopher killed off ftp for one major reason. Both the former protocols only
support download. Ftp supports upload too. The http POST method doesn't count since it doesn't
upload to a directory , merely to whatever cgi app wishes to receive the data and besides which
I'm not sure it would be able to stomach a 2 gig upload of the latest Linux distribution for example.

Re:Schnier co-writes a bad column!

[Zeinfeld]

SOAP is just an RPC mechanism that happens to flow over HTTP, mostly because Dave Winer only knows one protocol -- HTTP. Mr. Winer didn't try to evade protocols, he just couldn't conceive of creating a different protocol for this application -- an error of omission, not commission.

One of the principal architects of SOAP was Henrick Frystick Nielsen, who certainly knows about more protocols than just HTTP since he implemented them all in the CERN libwww code.

The point is that running SOAP over SMTP or NNTP does not make a lot of sense except to looney email junkies who need a strong does of reality. SOAP over FTP makes no sense because FTP is a fundamentaly bodged protocol, it is less efficient that HTTP in every circumstance, it is also designed as a human/machine interface and is actually fairly brittle when used as a machine/machine interface due to different incompatible implementations and interaction between the ftp daemon and the file system semantics. The number of special case code paths for FTP in the libwww code is quite large. Some folk are trying to combine FTP and SSL which is not a good plan because FTP is actually built on Telnet and there are good reasons not to use SSL with Telnet which is why SSH is no longer based on SSL.

Henryk certainly knows about designing new protocols as well, he was one of the principal architects on HTTP-NG which people refused to use because HTTP was good enough for them.

SOAP actually layers over several transport protocols but the only one most people have any interest in is HTTP. There is a small interest in BEEP, but BEEP is a fairly new protocol that is probably only simple because nobody has used it yet and so we don't know what it lacks.

I don't have much sympathy for folk complaining about the use of the 'firewall bypass protocol'. Firewalls are like chastity belts, they are mainly bought by people who intend others to wear them and suffer their inconveniences. They are also like chastity belts in that they tend to be less effective than the purchaser imagines.

SOAP traffic is actually quite easy to detect in HTTP, just examine the Content-Type field. It is strange that Bruce should get so excited about this and say nothing about Java that deliberately disguises itself as application/binary to prevent firewall filtering (and yes I did suggest Gosling chage this before they release Java, they refused).

Re:Schnier co-writes a bad column!

[Anonymous Coward]

> In terms of file and media distribution, the function of a HTTP server, FTP
> server and gopher server are very similar, so there's actually some sense in
> bundling the three together (and MS isn't the only group to do this). The
> security problems come when dynamic execution is added to the mix in HTTP.

Uh... no... The security problems come from opening up more point of entry, and
hence more point of vulnerability without the intent (and sometimes knowledge)
that you're doing that. Dynamic execution opens up other problems, but if there
are vulnerabilities in the daemons themselves (which invariably comes up now and then)
you're providing more opportunity for exploitation.

Re:Schnier co-writes a bad column!

[thrig]

...are good reasons not to use SSL with Telnet which is why SSH is no longer based on SSL

Err, when was SSH ever based on SSL?

Re:Schnier co-writes a bad column!

[petej]

By this logic, we should all supply our own implementation of printf, because every program that calls the one distributed with the C runtime is a new "point of entry" and thus more vulnerability.

The other way to approach this issue is that if common functions are implemented in common code, then fixes are quicker to implement and deploy. If all those services validate a path and play a file over various protocols, then to the extent you can reuse the path-validation and file-playing code, you improve your ability to fix problems, and as the code matures, you reduce your risk of new bugs by reusing mature code.

Re:Schnier co-writes a bad column!

[simm_s]

While I do not think you are a troll, I think you have rushed to judgement without thinking clearly.

Schnier never said SOAP was a Microsoft product he said "Implementation of Microsoft SOAP...." The reason why web services are so convienent is because they can bypass inconvienent security devices by tunneling through other protocols such as HTTP/HTTPS. Embedding a control protocol (SOAP) in a data protocol (HTTP) is just as bad (security-wise) as macros in email documents.

It is not easy to disable SOAP services without disabling HTTP. Sure you can use a packet filter but that just adds another layer of issues to deal with.

Seperating IIS from one large service to a many smaller services is a good idea. If a flaw is found in ftp it will be less likely to hurt the http server.

Redoing the protocols does not make any sense from a business point of veiw. Adding new open standard protocols to IIS (leading by example), is a more logical idea.

Re:Schnier co-writes a bad column!

[bXTr]

I don't have much sympathy for folk complaining about the use of the 'firewall bypass protocol'. Firewalls are like chastity belts, they are mainly bought by people who intend others to wear them and suffer their inconveniences. They are also like chastity belts in that they tend to be less effective than the purchaser imagines.
So, I should just let all the spammers, script kiddies and hackers (not crackers; I mean HACKERS) just break into my computer whenever they wanted. Do you understand ANYTHING about security?

Re:Schnier co-writes a bad column!

[NearlyHeadless]

Schnier never said SOAP was a Microsoft product he said "Implementation of Microsoft SOAP...." The reason why web services are so convienent is because they can bypass inconvienent security devices by tunneling through other protocols such as HTTP/HTTPS. Embedding a control protocol (SOAP) in a data protocol (HTTP) is just as bad (security-wise) as macros in email documents.

There is nothing inherent in HTTP being a "data protocol". It is just a communication protocol. It hasn't been just a data protocol since the first CGI program was written.

Schneier might as well say, don't let any PHP progams run as SOAP. The security issues are identical. Yes, if you write a bad PHP program (or ASP or Perl or whatever you write active web content in), you are potentially compromising the web server. SOAP is no more powerful, but it is a lot more structured.

Re:Schnier co-writes a bad column!

[Cally]

>The point is that running SOAP over SMTP or NNTP
>does not make a lot of sense

A free clue:
$ cat /etc/services

No one is (seriously) suggesting running SOAP over FTP or NNTP. The point is that one of the fundamental features of the IP suite is that unique services should run over unique ports. This has a wide variety of benefits, one of which is that you can SHUT IT DOWN AT THE FIREWALL (or border router or whatever) when someone blurts their new exploit all over Bugtraq without bothering to inform the vendor. As it stands, when this scenario comes to pass (or the first .NET worm breaks out, or whatever) the network admin will have to make a choice between killing all web traffic as well as the (completely unrelated) SOAP services ,or leaving them open and taking a chanceon not getting hit. [Or running an application-layer proxy, with the concomittant issues of security, resources, latency etc etc.) And when the MD or CEO calls up asking why he can't get to CNN.com, what's he going to say? Running SOAP over port 80 is a really dumb idea.

Incidentally when I said this here, a few months back, I got the most severe flaming I've ever had on Slashdot... nice to see that everyone's nodding sagely and saying "yes, of course, how true" now that Bruce Schneier says so, too. Apologies accepted =)

> FTP is actually built on Telnet and there are good
> reasons not to use SSL with Telnet which is why SSH
> is no longer based on SSL.

I have no idea what are you talking about here. ftp is "built on telnet"?

And FYI, SSH - OpenSSH at any rate - still had OpenSSL as a dependency
last time I compiled it (a couple of months back.)

Re:Schnier co-writes a bad column!

[simm_s]

Good point!

The difference is that at least on the client side is that if I hack a website with SOAP web services the results can now affect the software running locally. Thus manipulating software on the client side to do things they were not intended to do.

The difference is subtle, with CGI programs attacks would affect the backend, deleting accounts, intercepting charge cards, outputting misinformation, etc.

With SOAP/CGI they can do all of that plus control the software running locally. And they could easily subvert the firewall at the same time.

That to me seems like a potential security problem to me.

Re:Schnier co-writes a bad column!

[Anonymous Coward]

Ports are different; protocols are different; different point of entry... different exploits... worse security.

Re:Schnier co-writes a bad column!

[frozenray]

The point is that one of the fundamental features of the IP suite is that unique services should run over unique ports.

I'm glad to see I'm not the only one who gets the creeps seeing the abuse of port 80 we're getting nowadays (not only from Microsoft, mind you). Consider this post virtually modded up +1, insightful.

Raymond

Re:Schnier co-writes a bad column!

[Zeinfeld]

So, I should just let all the spammers, script kiddies and hackers (not crackers; I mean HACKERS) just break into my computer whenever they wanted. Do you understand ANYTHING about security?

Actually selling firewalls is a large part of my business. The point you don't understand is that people often buy firewalls as a substitute for security rather than a means of security. They want to tell their auditors they are secure, they don't actually want security.

There is very little point in buying a $100K firewall installation from me if you don't make sure there are no backdoors into your network. A gateway is no use at all without a fence. But the number of clients who fail to check their telephone networks for unauthorized dial up modems is large. Also depressing is the number of customers we go into where an expensive firewall has been installed but is configured insecurely. It is not unknown to find all ports open in both directions.

These days I try to get customers to buy a VPN with a firewall so that they can provide a controlled means of accessing the network from outside. The official rationale is that companies can save big by decomissioning their unreliable internal modem pools and switch to using a VPN and a national ISP with lots of POPs so the company doesn't have to pay long disatance telephone charges. While the numbers add up the real reason that the companies buy them is so that the CEO can read his company email over his cable modem.

Re:Schnier co-writes a bad column!

[Zeinfeld]

The point is that one of the fundamental features of the IP suite is that unique services should run over unique ports. This has a wide variety of benefits, one of which is that you can SHUT IT DOWN AT THE FIREWALL

HTTP has by design (mine) the ability to tag content within the HTTP stream. Unless you have a packet filter as opposed to a firewall you should be able to select on the content types you allow into your company. This is why we invented HTTP Proxies.

However the issue you raise does not actually arise since a firewall should not be accepting incomming HTTP requests to the internal network in the first place. The only reason to open port 80 incomming on a firewall is if it is serving a DMZ in which case the machines are highly controlled and the issue of unauthorized servers should not exist.

I have no idea what are you talking about here. ftp is "built on telnet"?

Sounds whacky? It is true. I have implemented FTP several times. FTP uses two TCP channels, a control channel and a data channel. The control channel is layered over Telnet. The protocol model of FTP is you log into a remote machine and tell it to transfer files.

And FYI, SSH - OpenSSH at any rate - still had OpenSSL as a dependency

The history there was that back in the very distant past someone had the very good idea of developing a secure telnet and then had the very bad idea of basing the work on SSL 2.0. As he discovered just how broken SSL 2.0 was he fixed it and SSH diverged. In fact there are good reasons why you can't build secure telenet on SSL since SSL assumes that you can simply do a 1 for one swap at the transport layer and is designed arround a stream cipher. This lays you open to attacks like keystroke timing. For secure telnet you really want a block cipher, or if you do use RC4 throw out the first 1024 bytes of the cipherstream.

Re:Schnier co-writes a bad column!

[Anonymous Coward]

> By this logic, we should all supply our own implementation of printf, because
> every program that calls the one distributed with the C runtime is a new "point
> of entry" and thus more vulnerability.

Actually, that's exactly the opposite of what I said.

Re:Schnier co-writes a bad column!

[mjh]

First, you say:

SOAP traffic is actually quite easy to detect in HTTP, just examine the Content-Type field.

Then you say:

Actually selling firewalls is a large part of my business.

So, in order to filter SOAP we need to get a firewall with significantly more horsepower in order to examine the Content-Type field... and you sell firewalls.

How convenient.

You also say

However the issue you raise does not actually arise since a firewall should not be accepting incomming HTTP requests to the internal network in the first place

That is irrelevant. If you allow arbitrary outgoing requests, and their replies, then it's trivial to encapsulate an incoming request in the replies. Witness httptunnel which can be used to setup outgoing SSH connections, which in turn can be used with PPP over SSH to establish the entire IP protocol... INBOUND... All of this over port 80. Think this can't be done? Well I'm an IT auditor, whose opinions you seem to eschew. I've done it (in the lab, of course.)

All things considered, I disagree with your conclusions.

Re:Schnier co-writes a bad column!

[Zeinfeld]

That is irrelevant. If you allow arbitrary outgoing requests, and their replies, then it's trivial to encapsulate an incoming request in the replies. Witness httptunnel [nocrew.org] which can be used to setup outgoing SSH connections, which in turn can be used with PPP over SSH to establish the entire IP protocol... INBOUND... All of this over port 80.

Which is why I am not impressed by the argument you make. Forget port 80 by the way, if you use SSL you prevent the firewall having any interaction! Do the initial SSL handshake then once you turn on encryption switch to using IP in IP encapsulation.

The attack you describe would require collusion between the sender and the receiver. So if SOAP ran over a SOAP specific port there would be nothing to prevent the sender and receiver colluding to layer it over HTTP on port 80.

Firewalls do not present a barrier to an attacker who has already penetrated a network. At best they provide a hinderance. The value of a firewall is preventing the initial attack.

Re:Schnier co-writes a bad column!

[mjh]

Which is why I am not impressed by the argument you make. Forget port 80 by the way, if you use SSL you prevent the firewall having any interaction! Do the initial SSL handshake then once you turn on encryption switch to using IP in IP encapsulation.

But it doesn't use SSL. httptunnel is not using the CONNECT proxy directive (which enables SSL connections through a proxy). It's using HTTP GET and HTTP POST, and that's it. To the proxy it looks like plain old HTTP. There's no SSL in it. SSHv1 yes, but not SSL. If you're unconvinced, thinking that ssh necessarily means that it's SSL, not a problem. It works with rsh, too.

The attack you describe would require collusion between the sender and the receiver. So if SOAP ran over a SOAP specific port there would be nothing to prevent the sender and receiver colluding to layer it over HTTP on port 80.

The attack that I describe does require that the sender and receiver be coordinated. However (and please correct me if I'm wrong) isn't SOAP's purpose to enable communication between a server and a .NET app? If so, it would seem to me that the .NET app (running on the inside of the firewall) and the server (running on the outside of the firewall) are certainly coordinated. And most likely, the .NET app that is inside your network got downloaded from the server that you're trying to connect to!

Firewalls do not present a barrier to an attacker who has already penetrated a network. At best they provide a hinderance. The value of a firewall is preventing the initial attack.

This is, of course, entirely true, but it misses the point. The point of the demonstration is that any time you allow arbitrary bi-directional traffic, the payload of that traffic can be used to encapsulate a point to point IP link. The problem with SOAP is that it creates an architecture for doing just that, and it's going to be released on an OS that enjoys 90%+ market share, and has an application barrier to entry.

The only prudent response to this is to block all SOAP Content-Type's at the firewall unless it's to a trusted source. And of course, this is exactly the point that Schneier is trying to make: SOAP is a security problem.

Re:Schnier co-writes a bad column!

[Zeinfeld]

But it doesn't use SSL. httptunnel is not using the CONNECT proxy directive (which enables SSL connections through a proxy). It's using HTTP GET and HTTP POST, and that's it. To the proxy it looks like plain old HTTP. There's no SSL in it. SSHv1 yes, but not SSL. If you're unconvinced, thinking that ssh necessarily means that it's SSL, not a problem. It works with rsh, too.

You gave one example that is relatively easy to detect, I countered with a more powerful example that is impossible to detect.

The point that you apear to be determined to miss is that a firewall does not and cannot provide a meaningful control against the attack you describe. It does not do that today and it will not tommorow, whether SOAP runs over port 80 or no.

Again, the problem with firewalls is that they are considered by the naive to be a solution to every security solution ever. Like all security tools they have a very specific and narrow use.

The attack that I describe does require that the sender and receiver be coordinated. However (and please correct me if I'm wrong) isn't SOAP's purpose to enable communication between a server and a .NET app? If so, it would seem to me that the .NET app (running on the inside of the firewall) and the server (running on the outside of the firewall) are certainly coordinated. And most likely, the .NET app that is inside your network got downloaded from the server that you're trying to connect to!

At which point we are not talking about SOAP over HTTP, we are talking about SOAP over reverse-bodged-you-just-invented-HTTP which bears no relationship to any standard ever. Nobody is proposing that model.

The proposal you make does nothing to control the class of attack you describe. Abusers will still be able to construct the type of attacks you describe if port 80 is open outgoing. All you would be doing is stopping the clients from running legitimately configured SOAP clients.

But as you correctly point out it is possible to filter the traffic on Content-Type. SOAP uses HTTP in exactly the way it was intended to be used I wrote the security profile for HTTP. Java on the other hand completely ignores the content-type field and does so deliberately to prevent filtering. So before heaping yet more criticism on Henryk and co who know what they are doing (Henryk was an editor of the HTTP spec), perhaps you would like to ask Gosling and Co why they decided to do their own thing?

Downloading active code on a user's browser, sandbox or no is a much riskier proposition than a SOAP call.

Re:Schnier co-writes a bad column!

[mjh]

The point that you apear to be determined to miss is that a firewall does not and cannot provide a meaningful control against the attack you describe.

I haven't missed that point. You're correct, of course. And by no means did I mean to give you the impression that I think JAVA doing this makes it any better. As you say, it's just as susceptible to the kind of attack I describe. It does have one advantage though, and that is that it runs in a sandbox, which limits the exposure of the risks.

SOAP, otoh, does not. Which means that the exposure of JAVA is determined by what can be accessed in the sandbox. The exposure to SOAP is determined by what can be accessed by SOAP... which is basically everything on the PC and everything behind the firewall.

IMHO, MS should choose either not to run SOAP over HTTP, and let administrators *easily* filter it, or run it in a sandbox. Either works for me. Until then, Schneier is 100% correct. SOAP is a serious security problem.

It does not do that today and it will not tommorow, whether SOAP runs over port 80 or no.

Of course, it's impossible to prevent someone who has access both inside and outside of the firewall from bypassing it if that person is determined to do so. But that doesn't mean that it's a good idea to deploy something to 90%+ of the world's computers that will enable anyone to do that, whether they intend to or not.

I wrote the security profile for HTTP

Congratulations.

Downloading active code on a user's browser, sandbox or no is a much riskier proposition than a SOAP call.

I certainly agree that downloading active code is a dramatically risky proposition. But having SOAP around makes that downloaded code even *more* risky.

Creating a systematic mechinism to render a firewall, with all of its limitations, to nothing more than a router, and then deploying that to nearly every computer on the planet... you consider this a good thing? A single SOAP call may not be risky, but the implication of deploying this thing on the global state of security can't be benign.

Sorry, but all things considered I still disagree with your conclusions.

How will MS do this?

[Alien54]

this is an interest question.

when MS wanted to take advantadge of the Internet, they bullied their way in to the browser market. Now they are going to bully their way into the security market, in orde to provide an integrated solution?

Sounds good on paper, for them. another step towards a microsoft world, which things security by obscurity is the pattern, etc.

feh

the thought of microsoft salemen becoming the thought police sickens me.

Re:How will MS do this?

[Zeinfeld]

when MS wanted to take advantadge of the Internet, they bullied their way in to the browser market.

They were invited. In fact the Web development team spent a lot of time and effort getting Microsoft to support the Web and deploy a browser.

Now they are going to bully their way into the security market, in orde to provide an integrated solution?

Microsoft already provide one of the most comprehensive cryptographic security packages out their. Windows 2000 implements most of the X.509/PKIX specification and the IPSEC, SMIME and SSL protocols, they also provide an encrypting file system

The problem with Microsoft is not that they fail to provide security features, it is that they also throw in some of the most amazingly braindamaged insecure ones.

For example, if Microsoft removed the scripting features from Outlook most of the Microsoft security issues would be eliminated at a stroke. If Microsoft eliminated scripting from Word, Excell etc the number of security issues would be cut in half again. The fondness of Redmond engineers for active code is their major security weakness.

It is a weakness that is not limited to Redmond either. Netscape's addition of Javascript to HTML was pretty gratuitous. I have yet to see any feature achieved with an active code platform perpetrated by Microsoft, Sun or Netscape that provides more benefit to the user than the programer.

Re:How will MS do this?

[Kirruth]

They were invited. In fact the Web development team spent a lot of time and effort getting Microsoft to support the Web and deploy a browser.

Ah, that explains alot. When you invite a vampire into your home, you are powerless against him. Oh well, next time we come up with a global standards-based network, we'll know who to leave off the guest-list.

New Levels

[Sir Tristam]

"We must lead the industry to a whole new level of Trustworthiness in computing."
- Bill Gates internal memo, 15 January 2002.

Hasn't this already been accomplished? I'd feel a lot better if it had stated that this would be a higher level of trustworthiness. All software (other than a "hello world" program, TeX and anything I write ;-D ) have bugs; that's simply life. Admit them, correct them, and move on instead of trying to ignore and bury them, and people would feel a lot more trusting of the products. The same applies for "gee-whiz" features that end up being security holes; admit that they were bad ideas and remove them (or at least disable them by default)

Bottom line is, words are easy. I'm going to wait to see the action.

Chris Beckenbach

Re:New Levels

[Anonymous Coward]

Who needs to wait? We've seen XP, and it's first found and publicised flaw. We know what to expect.

"Hello, Microsoft tech support? My computer suddenely turned off last night during that thunderstorm and when I turned it on again I got a strange "corrupted filesystem" message."
"Oh, yes ma'am, did you upgrade to our new PowerSource v2.0? The old version had a flaw where lightning strikes would do that."

Re:New Levels

[Anonymous Coward]

(other than a "hello world" program, TeX and anything I write ;-D )

I can't compile hello world....HELP!!!!

this cc:d to alt.comp.hello_world

Seems to me...

[elefantstn]

Microsoft's new focus on security will not help them sell any upgrades. If their customers were worried about security, why would they have started using Microsoft in the first place?

Re:Seems to me...

[Kool_Cat]

I'm not sure if that's just a bad joke but Microsoft will sell many upgrades in the future, especially if/when they sell their products with security as a feature (opposed to security being required in an OS). Now if we lived in a perfect world, upgrades and future/fixed versions of a home OS would be free...

Those customers probably started using Windows because it was the only thing they (being a first-time computer user) had heard about, or they had used it somewhere else, or it came pre-installed on that new computer.

Remember the whole monopoly thing?

My reaction

[Anonymous Coward]

Words are cheap. Results are what counts here!

New "focus" on security

[Cowculator]

Of course Bill Gates called for increased security. His announcement, in addition to happening while everybody is trying to settle a multitude of lawsuits against Microsoft, coincided with an announcement from (I believe) the National Academy of Sciences which called for legislation to punish companies who sell buggy, insecure software. He was just trying to protect himself...

Now, I know he's also sending thousands of employees into security training for a while. But the training doesn't mean they'll be perfectly secure anyway - think of all the "trained" MCSEs who are supposed to be networking experts but stlil get mocked for their incompetence by supposedly more experienced Unix admins. Getting a pretty certificate at the end of some training course doesn't guarantee that you've truly learned from it...

Re:What about the potential implications for Linux

[Anonymous Coward]

No, I use Win2k right now. I make damn sure to preemptively reboot. Last time there was a great deal of work (and I use mainly DOS boxes), I kept it up for days, and it took the filesystem down with it.

The sysadmins smiled and shook their heads at my naiveté.

Mac OS X does not do this. *nix does not do this.

Business practices are related here too....

[tfurrows]

How can a company hope to achieve "a whole new level of Trustworthiness in computing" if they don't have an ounce of trustworthiness in their own business and political practices? Some may argue that this is a whole other subject, but personally I think that a company with real ethics will perform leagues above in the field of security, bug-fixes and general product improvement.

Re:Business practices are related here too....

[Tony-A]

A whole new level of Trustworthiness in computing. Yep, it's a new level all right. Nobody said it would be better. Like the bit with innovation.

Re:What about the potential implications for Linux

[Hamshrew]

I still have frequent lockups and stalls with XP. Granted, this is due to a buggy video driver, but even without that, it's not exactly "there" yet. My Linux partition on the same machine NEVER goes down. And I'm running the video and sound drivers from CVS. XP is a HUGE step up from 9X(especially ME... that's on my laptop for work *shudder*) but to say it's as stable as Linux is laughable.

I'd trust it for light loads, or higher if I spent a LOT of time configuring it. But I don't have to worry too much, since my company uses Linux anyway :)

But it's not just about security

[All Dead Homiez]

Linux has much, much more to offer users than superior security to Windows. Having switched my desktop machine over to Linux several months ago, here are the differences I noticed the most:

• Speed. Linux does more with less. On my Athlon XP 1500+, Windows XP lags noticibly on many operations, but there are virtually zero delays using Linux.
• Usability. I'll take open source desktop tools any day over the Windows equivalent. The GNOME desktop is better than that of Windows, BeOS, KDE, and NeXT combined. It is designed by people who actually know what the users need from a desktop, rather than people intent on writing a desktop that integrates Passport and spyware into every single applet.
• Web browsing. Mozilla 0.9.7 is so compatible, reliable, and quick that I have uninstalled IE on all of my 80 Windows clients' machines and replaced it with Mozilla. The users loved the tabbed browsing and have probably never even looked back.
• Accessibility. Linux supports such accessibility features as sticky modifier keys, text to speech support (even for images, using OCR), and many other things that make life easier for users with disabilities. Windows has limited support, at best, for these things.
• Standardization. Linux supports all of the latest standards that Microsoft flouts. It supports open document formats, open web page formats, and many other encodings that are not patented or non-free. Truly Linux sets the bar for other OSes to live up to.

Given these many reasons, it is hard to imagine that Windows will be able to offer more to the desktop user than Windows anytime soon.

-all dead homiez

Re:But it's not just about security

[flez]

You forgot the most important one.
It's free (as in open)!

Re:But it's not just about security

[Anonymous Coward]

But was that Mozilla's fault, or Window's? The world may never know....

Re:But it's not just about security

[Duck_Taffy]

I know that many of you will view this as irrelavent because it's not specifically x86 oriented, but Darwin is quickly approaching the features and usability of Linux, but I see some distinct advantages to Darwin. #1) It runs on both PPC and x86 machines. Obviously you can't use the same binaries, but you can use the same source. #2) It's based on FreeBSD, and I know that everybody has different opinions about this, but in my experiece, I've gotten better performance out of FreeBSD than I have out of Linux, and for some reason, it just feels more stable. For those of you who don't know, Darwin is the core of MacOS X, which is freely downloadable and open source. Here is another great advantage. If you have a machine running MacOS X, you can run not only all of you Mac applications, but you can also run XFree86 and a great lot of open source apps, and people are constantly porting new ones over. To date, Apple has only released one security update. I know this one intimately, because I submitted the bug report that caused (at least part of) it, and let me tell you, it has nothing to do with Apple, and everything to do with the FreeBSD implementation of sudo. I merely found a way to exploit it from within the GUI. And in response to the above post, I too love Mozilla. In fact I'm using it right now, and ChatZilla is the only free IRC client on the mac that's worth any amount of time (Forget JediKnight 2.0 for MacOS X if you want to use any commands that aren't built in, or *gasp* COLOR TEXT).

Re:But it's not just about security

[sexninja]

The GNOME desktop is better than that of Windows, BeOS, KDE, and NeXT combined

wow....them fightin words!

Re:But it's not just about security

[Dr. Evil]

#1 is not an advantage, it is a limitation. Linux runs on just about anything. It is not limited to the PPC and the x86, but also runs on the Alpha, Sparc, ARM, 68k, Dragonball, etc.

Re:But it's not just about security

[Anonymous Coward]

This is flamebait

" The GNOME desktop is better than that of Windows, BeOS, KDE, and NeXT combined."

Moderators, beware.

Re:But it's not just about security

[Duck_Taffy]

Keep in mind that Darwin has only been around for about a year and a quarter, while Linux has been around for nearly a decade. It started out as x86 only. People have had more than enough time to port it to those processors. Considering that Darwin uses the Mach 3 kernel, it should run on anything that NeXT runs on, however Apple is currently focusing efforts on PPC and x86. Since it's open source, anybody who wants to can try to get it to run on other processors, but this project hasn't been around all that long. It's still only on version 1.4. It does have the potential to be every bit as ported as Linux.

Re:But it's not just about security

[Anonymous Coward]

"The GNOME desktop is better than that of Windows, BeOS, KDE, and NeXT combined."

You are wrong - so very, very wrong.

Re:But it's not just about security

[arkanes]

x86 port of Darwin is currently Intel-only, as it happens. I was all set to install it on my new machine and play around, too.

Re:But it's not just about security

[Anonymous Coward]

"If you have a machine running MacOS X, you can run not only all of you Mac applications, but you can also run XFree86 and a great lot of open source apps"

Mac software, as in emulation? I don't think that's too smart...

- Voice of Ambience -

Re:But it's not just about security

[Duck_Taffy]

No, not emulation. It does launch MacOS 9 inside of X, but it doesn't emulate any processor. Think of it as more like a megalithic code library. Surprisingly, the speed decrease is relatively neglagible. I frequently run Photoshop and Flash in Classic mode, and they run just fine, even on my laptop with only 160 MB of RAM.

Security APIs

[Hajoma]

It's not problems with the security APIs that cause exploits. It's the bugs in other APIs, like XP's recent plug and play exploit.

Even despite the fact that security through obscurity is no security, how does closing the security API make the system more secure? Surely all this achieves is to allow Microsoft to put backdoors in Windows' security features.

Re:Security APIs

[Anonymous Coward]

I *think* the point the parent was trying to make was that with this specific exclusion granted by the gov, MS will now just claim that an API has security value whenever they decide they don't want us to see it. Although it has to have limits if they want people to develop for them. I wonder where that leaves developers that need security functions? Creating their own and leaving us vulnerable again?

Schneier and Shostack go too far

[Shimmer]

Microsoft certainly has alot of work to do to improve the security of their products, but I think Shneier and Shostack go too far in some of their recommendations. Here's the worst offender:

Implementation of Microsoft SOAP, a protocol running over HTTP precisely so it could bypass firewalls, should be withdrawn.

First of all, SOAP is an industry standard, not a Microsoft protocol. Secondly, the need for security shouldn't prevent the development of web services over SOAP. I think the demand for these sort of services will mushroom over the next few years. Web services can be secured via the SOAPAction header attribute.

In general, we can't let security concerns prevent the development of useful new technology. Rather, we should make sure that such technology is secure prior to deployment.

-- Brian

Re:What about the potential implications for Linux

[the_rev_matt]

Ok, I think we can all agree that M$ has been making life hard on Linux advocates. First off they come out with Windows 2000 which doesn't crash and then they follow it up with Windows XP which also doesn't crash.

Huh, I must not be running Windows 2000 because my machine still crashes an average of once/week. My co worker has a brand new Dell with XP and it's definitely far more stable than 98, but it has still crashed at least twice that I know of in the past month.

Denny's

[pfaut]

I once heard a story about the Denny's restaurant chain. I'm not sure if it's true but the moral is. The story goes like this.

Apparently, Denny's had intended to be a 24x365 operation, never closing its doors. Therefore, when they built the restaurants, they didn't bother putting locks on the doors.

One year, they decided to give their employees Christmas day off. In order to close the restaurants, they needed to be able to lock the doors. Therefore, they had locksmiths go out to all of the stores and install locks.

Now, instead of having spent about $10 per door when the store was built to have locks installed, they needed to send locksmiths to all of the stores and pay them for a couple of hours work resulting in a cost of a few hundred thousand dollars to give their employees a day off.

The moral: It's a lot easier to design security into a system in the first place than to try to add it on later.

Microsoft has their work cut out for them.

Re:Denny's

[Locutus]

True or not, it's a good story.

Regarding Microsoft; they REALLY have their work cut out for them. They can't hide this with press releases for very long and failures won't be excused as easily. Then again the public has accepted a daily ritual with Ctl-Alt-Del for over a decade.....

I'm pretty sure they, Microsoft, lost the server battle but by buying into the home entertainment maket( xbox ) and controlling the content they'll have another shot back at the server market in 5 years. A BLACK-EYE between now and then will seal their fate. IMHO.

LoB

Re:Denny's

[Courageous]

Therefore, when they built the restaurants, they didn't bother putting locks on the doors.

While I can't be positive this statement is true, I seem to recall seeing it printed in local newspapers back when, so I think it is true. They way I heard it, it wasn't that they didn't bother, they made a specific deal of it, as a marketing trick. Think about it. You don't design locks in, you have to design them out. Doors without locks aren't the default, I'm sure you realize.

C//

Re:Denny's

[Anonymous Coward]

Couldn't they just pay some filthy commie hippy atheist Linux h4xx0r $10 to watch the store on Christmas day?
No, I guess not, they'd come back the 26th to find the resturaunt cleaned out. Because "food wants to be free".

Re:Denny's

[sulli]

It's definitely a true story. I remember when it happened, and I also remember going to Denny's before then and it was true - no locks! Weird, but you could certainly count on them to stay open all the time.

Re:Denny's

[ryantate]

Apparently, Denny's had intended to be a 24x365 operation, never closing its doors. Therefore, when they built the restaurants, they didn't bother putting locks on the doors.

this is so obviously bullshit, it is amazing no one has called you on it.

1. you think Denny's builds most of their own locations?

2. if they do build their own locations, do you think they open the store the EXACT day the last nail is pounded and the last tile laid, before, say, health inspectors have had a chance to review the establishmnet, or fire inspectors, or building inspectors? and if they don't, how do they secure the building in the meantime?

3. what about when someone holds up the place, or someone gets shot inside? do you think they just expected to keep on operating during such emergency situations?

how can you all be such idiots?

Re:Denny's

[Anonymous Coward]

This will get modded down for sure, but when did MS lose the server battle?

Wishing something doesn't make it so.

Re:Denny's

[ryantate]

how can you all be such idiots?

ermm, eh, hehe hehe ... what i meant by 'idiots' was enlightened beings ... or something ... OK i was being an idiot =)

check it out (and note in many cases it was simply that the locks had never been used):

NEWS

Ah, finally, Denny's has a lock on Christmas off
Zay N. Smith


12/23/1988
Chicago Sun-Times

FIVE STAR SPORTS FINAL
21
(Copyright 1988)



It sounded so simple.

It started when the people at TW Services, which franchises 1,221 Denny's Restaurants across the country, discovered they were in a holiday mood.

But what to give their 52,300 employees?

Then they got the idea.

Denny's Restaurants have been open every single hour of every single day since the chain was founded 35 years ago.

"So we thought we'd give them all Christmas Day off for the first time ever - even if it is our busiest day of the year," said Robert Ochsner, speaking from the chain's headquarters in La Mirada, Calif.

And what could be simpler?

Except for one thing.

"Since we hadn't ever closed the doors, we discovered we hadn't ever put any locks on most of these doors," Ochsner said.

"We discovered, in fact, that more than 1,000 of our restaurants had no locks at all. And we discovered that each store's new locks would cost about $300."

It has taken two months to get the locksmithing done.

"And it turned out to be a lot harder than everybody thought," agreed Nancy Diaz, manager of the Oak Park Denny's.

"Even the Denny's Restaurants that already had locks needed new locks because people had never used the locks, so the locks didn't work anymore or somebody lost the key after all these years."

But finally, two months later, the people at TW Services are ready to say Merry Christmas to all Denny's employees, to wit:

Denny's Restaurants will be closed from 7 Christmas Eve until 6 a.m. Monday.

The closings will affect all 35 Denny's Restaurants in the Chicago area.

The doors will be - locked.

And don't think the employees aren't grateful.

Except for one thing.

"The fact is, Christmas is about the biggest tip day of the whole year," said Dwight Quinn of the Palatine Denny's. "So you'll find some employees who are less than pleased."

Well. Merry Christmas, anyway. And while you're enjoying your Grand Slam Breakfast, keep in mind that most government offices, public schools and banks will be closed Monday.

City Hall offices as well as state, county and federal offices will be closed, with the exception of emergency services. There will be no mail delivery.

However, parking meter regulations will be in effect.

Chicago public shools will be closed, and most colleges and public libraries will be closed.

The CTA and Metra will operate on a holiday schedule.

For the convenience of commuters who will be leaving work early today, the CTA will begin operating express buses No. 120 and No. 121 from lower Michigan Avenue and Wacker Drive to North Western and Union stations at 30-minute intervals, starting at 2 p.m.
A San Diego locksmith installs one of the thousands of locks being added to entrances at Denny's Restaurants nationwide. The "always open" restaurant chain will close for the first time in 35 years to give its employees a Christmas; holiday.; Credit: United Press Inter

Re:Denny's

[Anonymous Coward]

I can verify that the Denny's story is true (according to my memory) -- But you miss an important point.

The fact that the doors didn't have locks was subtle marketing -- You walk into a a Denny's and subliminally you notice that their doors are never locked, always open, always welcoming. Next time it's 3 in the morning and your girlfriend kicked you out on the street and you can't sleep, you instictively head for Denny's.

It's unknown if that trick actually made any money, but considering the size of the Denny's chain (every 3rd exit here in California), I'll give it some credit. Hell, it probably cost them more money in the first place to find doors with no locks.

I can't think of a good analogy for this in the computer world -- maybe the Happy Mac that you see when Macs boot up.

facinating...

[jeffy124]

.. the cnet article by mundie was part of a pair of pro/con articles. Mundie wrote the pro, Bruce Schneir the con.

I find it just facicinating that CNet had to go with Microsoft in order to find someone willing to write an article for the "pro" half of the article pair.

Re:facinating...

[jeffy124]

i wrote:
CNet had to go with Microsoft

er ... that should read
CNet had to go within Microsoft

I agree with many points.. except removing SOAP

[mindstrm]

The ability to act over plain HTTP DOES have a use.

Now, I know one camp will say it's not necessary to wrap protocol within protocol, that it is a bad practice... but here's the thing.

To build really successful network apps for the mass market, you can no longer rely on network transparency.

What does that mean?

Back in the day, you could assume that every computer on the internet had an IP address, and could deal with unfiltered TCP/IP. That's how it was designed.

Nowadays.. we have NAT everywhere. Yes, NAT is a kludge to get more machines online.. but it's here to stay.

Example: I live in Costa Rica. The local cable company uses NAT. (yes, lame, I know).
My office also uses NAT.

Lots of home gateways use it.

And stuff like video, voice, remote desktops, VPN, etc will just plain not work over nat. Some things, I can hack up to work.. and I'm a real hacker type guy. What can my mom do? Nothing.

I'm all for MS paying more attention to security, separation of code and data, absolutely.

But bitching at them for SOAP, or for (not mentioned here) implementing raw sockets in XP is plain bunk... it's GOOD for them to support a full, flexible machine.

Re:I agree with many points.. except removing SOAP

[schon]

The ability to act over plain HTTP DOES have a use.

K. Still waiting for proof..

Back in the day, you could assume that every computer on the internet had an IP address, and could deal with unfiltered TCP/IP.

In other words, a FIREWALL?

Nowadays.. we have NAT everywhere ... I live in Costa Rica. The local cable company uses NAT ... And stuff like video, voice, remote desktops, VPN, etc will just plain not work over nat.

Yes, but the reason that HTTP DOES work, is that it's based on TCP. The other stuff you list doesn't.

There is NO reason that SOAP has to use HTTP. It could run over another TCP port, and NAT would have no bearing at all.

If the only excuse given for SOAP's poor design is to make it work with NAT, then there is no real reason it couldn't run over it's own TCP port.

Re:I agree with many points.. except removing SOAP

[simm_s]

Schneier did not say that SOAP was not useful he implied that it was a security risk. Security and usefulness are not the same thing.

Network transparancy is masking remote services to look like local services. SOAP, sunRPC, SMB, NFS, network printing are all examples of that.

NT was supposed to be a clean break

[rasilon]

Designed from scratch, to do it right and drop all the backwards compatible cruft. They had their clean break and blew it.

Never too late to FUD

[Anonymous Coward]

You DO know that Microsoft is EVIL?

Re:What about the potential implications for Linux

[Anonymous Coward]

VMS? I'm interested in purchasing some of whatever it is you're smoking.

It's just the old Embrace and Extend tactic...

[Ivan the Terrible]

I don't see Microsoft's new focus on security as anything other than the old Embrace and Extend tactic.

Step 1: Embrace some technology.

Step 2: Extend it in proprietary ways, locking the users in to Microsoft.

How long before we hear,

Microsoft cannot guarantee the security of your application/computer/network unless all your products and platforms are from Microsoft.

How long before the security protocols used are known only to Microsoft (for security reasons, naturally)?

Three months—at the most!

Re:It's just the old Embrace and Extend tactic...

[Anonymous Coward]

Ensnare and Asphyxiate...

Re:It's just the old Embrace and Extend tactic...

[Ivan the Terrible]

Are you suggesting that MS should guarantee the security of other companies apps or protocols?

No, of course not.

It is possible to have a reasonably secure system with hardware and software from different vendors. But this requires a degree of openess and a degree of adherence to standards that MS has yet to demonstrate. And since past behavior is the best predictor of future behavior, I expect MS will spread security FUD in order to lock users into their platform. I haven't seen IBM, for instance, or Red Hat attempt this kind of security FUD.

What? MS isn't secure?

[God_Retired]

Lately on /. when there is a headline about linux on the desktop, the M$ trolls come out of the wood work Linux isn't ready for the desktop, by a long shot, stop pretending that it is. This isn't news.

OK in the same light, call it trolling if you want, let me say M$ isn't secure. Not by a long shot, please stop pretending that it is or will be soon. Thank you.

Bully their way into the security market!

[linuxrunner]

Probably MS's next step... Doing exactly what they did to the browser market, but now their going for the Security market. They'll integrate their own security site and antivirus software with their OS. Then they'll buy up mailing lists and security sites (hey they have the money and anyone can be bought for a price).

Then all we have for security is what MS tells us and gives us!

MSFT will produce something secure

[WinPimp2K]

But like all MSFT software, it won't be till they reach version 3 that it will actually be workable. Will it be acceptable to their corporate customers? Yes - Bill G is many things, but "stupid" ain't one of them. ("Criminally arrogant" might be :))

Just look at their history of innovative products:

Windows: Sure they were caught a bit off guard by that fruity company down south of Redmond, but Bill G. made a GUI the main priority and they invented FUD (or did they license it from IBM?) to confuse and delay the corporate world for the years it took to get up to Windows 3.1

Similarly, when the Internet torpedoed Bill's fledgling MSN, he made the internet the company priority. It took a few years, but just look at the market share of MS IE nowadays. Even AOL uses IE as their main browser (and they own Netscape - why don't they "eat their own dog food"?)

So I think that MSFT will be able to bring about this shift to secure their OS and applications. 40 billion dollars in actual cash on hand is only chump change for a first world government. It can finance one heck of a lot of spin doctoring (Just the interest off that would come to more than all the US Congress - House and Senate races plus what Bush and Gore spent combined in the 2000 election campaigns). And of course, however much various folks like to grumble, MSFT actually does spend some money on programming as well as marketing. Heck, they might just make their own version hyper secure version of BSD (given how much BSD code they have alrady borrowed) and call it MS Fortress 2005.

Re:MSFT will produce something secure

[G00F]

Ok, first off. MS software has always taken 4 mjor versions to be "workable". Windows 3.1 wasn't work able, you had to exit it completly to play games. Windows 95 is v 4. IE 3.x was a joke, v 4 was the first one that competed with NS line. MS Office actualy took a long time, like v 7 or 8.

btw, from what I know, aol will be using NS 6.x in its next major release. I heard that some time ago, and not sure how things are stacking up.

Re:MSFT will produce something secure

[the_great_cornholio]

AOL uses IE because it is contractually obligated to do so.

Rememberances...

[FauxPasIII]

This reads alot like the dilbert where dogbert is a consultant and says something to the effect of "I'm going to make a bunch of recommendations that I know you are too cowardly to implement. Later, when you fail, I'll laugh at you for ignoring my advice."

the register

[horster]

register has been following this pretty closely.
they have a good editorial on what it would cost to ms to implement this as well (like dropping .net until the security implications are thought through)

here is the link -
http://www.theregister.co.uk/content/4/23791.htm l

Re:What about the potential implications for Linux

[JahToasted]

So what happens when Windows becomes secure (assuming this happens). It'll be a sad day for Linux advocates everywhere is what will happen.

Ahhh but we can always come up with new reasons for linux being better

• windows costs money, linux is free. This is not new but as they bundle more and more software with the os, and start .NET, microsoft products will cost more.
• Windows is spyware. With XP you must have internet to activate your product and since its closed source it can gather anything it wants about what you are doing without you knowing it.
• "digital rights management." Linux doesn't manage your rights, and I like that.

And in addition to these reasons there are always the old standbys like "Microsoft is evil" and "I am 3733+3 cuz I use Linux."

The thing about being a zealot is that you can always find ways to justify your position. Although I think the Linux zealots are closer to the truth than the microsofties, I'm somewhere in between.

Security potential

[Anonymous Coward]

The real problem is default configurations. Exploits aside, the NT OS is very securable. However, when the software for it, like IIS, is installed virtually open wide for the world, it's a picnic for hackers and crackers alike. From what I've read about the next Windows server line, a lot of this is being changed. IIS is no longer installed by default, and must be installed explicitly by the admin. Even then it will only be capable of serving static pages from a single directory, and every method of dynamic content processing will have to be abled explicitly. This, coupled with the excruciating combing of code for buffer overflows (and various implements that will prevent their execution, such as a SEH handler in VC7 which can kill the thread that has it's buffer overflowed,) I think Microsoft will be able to pull themselves out of this spotlight.

Re:Security potential

[chromatic]

Exploits aside, the NT OS is very securable.

Aside from being dead, HotBlack Desiato was the life of the party.

"trustworthy computing"

[reverse flow reactor]

is it just me, or do other people think the same thing when Microsoft and "trustworthy computing" are used in the same sentence. Does Microsoft mean that I can trust the integrity and security of my data on my machine running Microsoft software, or do they mean that Microsoft can trust that their software and their partners content are safe on my untrusted computer platform? Is this just a decoy for telling people they have to put up with these added security "features" that just happen to introduce DRM?

It is important to realise who can trust what here. Is this so that I can trust my computer is safe, or so other people can trust me with their content? MS is in the business of makeing money, after all. Do they make more money if I trust them or if the entertainment industry trusts them?

Re:"trustworthy computing"

[reverse flow reactor]

might I also add - Is this the trojan horse that will bring DRM to every desktop? They can talk about securing data, but whose data are they securing? Are they securing my data from vicious crackers, the entertainment industry's data from vicious me, or their own software from evil pirates?

Time will tell.

Re:"trustworthy computing"

[sallen]

is it just me, or do other people think the same thing when Microsoft and "trustworthy computing" are used in the same sentence

It does seem something of an oxymoron. I think there are several reasons behind the move:
(1) After XP being touted as the most secure OS they've released then the huge hole, they deinitely needed to buttress the PR.
(2) Digital Rights Management is, IMHO, a big part of it. They don't want the Hollings bill or anything similar, as that'd be published and hardware. They want the control and proprietary nature of their own Media Player. I think they're looking not just at PC's but down the road when consumer electronics will be PC's hidden in a box be it players, set top boxes, etc. They'd rather have the royalties than a chance the newer embedded systems have a standard that would allow competitive products.
(3) Notwithstanding the XP security hole, they have had bad press for years for security in general and the lack of responsiveness and priority in that area. They're betting the ranch on .Net but also seeing others come up with competing ventures (AOL/TW and their partners, for one, which has the resources to compete). If people don't trust .Net for security and privacy, it's going to be as popular as their new corporate licensing, which forced down the throats of customers has been generally regurgitated by them vs. the quick sign up they expected..and the associated revenue streams.
(4) Bottom line, I think it'll be developed with an idea to insure a continued monopoly.

I'd have had more faith in the commitment had the memo discussed 'privacy and security' throughout. It was mentioned as what was wanted/needed, but everything then went the way of 'trustworthy computing'.. something totally undefined, and from here, another buzzword from Microsoft (i dislike that as much as their continued reference to my 'experience' at a computer. ) They've done the PR but left it as a concept, allowing them to develop it into anything they want as time goes by and as potential competition comes into view.

Bush is for sale

[Anonymous Coward]

Face it, W will shake Bill down until he writes a big fat check and then M$ will get a pass. Just look at how W and his VP delt with Enron and other big energy. Money Talks and then MicroSoft Walks. THat's just the kind of boy W is.

Re:Bush is for sale

[Cro Magnon]

The Dem's would love to make political hay out of Enron. Only one problem. All of them are on Enron's payroll as well! Face it, this isn't Republican vs Democrat, it's corruption on both sides!

Re:Windows MADE a clean break

[Anonymous Coward]

In case you haven't noticed, DOS, Win16, and Win9x are all dead with the advent of Windows XP, which uses a purely NT kernel. NT security is awesome if you know how to close the open doors.

Security vs. privacy

[Anonymous Coward]

I wonder if their security method will end up in Passport being forced on every Windows user? Now, let's assume for a second that it eventually becomes 100% secure (hypothetical, I know). How am I going to be able to have full privacy in that scenario? Have you ever thought about "the new meaning of privacy" in "the face of security?". Somehow I feel that optimum security and optimum privacy are not achievable simultaneously? [Please comment -- I might have confused myself]

Of course, one can turn the tables around and think about dealing with privacy first and think about "the new meaning of security" in "the face of privacy". Huh?

Case in point: Intel's chip ID. Customers protested because it can be used for privacy violation -- although it really CAN be used for security. So which priority is it for you? Privacy? Security?

Re:Security vs. privacy

[Catiline]

Somehow I feel that optimum security and optimum privacy are not achievable simultaneously? [Please comment -- I might have confused myself]
Hmm. Security and privacy being mutually incompatabile? My, my, I can't help but ask where that places crypto in the equation.

"Perfect" security and privacy measures go hand in hand. And (surprise, surprise) take the same single basic element to implement. Every administarator/user has to care. A Linux or *BSD box can be just as easy to hack as a NT/2K one if the same shoddy security procedures are used on both. Default password? Hacked. Buffer overruns? Hacked. And those are the common ones.

The problem with Windows is the glossy UI and crappy certification system that fail to emphasise the value of a proactive security stance (and outline what comprises such).

DRM!

[mikeee]

What really scares me about this is the talk about taking desktop control away from users, the one thing MS has always been good about in the past.

Billg says:

"Security: The data our software and services store on behalf of our customers should be protected from harm and used or modified only in appropriate ways...It should be easy for users to specify appropriate use of their information including controlling the use of email they send."

Of course, this new "secure" email won't work on those unamerican Linux computers.

Am I the only one nervous about that?

Re:DRM!

[Anonymous Coward]

No, you are most certainly not the only one who realizes that when Microsoft says "user control" what they mean is Microsoft control of users. However, I wish you luck trying to convince a non-techie of that. Most people will hear what they expect, not what was said. And microsoft just said "W3 0WN J00!!!"

Re:DRM!

[OneFix]

What really scares me about this is the talk about taking desktop control away from users, the one thing MS has always been good about in the past.

You mean like my comment on a story posted yesterday... Wow, Deja Vu :)

Trust Microsoft? Who are you kidding

[Catiline]

All thoughts of their past products aside, who really is going to trust Microsoft? They are a convicted monopolist; we've seen from the evidence how their mental level does not exceed the school yard bully, beating up weaker kids for their lunch money. This attitude locks them into a win/lose philosophy (when we win, you lose).

It doesn't matter what sort of clothes they wear or how pretty they smile, when the bully comes around the next day, the kids run and sream in terror. They know the bully only wants to get them backed into a corner; what makes us treat Microsoft any different?

Re:Trust Microsoft? Who are you kidding

[fire-eyes]

All thoughts of their past products aside, who really is going to trust Microsoft?

Convicted or not, it's going to take a HELL of a lot more than 'just security' to even begin to get your typical home MS customer to consider not buying the next operating system subscription.

They know the bully only wants to get them backed into a corner; what makes us treat Microsoft any different?

Customers don't even see who the bully is yet! We're a long way from that point too.

Re:Trust Microsoft? Who are you kidding

[Cro Magnon]

The bully doesn't need to smile for the other kids, he just needs to smile for the teacher. "Miss Davis, you look lovely wearing those rose-colored glasses I bought you. Yes, I know they keep you from seeing out the Windows (tm), but I'm not beating up kids anymore. Trust me (tm)!"

The best part from our friend Mr. Craig Mundie:

[Toodles]

At the top of Mundie's spiel:

"...they've helped transport people to the moon and back safely, they manage critical aircraft systems for thousands of flights every day, they support business operations at companies of all sizes, and they move trillions of dollars around the world to keep the global economy"

It's a shame that none of these run Microsoft software. MS didn't exist in the 60's (moon landing), has nothing to do with aircraft systems (most still in use run on late 70's mainframes and mini's), and god help the bank/brokerage who runs their mission critical software on an Wintel platform. End flame.

Mundie does have one idea right though; make it ubiqutous (sp?). He indicates computers should have the same reliability that requires no thought. I agree whole-heartedly. However I don't believe MSFT can do it without rewriting the whole damn thing over. I cannot count the amount of times an NT server had to be manually power cycled because a service hung and wouldn't restart. This wasn't some oddball, third party service; this was IIS ("WWW Publishing Service" I believe) Until simple things like the separation between kernel and application (EVERY application, no exceptions for the ones you need to tweak for benchmarks) is complete, NT will have problems

Toodles

Re:Schnier co-writes a bad column! -- firewalls

[BlackStar]

That's somewhat incorrect. SOAP is illustrated as running over HTTP/HTTPS for the very reason that those protocols on default ports are already open. This was discussed in Microsoft's own announcement of the protocol. It had a pragmatic, if misguided purpose. Companies already had these ports open, and thus no additional work or effort would be required by the system administrators and network admins to enable the use of SOAP.

The idea is unfortunately short sighted, and will result in holes to be opened in what was previously a manageable service port. This was for expediency, not security. The SOAP spec team followed along as the adoption would be accelerated, but again, this was done without any real eye towards security.

I seriously hope MSFT takes these comments to heart and at least begins to adjust their practice and products to be more secure.

'nix community standards

[mmaddox]

Being quite the 'nix afficionado myself, I understand some of the rather hateful sentiments expressed toward MS. I take issue with some of Mr. Schneier's (whom I greatly respect) comments, however, as being opposed to the mindset of progress.

For instance, Implementation of Microsoft SOAP, a protocol running over HTTP precisely so it could bypass firewalls, should be withdrawn.
strikes me as an ill-conceived statement. SOAP, for the uninformed, is just an XML-based protocol carried through HTTP. It doesn't BYPASS the firewall, it passes through the port generally held open for the use of web servers. We're packaging an XML envelope that a SOAP implementation can open and use, not passing some magic packet that your web server can use to format its harddrives. Firewalls can be made to use SOAP information to block SOAP packets, and servers don't have to respond to ill-formed, ill-conceived, or ill-meanings SOAP calls. How the heck can removing SOAP all-together be considered a practical security measure, anymore than simply removing the web server from the net entirely? Sure, you might get your C-2 rating, but is it worthwhile?

MS has attempted to create a high-functionality server platform, one that installs with the purpose of usability as its default. This simplifies the installation process, creating a process that relies less on the intelligence and experience of the user and more on the good nature of MS itself (as the one who created the installation system). MS does not necessarily have YOUR interests in mind, but the interests of a non-specific "user" in mind - a user whose needs profile may or may not fit your own. Microsoft needs to expand their thinking to include the needs of secure-minded individuals, granted, but the needs of ALL users should still be taken into account, and documentation created that explains the differences.

I'll be the first to admit that Windows has security issues, however, I contend that the nature of networking imposes security problems on ALL operating systems. I doubt too many persons could implement a secure 'nix OR a secure Win box. Intelligence and experience are required in both.

Re:'nix community standards

[schon]

SOAP [w3.org], for the uninformed, is just an XML-based protocol carried through HTTP. It doesn't BYPASS the firewall, it passes through the port generally held open for the use of web servers.

As I would be one of the uninformed, can you tell WHY it passes through the port generally held open for web servers?

Could it because that's the easiest way to bypass a firewall?

The market can move mountains.

[mystery_bowler]

I know most people will assume such a statement by Microsoft is just response to the bad PR they've endured after stating XP was their most stable OS and then a major hole was found in it. But, when you think about it, it really would seem plausible for MS to finally get serious about security.

Take all the factors that normally influence major business decisions - especially IT decisions - and you start seeing really compelling cases against MS.

First, there's cost. We all know Linux wins that one hands-down, since it's hard to compete with free. Next, consider stability. We all know Win95/98/Me are horrible when it comes to this, but let's remember that most businesses are running at least NT - which is mostly stable - and many have now upgraded to Win 2k, which is very stable (IMHO). XP is as stable as Win 2k, but I don't think most businesses have an interest in upgrading to XP from 2k, so I'm mostly ignoring XP.

Then comes the big one: support. Many IT people that manage MS-centric offices and networks will tell you that they don't trust the availability or amount of support for Linux. Linux gurus, on the other hand, call MS support a joke. This one, IMHO, is more or less a draw since both sides see it differently.

But after all that, you can mention the factor that makes even the non-tech execs cringe: security. If the CEO - now matter how technologically uneducated said CEO is - reads in the Wall Street Journal that there's a major security hole in Windows version Blah and the hole is large enough to present danger to critical corporate systems, said CEO is going to make damned sure the IT people either get the hole patched or ditch Windows version Blah to avoid security problems. In the past, the IT people could shoot down such directives because going from MS to Linux could present too many problems. But now we have Lindows and Wine to help support any critical Win32 apps and KDE and Gnome to make the desktop transition easier.

Again, this could just be MS lip service. But with all the current pressures combined with the future potential of Windows replacements, it wouldn't be all that surprising to see MS start trying to produce a product that deserves the corporate mega-bucks.

My first assosiation

[af_robot]

with words Security and Microsoft is Taliban and Democracy

Re:My first assosiation

[Anonymous Coward]

with words Security and Microsoft is Taliban and Democracy
Which one's which?

Contrast Between Mundie and Schneir/Shostack

[Mnemia]

I thought that looking at these two articles provided an interesting comparison. Mundie's idea of "trustworthy computing" is a world in which people don't think about the technology that makes their computing devices work. This seems to me to be pretty much the same philosophy that Microsoft has followed for a while now, ie lowering the level of knowledge required to operate computers.

By constrast, in the Schneir article, the viewpoint expressed seems to me to advocate people getting involved in the operation of technology. More configurability, plus more modular components, more transparent auditing/logging of OS functions etc. In the author's view, users should be aware of what their computer is doing.

This is the fundamental problem with Microsoft's view of security. Their focus on making things transparent to the lowest common denominator is at the root of all the architectural problems from lack of logging to Outlook viruses arising from scriptable email. They need to change their view that people should just view their computers as mysterious black boxes before their security record will ever improve.

Re:Contrast Between Mundie and Schneir/Shostack

[Ralph Malph Alpha]

Funny, if we take the conclusion of your analysis (that user-transparent security is the root ;) of all evil, while infinite configurability & user involvement enforcez security) and apply it to apple's oses and some linux distributionz like redhat, it seems that the opposite is true. redhat in all its configgable glory, like windowz, can be rooted out of the box. securing against such vulnerabilities is relatively difficult for the average joe user. Not so with macs, running mac os x or not.

Thinking that you can enforce a minimum iq requirement to use a computer safely is extreme idealism. and letz be realistic, theirs a point when it becomes counterproductive to choose security over transparency to the user (ease of use) and performance. pefrom

One reason everybody hates microsoft from a user standpoint is the fact that their software is quite complex, but their defaults pander to the lowest common denominator who care about features more than security (meaning, the people who should be using macs but aren't). Thatz' not intended as a dig at mac users, but you gotta admit, itz much safer to sit a moron down in front of a mac than to leave him vulnerable on windows or confused out of his wits on a non-customized linux box. i am sitting in front of a mac right now, and it feelz great. itz a secure computar!!!

Someone should tell Mundie...

[Akardam]

... that they used slide rules on the trip to the moon, too :P

Jesus H. Fucking Christ

[Shoeboy]

I cannot count the amount of times an NT server had to be manually power cycled because a service hung and wouldn't restart. This wasn't some oddball, third party service; this was IIS ("WWW Publishing Service" I believe)

I cannot count the amount of times I've heard NT blamed by ignorant users. On the resource kit, and also on the 2000 Server install CD is a pair of tools called tlist and kill. I thought every NT admin knew about those?

Do you reboot Linux when a userland process hangs too?

Yours,

--Shoeboy

Re:Jesus H. Fucking Christ

[Unknown Poltroon]

So, I've just purchaed NT server 4.0, and WWW server, and the tools to successfully run and troubleshoot them aren't included in either standard install? Me, I'll keep on blaming microsoft.

Re:Jesus H. Fucking Christ

[irix]

Except a lot of times (in NT 4 anyways) when you kill the web service with the 'kill' utility from the reskit, you are unable to restart the service. You go to the Services control panel applet and the "start" button is greyed out.

I'll never understand why 'end process' in the task manager won't work and the 'kill' utility which you have to get from another CD only sorta works. You'd think that the desingers of NT might have thought to include the ability to properly terminate a rogue process.

Re:Jesus H. Fucking Christ

[m_pll]

I'll never understand why 'end process' in the task manager won't work and the 'kill' utility which you have to get from another CD only sorta works. You'd think that the desingers of NT might have thought to include the ability to properly terminate a rogue process

Truly unkillable processes are rare.

I'm not sure but I think task manager issue was fixed in XP/.NET server - it now allows you to kill all processes except for the ones that would bluescreen the machine if killed.

On Win2K/NT4 there are several ways to kill any process using only built in tools. You can attach a debugger (right click, Debug in Task Manager or ntsd -p <pid>, then 'q' from cmd line). Or you can launch Task Manager in the System logon session using 'at /interactive' - this will effectively give you LocalSystem rights.

Re:Jesus H. Fucking Christ

[mabinogi]

I've always wondered this......

what exactly does the H stand for?

Re:Jesus H. Fucking Christ

[crayz]

I always thought "holy"

Trustworthy=Less freedom=MS DRM initiative

[hirschma]

Prediction: Microsoft introduces a platform, hardware and software, that will essentially block the user from doing many things that we take for granted. Sure, it'll essentially be a PC, but with crypto built into the hardware so that users can't work with "insecure" binaries. Or unauthorized ones, for that matter.

That last statement that Mundie makes in the news.com article is kind of chilling:

Yet the way we build computers, and the way that we now build services around those computers, hasn't really changed that much in the last 30 or 40 years. But it will need to. At a time when computers are starting to find their way into just about every aspect of our lives, we must build trust into these systems from the ground up.

What we're going to see is Microsoft collude with the hardware manufacturers to strip users of complete access to their own computers, in the name of "security". Hey, it worked for the US government time and time again...

fight the lip service

[bokmann]

Its only a matter of time before this 'leaked' memo, the associated press release, etc, will have the average person thinking that Microsoft is now secure.

Go around your office and start asking people, "Have any security holes been fixed on YOUR computer since Microsoft made those annoucements?" Educate people that the average Windows installation has something like 10 KNOWN security problems, and countless unknown (except to your worst nightmare).

Security holes do not get fixed by press releases. Unfortunately, people's perceptions do. Don't let that happen.

Re:If it affects the share price, MS will move fas

[GSloop]

Putting security into a system that lacks it in the first place is a hurclean task. (This has been said here by others already)

Putting together a team that really "values" security, and structures the programming and QA and testing of software, is a long and difficult task too.

Sure, I don't doubt that MS _could_ impliment these things. But they're not flashy - you don't get to "sell" anything based on this strategy for a _long_ time, and it doesn't really help you beat any competitor until you can show it works.

Thus, I predict that if MS isn't just using a marketing play and claiming that security is the next big thing - we'll have it "real soon now", it will be hard to stay the course. Thus, if I were a betting man, I woudn't bet on MS actually pulling it off successfully. Sure they might, but I'm not holding my breath, or waiting for MS to provide a secure solution, as opposed to anyone else that already is...

Re:My guitar...

[Mark Round]

Actually, it's a Frank Zappa tune.
But yes, the "G3" did do it justice.

So does Robert X.

[sootman]

http://www.pbs.org/cringely/pulpit/pulpit20020117. html

New products and upgrades based on increased security have a certain appeal. After all, you can never have too much security, so users can be convinced to upgrade over and over almost forever (just look at Mcafee). But there is a downside, too, which is that security and security performance are now firmly on the table. If Microsoft says it is going to make its products trustworthy and they aren't, then customers can rightly be upset. To this point, remember, Microsoft has pretty much disclaimed security, saying that all operating systems and applications are vulnerable. "It's not our fault." Well in the age of Trustworthy Computing, it WILL be their fault, though the cost to us will probably be continual and expensive upgrades.

Am I one of the few optimists?

[JWhitlock]

Am I one of the few people here that took Bill Gates' message at face value? That they have decided to make a top-down corporate commitment to security, probably due to external and internal pressures?

Bad security practices can be expensive - I know I've lost a few hours of work due to not having an up-to-date-and-scanning virus program. This has to have a definate impact on MS's operational budget, trying to figure out how to spin the latest virus while testing solutions against the entire MS suite. On top of that, there has to be some managers and employees that still believe the old lines, that customers pay for new features, not bug fixes, that interoperability and ease of use sell, not security.

Microsoft knows that it has won the Desktop OS wars, that it's closest competators are Apple's OSX (only runs on expensive hardware, so it will have a minimal impact on business sales) and Linux (still playing catch-up with MS). Now it needs to figure out how to sell upgrade units to existing customers, and has to think about the eventual multi-computer households with home servers, where it is currently losing to Linux. Most reviewers that tried XP loved it's stability, and I've even been tempted to upgrade my 98 desktop (which runs fine once you get all the programs working together).

Extra bells and whistles aren't doing it anymore - customers are tired of gaining ease of use at the cost of patches and bugs. Customers want an invisible operating system, which makes easy things easy, and they almost don't care about making hard things possible. This will require MS to transition from a company focused on beating competators by innovation (by whatever means) to beating competators by having a better product (more stable, less supprises, better cooked).

To make a change in basic philosophy requires a redirection of management. The Gates memo is the first step, and I think we can take it at face value. Sure, it's a strategy to further MS's competative edge, but I really don't think that there's anything underhanded going on here. I think Bill is giving the lowest guy on the totem pole a weapon to tell his boss - Here, I want to work this bug out before we release it; if you have a problem, take it up with Bill. That a Good Thing, and I'm planning to be suprised by what the folks at MS can do when they have the will to make a secure product.

SOAP and the MSFT way

[BlackStar]

There is a side thread in progress that touches on how SOAP is addressed in the article. I think SOAP deserves a lot more attention, especially as it affects MSFT, and the new .NET initiative.

SOAP is designed to use HTTP/HTTPS as the most common implementation of transport and protocol underneath. Schnier and Shostack touch on how poor a decision this is. I think this goes a lot further than many developers and companies are realizing.

You just removed your firewall.

The idea of SOAP is to allow IT services to be exposed as remotely addressable and usable procedures. Essentially with every web service or SOAP receiver, you have written a brand new server that parses XML protocol messages to decide on action. Thus every web service you create may have overrun, DoS and other exploits inherent in it, in your code, as you are executing paths based on a message from the outside. Just like a web server, ftp server or any other available server.

So now, everyone has to become better at security, to the point that the web services are safe. Ideally they should all run within a sandbox environment with restricted permissions, but considering SOAP authentication is based on HTTP authentication, the models may or may not match up properly.

Most importantly is that the SOAP specification team, including MSFT and the .NET portions pertaining to web services have basically increased the difficulty of every network administrator's job by stuffing all this over port 80.

Now if there is a vulnerability in a web service, the network admin has to take out port 80, probably taking down the web service, the web server, and who knows what else that's been tunnelled through there. They can't simply block a set port. UDDI could have advertised a port for the service as well, and stateful inspection could be implemented at some level on each service port to increase security and leverage off of the firewalls. Instead, a rat's nest of information is getting funnelled through http/https. The firewalls aren't designed for this, and the inspection task is only going to get more difficult as SOAP grows in popularity.

MSFT is always looking at first to market, and I can almost assure you that for that reason, SOAP was designed around port 80 and into the web server engines. I can also say with a fair bit of confidence that the first time MSFT gets beat to market due to a security review, that the security priority is going to get thrown right out the window of the executive windows at Microsoft if it causes the stock to slip.

Re:SOAP and the MSFT way

[Zeinfeld]

The idea of SOAP is to allow IT services to be exposed as remotely addressable and usable procedures. Essentially with every web service or SOAP receiver, you have written a brand new server that parses XML protocol messages to decide on action.

FUD

What you, Adam and Bruce appear to miss is that firewalls are rarely configured to allow incomming HTTP requests. If they are the requests are typically handled by a server located in a DMZ between two firewalls.

The firewall bypass problem is for outgoing requests. There is not actually a whole lot of difference in the security implications of an HTTP client posting a form in URL encoding and posting an XML document.

Re:SOAP and the MSFT way

[BlackStar]

I really think you need to examine SOAP, especially as it relates to RPC. When you make a request to SOAP, it's an incoming request over HTTP. Coming from an outside party to your ticket selling system to reserve a flight. That's the whole idea of published web services.

You might with to browse the powerpoint from Microsoft itself detailing .NET and Web Services at this location and then try to get a grip on how it works before decrying "FUD!". If you think Adam and Bruce are offbase on security, you obviously have no concept of the capabilities, experience or dedication of either individual. As for myself, say what you want. :-)

Re:SOAP and the MSFT way

[Zeinfeld]

I really think you need to examine SOAP, especially as it relates to RPC. When you make a request to SOAP, it's an incoming request over HTTP. Coming from an outside party to your ticket selling system to reserve a flight. That's the whole idea of published web services.

Any you would put a machine of that type providing an external service in your internal network???

You entirely miss the point, for every service there is also a client. The port 80 / firewall issue has nothing to do with the server end. It is when the client is behind a firewall that you have a problem.

There is no firewall bypass issue at the service end, a company that is providing a published dotnet service will modify its firewall configuration to deploy its product. The problem with firewalls comes when the IT dept refuses to modify the firewall configuration to allow use of services provided externally.

If you think Adam and Bruce are offbase on security, you obviously have no concept of the capabilities, experience or dedication of either individual.

I know Adam and Bruce very well, they know me very well. I don't think either of them would claim that they had greater expertise or experience than I do, and in particular not on this particular topic. Certainly neither would expect the automatic deference to their views you appear to think due.

On this point they happen to be mistaken. Bruce is very rarely 'wrong' about security, that is I do not recall an instance of him calling a system secure when it was not, he is however quite frequently mistaken in describing a system as insecure when it is in fact secure. If he could learn to discuss them in private with the relevant designers before launching public attacks his reputation inside the security industry might match that outside.

The point in question is a sngle sentence paragraph tacked onto the end of a section. I suspect that it was an afterthought that they had not thought through in great detail. If they want to call me up and discuss it I can go through the detailed analysis I have.

Re:SOAP and the MSFT way

[BlackStar]

Good gravy, I think you've caught me offguard offering a real, informed discussion on the topic! Many thanks for your attention.

Automatic deference, I admit, is a kneejerk from me to these individuals. When you're not an expert, you defer to experts, at least to start with.

Now granted, the SOAP server for argument's sake would *not* be directly in your internal network, but I expect likely in a "middle zone", not DMZ, but like a web server, a protected network with limited access to internal systems like J2EE and database servers. This doesn't really solve the problem though. All are going via port 80, and thus managing those services is less readily done via the firewall. Setting time zones of access, stateful inspection (if applicable) and some DoS defences (as I understand them, you're better to answer than I am, so treat these as questions worded as assumptions) become more difficult with one routed stream moving through the firewall. But that's really just cursory anyway, as the defence of a firewall is more high-level and perfunctory.

I totally agree that the problem comes when the IT department refuses to modify the firewall. That's why SOAP is being routed over the HTTP port by convention in the first place. That way they don't need to understand or worry about it, apparently. I expect we agree that this is the wrong way to approach the problem. The network engineers are part of the defence.

My large issue is that so many CGI scripts, which are really a precursor to web services, have been SO poorly written, especially with reference to security. Now you can write a web service in .NET with a few lines of code and a line identifying the method as a service. *poof*. You have a web service. And all the wonderful problems that go with trusting outside messages and directives. I personally think the concept is great, albeit not original (CORBA for one precursor), but that like so many things in network systems, it masks the vast majority of risks. SOAP is a prime example of a technology being viewed as always as a new, enabling technology, and not as a whole picture of a technology with inherent security concerns as well as business advantages.

And remember, the magnifying aspect of the automation of web services into the businesss processes make the security and reliability even *more* critical, as the amount of lost business and risk with errors is concurrently magnified.

I agree with Bruce and Adam's position not only by virtue of my respect for them, but also by my appreciation for the misapplication of so many technologies in the past by people not understanding the overall system. There will always be omissions and holes, but a balanced, rational approach is warranted with new connected technologies. SOAP has become "el buzzword supremo", and as such, the rampaging hordes of silver bullet hunters will be there, along with th e responsible adopters of the technology.

My hope is that people like Bruce, Adam, and by the sounds of it yourself would be able to present "the whole picture", by virtue of your understanding. It's not technical. It's psychological.

I'd enjoy taking this offline if you like, and if you don't mind, as I'd like to learn more about your views on this.

Re:If it affects the share price, MS will move fas

[Anonymous Coward]

> I think it is largely naive for the readership here to snicker and write off MS in this regard.

And I find it rather naive (if not down right ignorant, to resort to name calling so this can be a troll) to believe this won't be more than a marketing ploy. Remember "scalability days"? I still don't see any form of 64 processor nt servers. Not that I'm looking, nor would I really want to.....

Like any of their other "oh, shiney" *cough*inovations*cough*, it will at best require SP's breaking other features, or a whole new release requiring brand new hardware.

Why am I continually reminded of VMS?

Re:If it affects the share price, MS will move fas

[Oink.NET]

I would look for MS to make at least two major acquisitions in order to shore up their security offerings - they have used acquisitions in the past to shore up problem areas.

Microsoft has already made at least one of these crucial acquisitions in acquiring Colusa Software and turning Colusa's virtual machine technology into the .NET Common Language Runtime. The way the CLR makes buffer overflows impossible can be credited directly to Colusa's work. Microsoft's new programming language COOL, now called C# and branded with .NET, also was influenced by Colusa.

The irony in the ZDNet article: Microsoft was going to demonstrate their new virtual machine a while back, but "decided to cancel its presentation, claiming it did not fit with the show's 'visionary' theme." Now with Bill's latest "visionary email", it's back in the spotlight again as the technology that Microsoft is betting its future reputation for security on. They've been sitting on this one for quite a while now, and it has received the most extensive pre-release beta testing a Microsoft product has ever been subjected to, so they may actually have a chance.

The usual press response...

[DrCode]

If the past is any indication:

MS will do a barely useful job of improving security, and the press will proclaim that they invented it.

It will be just like multi-tasking in Windows 95 (i.e., "Users can now run two or more programs at the same time!!").

Time will tell

[Anonymous Coward]

So it has been less then two weeks since BG made the announcement. We can't expect mountain shaking changes from them in this short a time. If they are serious about making their products more secure then we shall have to wait and see. I know that within the IT community they pretty much have no trust as far as their word goes. I say give them the chance to earn it again. Let their actions speak for them not their words. If they do manage to make a reliable and secure product then that is a good thing. If not then we continue viewing them the same way we do now. As a company that can not be taken seriously to produce a reliable product.
In any event for their revenue streams it will be good. I can almost guarantee that the new secure MS Windows, and any app for that matter, will require a fresh install, no upgrades.

Re:Schnier co-writes a bad column! -- firewalls

[greenrd]

The real stupidity is those who think that by blocking all ports except http, ftp, and email, you thereby ensure system security for all time, and you don't have to keep up with new developments like SOAP. Firewalls are better than nothing but they're certainly not enough.

Trustworthy Computing...

[_johnnyc]

...is yet another marketing effort to alter the existing perception that MS lacks security. It is perception that really matters to Microsoft, not reality. Very typical of them to create a new word when one already exists. It's not about security, it about "Trustworthy Computing".

Re:Trustworthy Computing...

[place4linux]

"Trustworthy Computing" = Security Through Obscurity.

Bill G: "We don't need real security. We just need to make people think that their computers are secure."

Vunerabilty?

[archen]

I remember some MS propaganda stating that Linux and other Unix based OS's inherited 30 years of vunerabilities, yet NT was wonderfully secure because it was a much more modern OS. NOW they're making security a priority? Don't tell me M$ has been lying to me!

Actually, it's a little more complex.

[hotsauce]

MS may now be trying to move into to a different market, one that values security above point-and-click.

The BBC sums it up nicely.

Re:Actually, it's a little more complex.

[Banjonardo]

Actually, it's a little more complex.

What????? Something more complex than how it was explained in slashduh? It.........cannot............be.................

Well then, let's use Java

[Anonymous Coward]

When I read the first article (Schneier et. al)
I had to congratulate myself and our company for
chosing Java as our development platform.

Buffer Overflows? - Gone.
Dangling Pointers? - Gone.
Uncontrollable access to host computer? - Gone.

I wonder though...

[ackthpt]

Is this really the -NEW- Microsoft, taking responsibility for security in their OS and applications OR is the the -SAME OLD- Microsoft doing this because they'll roll out their own Security Consulting Service or certified specialists (let's call them Microsoft Certified Security Specialists) to tell clients, "Yeah, that's one of our gaping holes, lemme call it in, by the way, it'll cost you a few thousand for Microsoft to repair this and issue the fix."

Sure the security gaps, shoddy Q/A (i.e. let the customer do this) and worms have made interesting press (including Gartner Groups suggestion business dump IIS, you may disagree with Gartner, but PHB's everywhere listen to them, not you) and is probably costing them a few bucks, but there's still an army of people out there who still buy M$ only, because "nobody ever got fired for choosing Microsoft."

I'm too jaded to accept this as a genuine effort by Microsoft, which has left the security worry squarely on the shoulders of the client, to clean up their own mess and stop making them. I think there's an ulterior motive which we'll see later, like waiting for the other shoe to drop.

Re:I wonder though...

[Thing 1]

I'm too jaded to accept this as a genuine effort by Microsoft, which has left the security worry squarely on the shoulders of the client, to clean up their own mess and stop making them. I think there's an ulterior motive which we'll see later, like waiting for the other shoe to drop.

I've seen that ulterior motive being discussed already. I don't have pointers to the actual documents, but part of the settlement was for Microsoft to open their protocols except where it had to do with security.

So, in Microsoft's eyes, everything now deals with security.

Everything stays closed. Business as usual.

Re:I wonder though...

[ackthpt]

I've seen that ulterior motive being discussed already. I don't have pointers to the actual documents, but part of the

settlement was for Microsoft to open their protocols except where it had to do with security.

So, in Microsoft's eyes, everything now deals with security.

My word! It's like they have learned from Congress! Scary!

Kerberos could be a first step

[BlackStar]

Removing that idiot extension to Kerberos that broke compatibility and modified without examination (at release -- it's been plenty examined now) is one thing they could start with. Release the modification, and the Kerberos networking code for MSFT OSes into the public security community. Interoperate and cooperate on the stuff that's really central in secure environments.

Or you could look at that act as proof that they want to own the security. Not necessarily create it.

But that's a big part of MS's assets

[JMZero]

Backwards compatibility sells MS products. Losing it will open the floodgates. MS won't do it.

Apple is a very different animal. They can sell anything. Just not to everybody.

In any case, "going back and rewriting everything" always sounds like a good idea, but seldom is.

"Going back and rewriting the worst stuff" is probably a much better idea.

How Linux could do this

[Animats]

• Start with NSA Security-Enhanced Linux.
• Break up some major applications, like Apache and a mail handler, into modules that run with different privileges. Basic rule: if it's trusted, it doesn't do much, and if it does much, it's not trusted. As an example of an untrusted process, in mail handling, each process talking to a network port runs in a jail. It can talk to its network port, and, with restrictions imposed at the database end, to the database. It can't do much else. So even if it has a buffer overflow, it can't do much.
• One of the remaining Linux companies (is anybody but Red Hat left?) should offer a warranty program. If it breaks, we fix it; if it damages your data, we pay. Offer this to corporate customers along with a support contract.
• Kill Sendmail. It's never going to be secure.

Re:How Linux could do this

[Anonymous Coward]

"Break up some major applications, like Apache and a mail handler, into modules that run with different privileges."

What a beautiful way to slow down everything to a crawl.
You are genuine genius.

Kerberos and MSFT -- a start

[BlackStar]

MSFT could start by releasing all the crap they did with Kerberos and the 1 bit extension they put in to ensure incompatibility and create a semi-proprietary extension. Release that to the public with the code so that the experts can see if Kerberos was in any way broken or compromised by the MSFT implementation.

Doing that to the protocol was before Bill's memo, but it's indicative of at least a few people involved in security interoperability that really don't get it.

Schneier & Shostack are right

[beagle]

In their article, they say that trustworthiness is something earned. That's right. Microsoft's past security breaches and spyware have caused me to totally lose faith in the company. As a result, I am now a Mac OS X fan. (Well, that and the fact that OS X is for now the best desktop Unix around.)

Microsoft will have to drop its spyware and its insane licensing policies before I will try Windows again. Microsoft will have to drop the Globally Unique Identifier before I will use Windows Media Player.

In short, this is a good move for MS, but for me it is too little, too late. I have switched to Mac OS X and will never go back to Windows.

Re:Schneier & Shostack are right

[Anonymous Coward]

They are right, you are wrong. Many of the problems they talk about exist in OS X because it runs software developed by MS. Linux is the best desktop nix clone bar none.

[OT] Re:It seems to me

[fader]

I'll probably be modded down as troll or flaimbait, but then it just shows the /. mentality.

If I had modpoints, I would definitely mod you down. Not because of the article you link to (in fact, I'd mod that +1 informative otherwise) but because of the perfect example of /. mentality: pretending that you're some poor put-upon soul preaching the truth while everyone else around you refuses to listen to reason.

For every one '-1 Troll' mod that a genuinely informative or interesting pro-Microsoft piece gets, it generally gets +3 or 4 from the 99% of moderators who aren't out just to get you. You're really not being hunted down because you like MS... it's not worth our time. Pretending to be some sort of karma martyr is getting fscking old.

Re:[OT] Re:It seems to me

[Unknown Bovine Group]

You guys spend WAY too many brain cycles on modding and karma.

Karma points do not actually increase the size of your penis.

Re:[OT] Re:It seems to me

[aardvarkjoe]

Karma points do not actually increase the size of your penis.

That's what you think; you've obviously never had any.

Re:[OT] Re:It seems to me

[Anonymous Coward]

Point proven. There are moderators like you who abuse the system. Archanagor made an insightful post, and the abusive moderators bitchslapped him. This post was not deserving of a Troll mod.

Re:If it affects the share price, MS will move fas

[archen]

To me that's where MS is going to have a problem. I don't think any sort of aquisition will help. Security is a mindset. To MS security has always been an after thought after everything else is done. More money isn't the solution. More programmers isn't the solution. The programmers they already have need to "see the light" first. Then they have to do is fix all their stuff, and some of it i imagine couldn't really be made secure unless they rebuilt it from the ground up. Can MS really do this considering their applications tie into just about everything else on the OS? That remains to be seen.

Starting from scratch

[czth]

But wasn't there an interview with the former Project Manager for Excel who said why some of their competitors failed was because they restarted from scratch (i.e netscape).

The manager was Joel Spolsky, the article is here, and his site is Joel on software which has a lot of good articles. Since he's a manager with (it appears) a proven track record, bosses might just listen if programmers go to them with his articles. By the way: the place I work at now gets 0/10 on his software development methods test.

czth

Re:Starting from scratch

[rikkards]

By the way: the place I work at now gets 0/10 on his software development methods test

Especially since the score is out of 12 (it looks like)

Propaganda

[kenneth_martens]

Given Microsoft's business success record (legal or not, they make a lot of money) if Microsoft says they are going to focus on security, that should be taken seriously. I have no doubts that if Microsoft wants to, they can make products as secure as their competitors' software. (After all, when Microsoft decided to kill Netscape, they did so fairly well. If they decide to be secure, they can do that too.)

The question is, how badly do they want security? Their new focus on security may require them to make their new software and OS less backwards-compatible, or not quite as user-friendly. Microsoft may have trouble seeing their products' ease of use drop in the short run--they've put a lot of work into making Windows easy to use. So basically it comes down to this: are they willing to sacrifice some ease of use (and beef up their technical support) in order to produce more secure products? If so, great. If not, then it's all just propaganda.

Windows XP stable? HAH!

[David Jao]

I have nothing bad to say about Windows 2000 (other than that it's proprietary), but Windows XP is not anywhere near as stable as Linux by a long shot.

See for example this eweek article:

Another IT professional, based in California, who runs Windows XP systems for testing purposes, said that after installing the latest batch of XP security patches on four systems running XP Professional, all the systems became unstable.

"I'm seeing system failures requiring a reboot about once a week on each machine," said the user, who requested anonymity. "Before this latest batch of patches, I hadn't had to reboot any of these boxes. They were as stable as Windows 2000 Service Pack 2 or my Linux 2.4 systems."

Re:Windows XP stable? HAH!

[OSgod]

So the XP implementation of apt-get burned the administrator.

Shame on the IT "professional". Never, ever run any code in production that has not been thoroughly tested on the intended platform. Run it in test only. It is not professional to say "apt-get" on a production server or workstation if the patch has not been tested on that configuration of hardware.

We're all gonna DIE!!!!

[coyote-san]

We're all gonna die anyway, so there's no point in trying to put off the inevitable!

Let's smoke and drink and eat nothing but onion blossoms and have unprotected sex with gutter-crawlers. We're all gonna die anyway!

And we can't forget about Joe - ate well, exercised, etc., and he still got cancer and died at 24. Why bother?....

What will it take to kill this damn "all software has bugs" crap? Of course it's possible to write bug-free software - look up "formal methods" or "correctness proofs" on goggle. It's just very expensive and isn't used unless a bug will result in death.

But more practically, I've been at few shops (maybe one in almost 20 years) that couldn't eliminate the vast majority of their bugs with some simple changes. Things like TURNING ON COMPILER WARNINGS - you would be shocked how many times I've come into a site (as a troubleshooting consultant) with a flaky code base, turned on compiler warnings (which are inevitably disabled), made sure every variable was initialized and functions were called with the right types of arguments and the code was immediately described as "more reliable," "less fragile," etc. Yet this rarely takes more than a week to complete.

If I were security czar at Microsoft (and pigs could fly....) my first order would be that every developer drop everything else to turn on compiler warnings and eliminate these warnings. (Some warnings are acceptable, but not uninitialized variables, wrong number of arguments or wrong types of arguments.) Shouldn't take more than a week, even if function prototypes have to be defined from scratch, and the code will be a lot more solid.

Then there's the buffer overflow issue - "grep" is wonderful at locating sprintf(), strcpy(), strcat(), scanf(), and other problematic code. It's normally easy to convert them to the safer functions. "grep" can also find snprintf(), strncpy(), memcmp(), strncmp() etc with hardcoded array sizes - too easy for the size of a buffer and the function calls to get out of sync if you don't use a manifest constant or sizeof().

Overall, there's about a dozen simple steps you can do that will eliminate essentially all of your serious bugs. Some of these steps can be done quickly, others can be painful if a shop has been sloppy (e.g., 'programming by contract' and adding assertion checking to existing libraries.)

To be sure a nontrivial application will still have bugs, but they're much less likely to be ones that an attacker can exploit and there's no justification for a site not following these practices. Yet we keep hearing the fatalistic "all code has bugs, we're all gonna die anyway!" chants and nobody takes the simple first steps to fix bugs or eliminate the worst of their personal habits.

Re:We're all gonna DIE!!!!

[Sir Tristam]

Yet we keep hearing the fatalistic "all code has bugs, we're all gonna die anyway!" chants and nobody takes the simple first steps to fix bugs or eliminate the worst of their personal habits.

Every point you make is quite valid. However, there is a distiction between "all code has bugs" and "bugs in code are inevitable". If a program has a bug in it, it's in the vast majority. There should be little stigma in admitting that there was a bug and fixing it, instead of ignoring it and hoping that not many people will notice. Perhaps I should have said, "All software ... have bugs; that's not unusual. Admit them, correct them..." instead of "All software ... have bugs; that's simply life. Admit them, correct them..." We'll just chalk it up to a bug in my previous post, which will be fixed in the next release. I was trying to state the current status of reality, not an attitude of being resigned to rampant bugs being unavoidable.

By the way, correctness proofs only demonstrate that the code correctly implements the algorithm specified and still doesn't handle the problem of selecting or designing the correct algorithm. They therefore attack only one point in the development process where bugs can enter. (You already know this; just letting the others in on the fact that there's no silver bullet.) Full compiler warnings are a good thing; another thing I would insist upon is that a programmer use a debugger to step through every line of code affected by a change, and make sure that the program execution flow is what they had intended. It's amazing how many bugs I've caught this way.

Chris Beckenbach

My response to Microsoft

[Aceticon]

Dear Bill

It saddens me to see Microsoft exiting the highway of consumer satisfaction into the dirt road of security.

As a long time fan and appreciator the Microsoft way, i feel i must stand up and ask:

Why?

Microsoft has done more than any other company to turn Desktop Computing into a thriling adventure. From the very moment i turn on my PC, i feel i'm entering a world of wonder and surprise, where new adventures can happen at any moment:
- Maybe Windows will not start-up and i end with a black screen.
- Maybe it will start in VGA mode
- Maybe clicking in the explorer toolbar wil result in a blue screen
- Maybe Word will crash when i'm editing an important document.
- Maybe installing the newest IE will make half my applications stop working.
- Maybe after installing the newest DirectX Windows will stop working.
- Maybe i'll open an e-mail an my PC starts acting funny.
- Maybe i'll get a phone call from my ISP saying a Denial of Service attack to the Whitehouse site has been detected from my machine.
- Maybe the mouse pointer will start moving by itself
- Maybe all my files are deleted.

Why? Why do you want to remove all the thrill and adventure from my life???

Re:My response to Microsoft

[Zog]

- Maybe i'll get a phone call from my ISP saying a Denial of Service attack to the Whitehouse site has been detected from my machine.

Well, personally, I think whitehouse.com is a bit overrated, anyway....

(This moment brought to you by the letter upside-down-i)

Re:My response to Microsoft

[frozenray]

- Maybe the mouse pointer will start moving by itself

You know, every time I told my coworkers that the mouse pointer scuttles across the screen by itself at odd intervals on my PC, they would give me odd looks and walk away from me. Now I can show them your post and get back some social respectibility - thank you!

Everybody's getting too worked up.

[rhizome]

Of course, the only appropriate response to Microsoft's initiative:

*What* security problems?

Think about it, if the industry plays dumb the way that Microsoft has for the past 10 years, then they will have to enumerate their history and how they might address the problems. Speculation on my part, sure, but they sure don't deserve all of these free ideas.

I'm an MCSE, and while Microsoft's lameness has provided me with a nice career for the past several years, but I still have nerdy idealism governing my attitude. :) It's been many years that my standards of quality have been much higher than Microsoft's, and now we see that they want to "lead" into the future. Well, start by catching up.

Re:Everybody's getting too worked up.

[fire-eyes]

It's been many years that my standards of quality have been much higher than Microsoft's...

High enough to be an official MicroSoft mingion right?

Mmmkay.....

Re:Schnier co-writes a bad column! -- firewalls

[BlackStar]

I agree in principle, but bundling services together is still a bad idea, and in fact Adam and Bruce state that rather clearly at the outset. The ability of the firewall to separate, manage and in some cases via stateful inspection assist in the security of each service separately is still a desirable methodology.

The clean break is already on its way

[Oink.NET]

Microsoft's clean break is their new "virtual machine" which is about to be unleashed on the world, AKA the Common Language Runtime [PDF]. It's basically a whole new platform riding on top of Windows (and maybe others if things like Mono pan out), and this time security is supposedly built into the architecture from the ground up.

Re:What about the potential implications for Linux

[AFCArchvile]

Sir, I salute you. However, a secure Windows won't appear overnight. At least it's good knowing that Bill Gates had an epiphany.

Another Reason

[Anonymous Coward]

The whole idea of 'disable non-secure features by default' is crap. How about just making the features secure to begin with?

distraction?

[GPer]

Is anyone concerned that M$' new focus on security could really mean that they're getting into the firewall/router market? If M$ says "to be truly secure," you must run our firewalls and routers, and businesses follow suit, that puts them in a good position to displace TCP/IP as the standard networking protocol and replace it with a M$-proprietary protocol.

Re:If it affects the share price, MS will move fas

[Sloppy]

I would look for MS to make at least two major acquisitions in order to shore up their security offerings - they have used acquisitions in the past to shore up problem areas.

An acquisistion can't fix their problems. It's not like they can buy some 3rd party program, and then Word and Excel macros suddenly won't work any more. Buying a product won't fix Outlook's "click here to execute virus" user interface. The only way an acquisition could fix their problems is if they use acquired products to replace existing products. (e.g. buy a new word processor and sell it instead of Word.)

Its about features that MS can steal from Linux

[GoofyBoy]

Take all of these things which you mentioned and in X years MS can and will bring it to their OS.

The only thing that MS won't copy of Linux is price. But then again, MS has alot of advantages (non techincal) which Linux will not have. (Professional sales force, mindshare of upper management, closed source digital rights management, premeire gaming software etc)

abstraction

[Stalcair]

that is a good moral indeed. However, I believe instead of saying, "It's a lot easier to design security into a system in the first place, than to try to add it on later" Perhaps it should be more on the lines of, It is better to design FOR security in the first place. No one can predict the future, and often the best layed methods of security today, show up tomorrow to be the gaping holes of vulnerability. Either way, if you hard code things like that in, then you will end up having your work cut out for you. The only constant in the universe is change itself, so modularize as much as possible (if only in your code base, but not necessarily in the completed product).

In your story, the problem could have been that the money was simply not available (or some other logistic issue existed) to initially put in locks. But maybe, a lesser (but still perhaps more than no implementation) preporatory 'middle ground' could have been put in.

For example, many doors have no cut out section along side the knobs. (doors where no locking is anticipated) However, why not buy normal doors and frames, but no lockable knobs. Or as I have seen before, have a door pre cut for any cipher locks or such, but put a plate on that section for the later time when the cipher will be needed.

Another aspect of this, is that when security and vulnerability methods change (which they will), it is cheaper/easier to convert.

Or I could be nuts... I have drugs in my right now (no, not that kind) that could be making me rather loopy!

Microsoft's list of new "security" features

[Alsee]

It seems to me like MS are doing this just to counteract the recent bad press

They are securing the operating sytem from "attacks" by authorized users.

They patented Digital Rights Management Operating Systems.

Any increased security against unauthorized attackers would be accidental.

If you read the patent you'll see they plan to keep the user locked down with an iron fist. It appears to require a special RightsManagement CPU and continous internet access for validation. Patent has 24 claims (new "security" features), condensed below:

1. 1 protecting the rights-managed data from access by an untrusted program
2. 
   2 refusing to load the untrusted program into memory
   3 removing the rights-managed data from memory before loading the untrusted program
   4 terminating the execution of the trusted program
   5 renouncing the trusted identity before loading the untrusted program when the untrusted program executes at the operating system level
   6 securing the rights-managed data written to a page file
   7 prohibiting raw access to the page file
   8 erasing the page file before allowing raw access to the page file
   9 terminating the execution of the trusted application
   10 encrypting the rights-managed data prior to writing it
   11 protecting the trusted application from modification
   12 refusing to attach the untrusted process to the trusted application
   13 preventing the untrusted process from accessing memory
   14 restricting a user to a subset of available functions
   15 restricting a user to a subset of functions available for modifying the trusted application
   16 (nothing)
   17 operating system causes the processor to create a trusted identity (Requires RightsManagement CPU?)
   18 operating system further causes the processor to protect the rights-managed data
   19 secure the rights-managed data on the page file from access
   20 causes the processor to erase the rights-managed data
   21 revoke the trusted identity and terminate the trusted application prior to loading an untrusted program
   22 obtaining, from a computer processor, a first value for a monotonic counter (Requires RightsManagement CPU!)
   -22a receiving, from the trusted time server, a certificate ... a trusted current time (Requires Net access!)
   -22b determining whether to load the trusted component
   23 [presenting] the monotonic counter occurs on a pre-determined schedule (Requires continous internet checks!)
   24 date and time at which the trusted component becomes invalid

-

Re:Microsoft's list of new "security" features

[Anonymous Coward]

Item 16 sounds like MS's prior art, but, how does one patent doing "nothing"?

Re:Microsoft's list of new "security" features

[MindStalker]

well they arn't individual patents they are parts of one patents. Each of which the guy summerized, and realized he couldn't properly summerize #16 without over explainig the other parts.

Setting an impossible task

[iangoldby]

Schneier and Shostack are trying to pull one of the oldest tricks in the book. They agree with and welcome Microsoft's new intentions. Then they set out what they think Microsoft will need to do to put it into practise. The trouble is, the very things they list as the first vital steps are exactly the things that are most abhorrent to Microsoft. If Microsoft are going to change anything, these are the last things they would ever consider.

It may be that Schneier and Shostack are trying to pull a very old trick, but they are also very right.

Consider:

• Data/Control Path Separation. Would Microsoft really remove macro functionality from Outlook Express? And completely U-turn on integration of the internet with the desktop?
• Default Configurations. (This involved separate tools for separate tasks rather than monolithic applications.) Such a move would force Microsoft to accept that IE should not have been bundled with Windows, that users should be able to choose a 3rd party spell-checker for Word... If you can perform powerful operations by stringing together a series of small tools that do a single task very well, you can get those tools from wherever you like. That's bad news for Microsoft because they lose control.
• Separation of Protocols and Products. Again, this strikes at the very heart of Microsoft's monopoly position, allowing a mix-and-match approach.
• Advance Publication of Protocols and Designs. This would give competitors the ability to beat Microsoft to the market place by taking a protocol that Microsoft has published and writing their own implementation. Again, a strike right at the heart of Microsoft's monopoly.

Amusingly, in these recommendations, which are anathema to Microsoft, Schneier and Shostack seem to have rather neatly told us what Linux looks like. (I particularly liked the bit about scrapping the monolithic Registry...)

I too think SOAP requires attention

[Anonymous Coward]

from certain geek types.

Some good things suggested, some bad.

[Chanc_Gorkon]

I am playing the pragmatic approach with this whole thing. Windows IS in need of a rewriting some parts of it. One example is e-mail (Outlook and Outlook Express) as mentioned in the article. One thing that is mentioned in some posts here is they need to drop the compatablity stuff. I don't really think this is the cause of their problems. If that was true, then Linux and other UNICE's should have a problem as well and we know they don't have a problem running old stuff either. They DO need to drop the DOS kernel which is unsecure in the first place (everything runs as root.....EVERYTHING!). The also need to start dropping support, slowly, for 95 (already done so)/98/98se and ME. Remember these suckers above have no security essentially. The auto download thing never worked right anyway. If they want to notify folkd of these, the should have a automatic check for updates thing ala AOL/Winamp and several other apps and not automatically download stuff and install it. Nothing should be installed unless a admin is at the console. That is a good suggestion. Granted, Debian users can automatically setup a cron job to apt-get update; apt-get upgrade;, but do they do this? No! EVERYONE who uses Sid (or previously the unstable Woody, now in testing) knows what it's like to have working Xfree86 one day and then apt-getting a new version and it friggin breaking things! That's not only a security risk running these automagically update things, but it also can break things causing a server to need a reboot or whatever to fix it. That's why these things MUST be attended when running.

Microsoft also needs to STOP THE INSANITY with reboots. On Linux, the only four times I had to reboot after updating something or just using a linux system was once when it was a kernel, and again after making a change from HW_cursor to a SW_cursor on Permedia 2v graphics card because if you didn't X would go all wonky, and even then the only reason it needed a reboot was to get rid of the dead mouse pointer (rebooting resetted some clocks or something that made the hardware one go away), if something locked up (beta/alpha code can do this! :) ) or to reboot to play games/use something in Windows. If I had VMware, only reason for this kind of a reboot would be for games (until someone figures out a way to run DirectX games under Linux or VMware....). Reboots are bad. Not necessarily for security, but for general uptime. Figure out a way to install and update software without needing this step. Both the changes in security and the reboot thing need ot be handled to increase reliability of these systems.

Comment removed

[account_deleted]

Comment removed based on user account deletion

UNIX = legacy

[scorcherer]

Just because something is backwards compatible doesn't mean it's bad. There's a lot to be said about sensible design in the first place, so that future extensions don't break everything. This is my impression of why unix is still successful.

In some ways, Windows is still based on DOS, which was crippled to begin with. It was never intended to do multitasking or run servers.

Besides, when Windoze people note that my unix box is 'obsolete', the best word I can reply with is 'evolution'.

Re:UNIX = legacy

[ZxCv]

In some ways, Windows is still based on DOS, which was crippled to begin with. It was never intended to do multitasking or run servers.

Uh, maybe Win9x-ME. But NT was a 32-bit multi-tasking operating system from the get-go. No it wasn't perfect at first, but it was certainly not based on DOS in any way, shape, or form. It had a DOS-like command window, but that was about it.

Re:UNIX = legacy

[hummingtroll]

Besides, when Windoze people note that my unix box is 'obsolete', the best word I can reply with is 'evolution'.

That's my feeling exactly. If Unix is a dinosaur, Linux is a crocodile. A "dead-end" evolutionary design that's managed to survive for millions of years, crocodiles are ugly and scaly but their jaws will crush your bones like twigs. While crocodiles may not light fires or swing gracefully from tree to tree or buy Madonna albums, boy oh boy, you dunk a monkey in the river with one and you'll quickly find out which one's supremely adapted to THAT environment.

Re:UNIX = legacy

[scorcherer]

NT was a 32-bit multi-tasking operating system from the get-go.

Yes, but the legacy goes on. The marketing suits wanted to maintain the crippled 9x user interface, while the underlying OS could have done so much better (rot1(VMS) = WNT).

Re:UNIX = legacy

[perky]

nice analogy. At least it's funny, though I can't really agree with the proposition that Linux is adapted to a specific "environment". In fact i'd argue the opposite: the generic architecture is sufficiently flexible that smaller adaptations to local environment are possible. Perhaps a better analogy might be basic architecture stand on two legs, have two arms with opposable thumbs, etc. local adaptations height, skin colour, strength, endurance, balance, operation at the extremes of temperature, plays NBA basketball etc.

Having said that, I suppose Windows is better suited to secetarial work in the office. And it's everywhere. In the spirit of evolutionary analogy perhaps we could consider it as that lowest common denominator of survivors: the cockroach.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Excellent!

[Anonymous Coward]

Best troll in a while (in terms of people biting). Modded to +4 and a shit load of comments.

Well done!

i don't think it's just paranoia ! see inside.

[spd_rcr]

quoted from http://www.securityfocus.com/columnists/54
"Regardless, the memo comes at a good time. As the sun sets on Howard Schmidt's days as Microsoft's chief security officer, and he prepares for his new role as the number two man at the United States' Critical Infrastructure Protection Board,"

anyone want to tell me how some one responsible for the most insecure software releases on the market is promoted into a government security role ? wasn't there a joke about microsoft postponing their antitrust settlement until they had a controlling interest in the united states ?
at least we'll have a settlement soon eh ?

Re:What about the potential implications for Linux

[OSgod]

Of course you were using NTFS so it recovered within a few minutes.

If you weren't they should pull your OS license.

MS Who?

[Anonymous Coward]

Microsoft who?

Linux=OpenSource=Freedom

broken

[MenTaLguY]

I've written a fair amount of software that uses the NT security facilities.

The NT4 security APIs are totally useless. (read: they've left them half-_BROKEN_ and pretty much unfixed through all of NT4 through W2K through XP)

If you want to manipulate security objects you have to use the NT3 APIs and build the security structures yourself "by hand".

I realize this sounds kind of incredible, but don't take my word for it. Search comp.os.ms-windows.programmer.misc, comp.os.ms-windows.programmer.win32, or even microsoft.public.win32.programmer.kernel for "EXPLICIT_ACCESS" and/or either "GetNamedSecurityInfo" or "GetSecurityInfo".

In this light it's not surprising most Windows software (Microsoft and otherwise) doesn't take advantage of this security infrastructure. It's a maddening pain to actually use.

Re:What about the potential implications for Linux

[Anonymous Coward]

Spot on, my dear old boy! Spot on!

KRAPPY LINK

[ReidMaynard]

Since I am interested in the security of corporate systems, I analyzed only those sub-set of advisories that would be relevant to corporate infrastructures. Thus I ignore advisories that deal with email systems, browsers, and client applications.

In general, there are three categories of security problems.

The first category is user complacency. The most common example of user complacency is when a user opens an unknown email attachment.

Ummm...how do you open email without an email system?

I bet Roger Sessions of objectwatch.com is enjoying his nice (M$) bonus; that is, if the whole company is not a Microsoft stooge...

Re:KRAPPY LINK

[Anonymous Coward]

As far as I can tell "objectwatch.com" is one guy who's a VB consultant or somebody and basically has nothing better to do but stooge for Microsoft by regurgitating their product whitepapers.

His work is so amaturish that I dearly hope MS isn't stupid enough to be paying him. They can buy better propaganda.

NTVDM

[OSgod]

Is built in and has been since NT3.1. Each 16bit app can start in it's own NTVDM or you can run them all in one NTVDM -- your choice on an app by app basis.

It works, it doesn't bring down the OS and many apps actually run better in an NTVDM.

The clear reason ..

[Anonymous Coward]

... why Microsoft (I say Microsoft and not Bill Gates because I am sure it was a well planned publicity stunt) made this announcement was to assure people that their .NET initiative is going to be a reliable and secure platform.

If you look at the timing of Bill's letter, it was released on the very same day Visual Studio .NET (the toolkit used to build .NET applications) was released to MSDN subscribers.

Enron?

[OSgod]

You mean the company that was such a major D party contributor? You mean the company that usually had an employee on each presidential plane?

Ahh -- the one who found they could not bribe W as easily as Clinton and was exposed?

Without a doubt MS is now playing the political game. Kinda like the internet -- they didn't create it, they didn't play in it at the beginning and they will probably own it within a few years.

The business of MS is business and they know it well.

Re:Enron?

[frozenray]

>> You mean the company that was such a major D party contributor?

According to this and to the major national newspapers in Switzerland, they certainly were not choosy when it came to brib^H^H^H^Hcontributing to the other party as well.

>>Ahh -- the one who found they could not bribe W as easily as Clinton and was exposed?

Without supporting facts, this looks like a "Post Hoc, Ergo Poster Hoc" fallacy (Enron got busted under the Bush administration, therefore the Clinton administration was corrupt and the Bush administration is not). I'm not saying that there is no causality, only that without solid facts, it's just wishful thinking.

Raymond

Re:Enron?

[bnenning]

Without supporting facts, this looks like a "Post Hoc, Ergo Poster Hoc" [texas.net] fallacy

You're right, but the poster you were responding to wasn't claiming that Enron is Clinton's fault, just that it isn't W's. The Democratic strategy is to repeat the words "Enron", "big oil", and "criminals" in as many sentences as possible in an attempt to smear Bush, despite the fact that there is absolutely no evidence of any wrongdoing by his administration in this matter.

Re:Enron?

[frozenray]

The usual political guerrilla tactics, I guess. The theory is that even if nothing can ever be proved, the smell of a possible scandal will cling to the other person/party and lower its credibility. The Republicans tried the same tactics with mixed results (Whitewater, Monicagate) - which doesn't excuse the Democrats trying the same stunt now.

By the way, I misspelled "Post hoc, Ergo Propter Hoc" in my first reply, sorry.

Raymond

Security Focus gets it right. I doubt M$ will

[CodeShark]

Having done an amount of C++ coding back in the early years of Win9x, I have extreme doubts that M$ has the commitment or the ability to do anything more than "patch the leaky tires". Here's why: IMO the code structure upon which most MS apps are built (MFC classes) has some deep down design flaws which can't be rectified without introducing serious compatibility issues with any other MFC apps already out there.

As an example, we wrote a test app with a different foundation class library that was bug- and memory-leak free in all of the major WinXX OS's up through 98 and NT 4), and even compilable and bug free back into Win 3.XX. The whole app was a total of 123K: the Microsoft Foundation Class (MFC) [version 3.2, IIRC] test app as created by the wizard came in at just over 1 Meg, riddled with memory leaks, logical errors, etc. Our determination was that it wasn't just a bad wizard -- the MFC itself was causing many of the leaks and problems.

Now then, if you look at the Win API set now (Y2002), it is just that much more massive than when I last actively coded to it -- but the underlying code classes look much the same. [I haven't done a diff, so I can't prove it.]

So accurate or inaccurate, I don't think Microsoft has the corporate will to change from a company built on FUD (fear uncertainty doubt) to a company whose software is something I can trust because it doesn't even look to me like they have fixed all of their original problems in the foundational code classes from the early days of Windows 95.

M$ Secure PC Instructions

[aroobie]

FROM M$:
In order to secure your PC while having a Micorsoft product installed, unplug the power cord from the wall AC outlet.

NEW AND IMPROVED

[greymond]

M$ now offers COMPLETE security and stability for all there products - simply shutdown your system, unplug all cables, disconnect your modem/dsl from the wall and instantly be amazed at how theres no more CRASHES or HACKS in this totally secure and stable environment!

Warning: stability and security may be compromised if machine is operable.

Re:What about the potential implications for Linux

[MrTaz65]

At least get your facts straight.

You do not need the internet to activate your product. A simple phone call to the number provided will get you your key.

Please, no FUD, it's not becoming of you as an individual, or linux users as a group.

Yeah right

[Anonymous Coward]

If it's flamebait, how come you're the only one who's even mentioned it?

Sounds like you're just another bitter Windows user.

Gullibility

[epepke]

The problem is that an alarmingly large number of people cannot distinguish between the following:

• Security
• Words about security

What has happened to the software industry in general is exactly what has happened to the American political process. If you make promises and then cash the check, it doesn't really matter if you deliver. The reason is that people are gullible.

So you think, "gosh, wouldn't it be great if they've finally decided to do it right." But they haven't done it; they've just said that they are going to do it. Any support for mere words on the hope that it might come to pass will remove any incentive for actually doing it.

Most people get off so much on the hope and the promises that they don't realize how they're encouraging integrity-challenged behavior with their actions. It takes a real cynical bastard not to get caught up in this, and then we get told, "Oh, you Microsoft Bad Religious Types."

subliterate

[Anonymous Coward]

> Bruce Schneier and Adam Shostack have written a
> piece, while Crag Mundie of MSFT has also chimed
> in, along with some commentary from ZD folks.
> SecurityFocus has other words, as does
> InfoWarrior.

Do you guys ever read the shit you post?

It will be bad if they succeed

[truthsearch]

Troll me if you will, but...

I sincerely hope they fail. Unfortunately, if they succeed they'll only strengthen their monopoly. They need a better image in the area of security if the .net strategy is to really take off the way they plan. I do not want MS to succeed any longer. I despise their business practices and moral choices: destroy competition to the detrement of an industry, lie in federal court, put politics and PR above software quality. They don't deserve any more chances to change their ways, and so I hope they fail miserably while I stay as far away from their products as possible.

If they keep making a mess of their software's security, it'll help convince my company to move away from their products.

Morals and Legends

[fm6]

The moral: It's a lot easier to design security into a system in the first place than to try to add it on later.

I don't think anybody would disagree with that statement. Indeed, MS has always insisted that they follow it. It's just that security concerns have played second fiddle to Cool New Feature, and Hide Everything Behind a Simple GUI concerns. What nobody at MS seems to understand that these other priorities are not merely less important than security -- they're incompatible with it.

About the Denny's story. Has to be an urban legend. I think it unlikely that you could save any money on outside doors by leaving out the locks -- it's a standard feature on a mass-produced item. And even if the story is true, the locksmith bit has to be bogus. I once worked in another 24-7 operation -- a 7-11. Front door lock was there, but not functional. (Propably rusted solid from disuse.) And 24-7 or not, we did sometimes have to lock up. Solution is available at any hardware store and does not require a locksmith to install.

Re:Morals and Legends

[Kiwi]

And 24-7 or not, we did sometimes have to lock up.

Yep. I once worked at a similar operation. Once, we had a long-term power outage, so we had to lock up, even though we were 24x7x365.

As it turned out, the store across the street, also 24x7x365, did not have a functioning lock on their door (they may not have had a lock at all), so the poor clerk had to stay inside the store and call the police to protect people entering the store to loot things.

- Sam

Re:Morals and Legends

[Mr.Mustard]

...so the poor clerk had to stay inside the store and call the police to protect people entering the store to loot things.

Cool. I didn't know looters could get police protection. I'll have to remember that next time.

Only a Weenie could have a kneejerk so strong

[John Harrison]

Ryan,

I find it funny that you, a reporter for Business 2.0 as you proudly proclaim on your website, would call "bullshit" without doing your research. For shame!

Also, the parent post included a disclaimer stating that even if the story wasn't true (and it was), the moral of it was true.

how can you all be such idiots?

I guess because we weren't privledged enough to go to Cal.

ps Since I'm in a pissy mood I'll ask the following: Do you get to submit your articles without any capitalization?

END OF WEENIE BASHING RANT

Re:Only a Weenie could have a kneejerk so strong

[ryantate]

well, if you'd kept reading, you'd see i immediately posted a reply to myself, including an article which showed i was wrong. i just couldnt help checking myself =)

but you're right, i was being a weenie ;->

cheers
r

Re:Only a Weenie could have a kneejerk so strong

[frozenray]

but you're right, i was being a weenie ;->

... but kudos to you for admitting it. I wish this were more common here on slashdot (and on usenet, and in the newspapers etc.)

Have a nice weekend,
Raymond

Re:Only a Weenie could have a kneejerk so strong

[Anonymous Coward]

Well. Go ahead. Admit it. ;)

6 years ago?

[Anonymous Coward]

6 years ago, MS did an about face on their views of the Internet. Like it or not the big company acted pretty nimble , changed direction and stayed focused.
While IE sucked at first it is now a pretty good browser. Most of their products seem to follow this pattern. I would predict their security will suck as it has been, slowly getting better until it's quite good. 2-3 years.

OR this is a complete PR move to help .NET

It will be interesting to watch.

knowingly entrust their lives...

[gwillden]

This one kills me. From Craig Mundie:

"Many people today are still reluctant to trust computers with their personal information, such as financial and medical records, and few people would knowingly entrust their lives to them"

Every time you fly on a plane your life is in the 'hands' of computers. Every time someone gets an x-ray or a CT scan or any one of many now normal medical procedures you are entrusting your life and health to computers. Most (if not all) medical and financial records are entrusted to computers.

We do it everyday and the reason we do it is because these devices are designed and built by companies that have earned our trust by building quality products to very strict specifications for safety. These companies have good track records of safety and if they have problems then they are reported.

What Mr. Mundie should have said is:

"Many people today are still reluctant to trust Microsoft with their personal information, such as financial and medical records, and few people would knowingly entrust their lives to Microsoft."
--

Pay Tied to Security?

[caffeined]

The one thing that I found interesting in Schneier's article was that Gates's memo says that pay will be tied to a product's security. If this is actually implemented as a policy internally (and is not just for public consumption) then this could actually changes things. People will go to great lengths to get their bonuses - I've seen this in real life.

I'm still skeptical about Gates's commitment to this, but it wouldn't be the first time the company was turned on a dime by the BG (Bill Gates or Big Guy - whichever you prefer) - remember that they did this for the Internet as well, which they originally missed the boat on.

You are a Weenie, and a correct Weenie at that!

[John Harrison]

Please accept my humble apologies.

Re:You are a Weenie, and a correct Weenie at that!

[ryantate]

considering i called the proverbial everyone an 'idiot' -- when i was wrong no less -- i think i should accept =)
r

100 to 1 compression

[Anonymous Coward]

msft secure is more of a long shot.

M$ vs. Softimage. Why does no one talk about it?

[jeff13]

Why does no one in America talk about the Softimage case? You know, the French couple who mortgaged their business, lives, and home just to defend their rights against Micro$oft... and WON! 'Course, M$ still has yet to pay up the piddly amount of cash. This column has links to and explains the reasons why fighting M$ is a death knell for any company (or perhaps Supreme Court Judge *snark*)
Oh yea, Slashdot rejected this story. Hmmm...

Cyberia by Jack Kapica

www.trustworthycomputing.com

[Dan Crash]

I was going to do exactly what this fellow did, but he beat me to it. Clever. Let's hope this URL gets around: http://www.trustworthycomputing.com

Re:www.trustworthycomputing.com

[VB]

Usenet is loaded with the past errs also...

These people don't understand.

[Oriumpor]

who uses the word trustworthyness when dealing with computers? It's not like they can lie to you, or decieve you... they do what you tell them... or laugh at you and seg fault

Re:These people don't understand.

[Oriumpor]

One entry found for trustworthy.

Main Entry: trustworthy
Pronunciation: 'tr&st-"w&r-[th]E
Function: adjective
Date: 1829
: worthy of confidence : DEPENDABLE
- trustworthily /-[th]&-lE/ adverb
- trustworthiness noun

And I thought ebonics was bad.... they can't even spell trustworthiness right.

Opposing philosophies

[Proaxiom]

The benifits far outway the drawbacks...

This is a good post. You are taking the opposing side from one of the replies I posted above.

I pointed out that the weak security characteristic of Microsoft is a direct result of them making everything so damned easy to do. They strip away the limitations of the software architecture, enabling more powerful apps but at the same time opening a great number of security vulnerabilities. You are suggesting it is worth it. Obviously Schneier and Shostak disagree with you.

As someone who works in the security industry, I can't agree. The more we tear down those boundaries the more vulnerable we leave ourselves. If the Internet is ever to live up to its full potential, especially in economic terms, we have to protect ourselves. Unless we start admitting such tight software restrictions are necessary, things like Internet fraud and web worms will keep increasing in frequency and severity.

I think you are right that it is impossible to "go back". You can't turn back the clock, and while I may think Microsoft did it wrong, it is unreasonable to think they will do it over again.

Re:Opposing philosophies

[Anonymous Coward]

If you think programmers can come up with an OS that the user won't be able to render insecure, you're dreaming. It is better that users use an OS with crappy security so that the industry can come up with ways to cope. I do not think for one second that if all users were using Linux that things would be any more "secure", or that there would've been greater potential for what 99% of users want from computers. The truth of the matter is that computers would've been more limited and harder to use, and would not have been adopted nearly so quickly.

G.W.Bush is B. Gates!

[SoSueMe]

See #3 and #5, if that doesn't convince you, you probably think the Lincoln/Kennedy thing is coincidence too.

Top 5 G.W. Bushisms

1. "If I'm the president, we're going to have emergency-room care, we're going to have gag orders."

2. "It's one thing about insurance, that's a Washington term."

3. "Well, I think if you say you're going to do something and don't do it, that's trustworthiness."

4. "We cannot let terrorists and rogue nations hold this nation hostile or hold our allies hostile."

5. "I'm gonna talk about the ideal world, Chris. I've read -- I understand reality. If you're asking me as the president, would I understand reality, I do."

Ahh, nitpicking...

[WinPimp2K]

3 versions, 4 versions.. next year it'll probably be 12 versions according to some people :)

Win 3.1 was the version that marked it as "arrived" - We don't hear about the earlier versions very much - they were there but nobody would buy them. There was Interface Manager (original Windows), then there was Windows 286.
In IE, can you give me the release dates for versions 1.0 and 2.0? I don't remember them at all. It was when Win '95 came out that version numbering became a marketing function. And since by then it was common knowledge that MSFT never "gets it right" until version 3, guess where the marketroids started the version numbers? Of course, then they pretty much gave up on version numbers...(Pop quiz: how many versions of Win '95 were there? Win '98? Win ME? With NT/2K, you just needed service packs to be up to date. (Oh yeah, why Win 2K and not NT 5? marketing not engineering - and pretty darn stupid marketing - it caused a bunch of the same versionhecking problems that the change from Win 4 to Win 95 did)

If you consider the ability to play games as the criteria for workability, then Linux still ain't there for me. I have to exit it completely to play the games I like.

I've played with several browsers myself, and I like Opera 6 best. Competition is GOOD. But both MSFT and AOL want to make it illegal - it is easier to make your marketing forecasts when there is no mechanism for change that can upset your applecart. AOL really bought Netscape as a weapon to use in a legal battle - the same way Caldera used DR DOS. They will not bundle it into their AOL environment for technical merit.

Translation: we've run out of ideas.

[landley]

"So now, when we face a choice between adding features and resolving security issues, we need to choose security." -Gates memo.

I.E. we can't think of anything new to cram into windows that anybody would actually WANT (and it's getting harder to copy stuff since all our remaining competition is a Unix variant and can address things like latency that we'd have to throw windows out and start over to address) so we're going to stop doing new things and put a happy face on it. Heck, you're all going to a rental model anyway, we don't HAVE to do new stuff anymore. You'll keep paying us anyway or you desktop will stop working.

Rob

Re:Security Focus gets it right. I doubt M$ will

[Anonymous Coward]

IMO the code structure upon which most MS apps are built (MFC classes)...

Sorry... a lot of software written third parties for Windows may use MFC, but Microsoft definitely does not use it in anything larger than a toy application. There are a number of "consumer-grade" technologies (MFC, VSS, etc.) that are marketed by Microsoft as developer tools, but which are avoided internally.

Microsoft Foundation Class (MFC) [version 3.2, IIRC] test app as created by the wizard came in at just over 1 Meg...

Sigh. Let me guess - you linked statically, right? Aside from being a silly thing to do, it's (traditionally) the way that *nix folks blame VC for "software bloat"... they jump up and down saying "See? See? BLOAT!" until you point out to them that you get the same &quotbloat" under *nix if you link to the static version of glibc. But I guess that's different.

Vmyths.com

[dummy_variable]

apparently this editorial about Trustworthy Computing was missed.

it's a charade.

[mkbz]

it's a dog & pony show to make jim & betty average feel better. and the settlement/security API loophole sounds right, too.

trust me, if anything tumbles out of bill g.'s mouth in public, it's very likely to have been premeditated, and very unlikely to be benevolent.

Going overboard

[Salamander]

The first few suggestions - e.g. separate code and data, use secure default configurations - sound great, but I think Schneier and Shostack go a little bit too far when they get to this point:

We recommend that all protocols and interfaces used in Microsoft software be immediately published, and a one-year moratorium be placed on all non-security modifications to those protocols.

One year? One year?!? Does Linux do that? Does anyone? I'm sorry, but a year is a damn long time, and this is a time-based business. Making their protocols public at all is a big pill for Microsoft to swallow; expecting them to develop a protocol -which might define much of a new product's functionality - and then sit on their hands for a full year while security experts diddle and competitors get a head start implementing Microsoft's ideas is just ridiculous.

The next part is almost as bad:

We feel that Microsoft needs to go further, and reward not only Microsoft employees but independent researchers...needs both automated security reviews and evaluations by security experts.

Translation: "We feel left out, and the dot-bomb has left us destitute. Send some money our way to make us feel better, and maybe we'll change our tune." Shameless. Constructive engagement with the security community is well and good, but Schneier and Shostak's "suggestion" as given is little short of demanding protection money. Thought experiment: substitute "government" for "Microsoft" in the above and consider whether such an arrangement would qualify as corruption.

Really, if those last few paragraphs had been left out it would have been an excellent article, but they got kind of carried away there at the end. What a shame that an opportunity for a truly constructive dialog was pissed away out of greed like that.

Read it again.

[schon]

We recommend that all protocols and interfaces used in Microsoft software be immediately published, and a one-year moratorium be placed on all non-security modifications to those protocols.

One year? One year?!? Does Linux do that? Does anyone?

Besides the point that "Linux" doesn't create standards, one year isn't a huge amount of time to wait before making changes.

expecting them to develop a protocol ... and then sit on their hands for a full year while security experts diddle and competitors get a head start implementing Microsoft's ideas is just ridiculous.

Re-read what you're responding to. Where does it say that MS has to wait for a year before they implement a protocol?

Once a protocol (which might also include file formats) is published, waiting a year before extending-and-embracing it sounds like a good idea to me.

Or have I just been trolled?

Not security: trust - in "established" companies

[pointym5]

Reading Mundie's article made it crystal clear what all of this Microsoft security stuff is about. It has nothing to do with increasing security of their products, per se. It's all about engineering a market perception that Microsoft is a single entity that has the ability to make announcements like this, to offer commitments (empty or not), and be a focus of trust. Read the article -- note the implications that in order to have trust in software, you need some corporate entity in which to place your trust.

Guess what competition will be easy for their marketing machine to paint as being lacking in the trustable big established multi-billion-dollar company department? Sure there's IBM, but experience suggests that Microsoft are fully up to the challenge of out-marketing IBM.

So What am I suppose to do now?

[Eric Damron]

I read my security logs like other people read the newspaper. Without all of the hits coming in from hacked Microsoft platforms, what am I suppose to do with the first half of my day?

Re:What about the potential implications for Linux

[Dyolf Knip]

Just make a simple little phone call? Ok. And if you want to get a printer for that computer, you have to make another little phone call to activate _it_. Want to add more memory? Make a call. Install any application whatsoever? Why should activting your product be limited to the OS? How about activating your new TV through the cable company? Or a new phone through the phone company? Or a new CD with whoever makes the player?

Do you see that if everyone had the same mentality as MS, using any kind of electronics would be a hassle of a ridiculous order and nobody would do it. There are only a few apps that require this kind of nonsense and I truly hate them for it.

Re:Security Focus gets it right. I doubt M$ will

[CodeShark]

Linked statically...

I'd have to double check that. But we ran a code stripper (which removes all code which is uncallable) to pull out the bloat ... and the app dropped to 763K. Still leaked like a sieve, but this was admittedly a wizard app. My point is that the problems with memory leaks, etc. were in the MFC, not in the linked in code.

Some history

[Zeinfeld]

Back at the start of the 1990s the general consensus in the computing industry was that UNIX could never succeed outside academia because it was chronically insecure.

It would be good if the people who spend so much time attacking Microsoft's security issues considered that UNIX generally and Linux in particular are not exactly fault free.

How can anyone who runs sendmail throw stones at Microsoft? sendmail is a textbook case in how to write software that can never be secure. The program breaks every single one of the rules Bruce and Adam set out. There are plenty of better alternatives, yet sendmail remains the default through sheer inertia (you might want to route some bang path UUCP or OSI mail sometime you know).

UNIX only became secure as a result of trial and error. There never was a security architecture worth a damn. For many years the main contribution to the security world from the UNIX security architecture folk was discouraging people from using shaddow password files.

The security model of all modern operating systems is based on the security model of MULTICS and comes from the age of the Multiple Access Computer. The security problem is defined in terms of a single machine that has multiple concurrent users. The addition of the network is an afterthought.

What this means is that very few of the security features in a modern O/S are actually of the slightest relevance to a machine running a Web server. In effect we end up with two parallel permissions structures, the one managed by the O/S and the one managed by the Web server.

Win2K and XP have Kerberos and PKI integrated into their core. The standard condfiguration supports IPSEC, S/MIME, SSL, Kerberos, Smartcard login, Encrypted File system. Measuring security in terms of cryptographic features Microsoft wins hands down (Microsoft are good on features).

Linux on the other hand is not in anywhere near such a good position. Security packages are available but it is left to the end user to integrate them. Linux also lacks anything that resembles the 'Security Administration Guide' mentioned in the rainbow series books.

Security is not a binary condition. The problem I see for Linux is complacency. There are too many weenies out there whose knowledge of security is actually minimal who tell people Linux is secure because that is what they have been told. None of the O/S on the market are particularly secure. Windows has a great security architecture that the crappy applications completely bypass. UNIX has a crappy architecture and some very well tested applications whose security bugs have been largely eliminated by trial and error.

People in the OSS community can go arround telling each other that Linux will always be more secure than Windows if they like, but that won't make it true. Gates has essentially served notice that Microsoft is going to be upping the ante here. That does not mean that they will win, but a lot of work is going to have to be done if Linux is going to keep up. Fotunately it is not necessary to integrate PKIX into Linux as Microsoft did with Windows, the OSS community could skip a PKI generation and move straight to using new technology such as XKMS and SAML.

Re:Some history

[cyber-vandal]

It would be good if the people who spend so much time attacking Microsoft's security issues considered that UNIX generally and Linux in particular are not exactly fault free.

That is undoubtedly true, given that totally reliable software costs orders of magnitude more than Linux or Windows, but it hardly excuses a billion-dollar corporation that spends billions every year on R&D.

Sendmail is a bad example, since, although a lot of people still use it despite it's flaws, there are other MTAs available and is not in itself a flaw in any version of Unix.

The standard condfiguration supports IPSEC, S/MIME, SSL, Kerberos, Smartcard login, Encrypted File system.

Yes, but you still have to learn to use them and actually use them, and installing stuff on Linux is as easy as firing up a good package manager and installing (with dependencies all satisfied, before you say anything), it doesn't really matter whether they are installed by default or whether you need to spend a couple of minutes putting them on, it's not really that important.

The problem I see for Linux is complacency.

That's true too, but it's just as true for Microsoft, and the people writing the various bits of Linux seem to care about fixing security issues as they appear, rather than going through an extended spin cycle, or worse, not bothering with it because it only affects a few people.

The OSS community is made up of a lot of people and those who actually know something are not taking security lightly. Microsoft however seems to treat security issues as a failure in PR rather than a failure in their methodology and are finally recognising this fact. Whether they choose to do something constructive about it, time will tell.

Re:Some history

[Zeinfeld]

Sendmail is a bad example, since, although a lot of people still use it despite it's flaws, there are other MTAs available and is not in itself a flaw in any version of Unix.

So follow the advice Bruce is giving to MSFT, ship the product safe by default. Take out sendmail which has been a festering sore and slot in something that deserves the default slot.

even if they do secure their products...

[Magius_AR]

I doubt I'd want to support their company.
I mean, even if this does work out, I'm not ready to forgive them for the decade of trash software they've been releasing.
But that's just me. Forgiveness should come with a penance, and somehow I doubt Microsoft is ever gonna pay.

Magius_AR

Re:NEW AND IMPROVED MOD DOWN???

[greymond]

i cant belive i got modded down for trying to be funny?!

Re:Zeinfeld co-writes a bad comment!

[schon]

SOAP traffic is actually quite easy to detect in HTTP, just examine the Content-Type field.

Uh-huh. "SOAP is easy to detect, just throw away your simple, efficient packet filter, and install something that examines every stream, which of course requires a ton more horsepower."

Sorry, this is nothing more than an attempt to sidestep the issue.

Re:What about the potential implications for Linux

[Reziac]

Re the black screen at bootup -- this happens (on rare occasions) with ALL versions of Windows (back at least thru Win3.1 that I know of) and sometimes (equally rarely) with DOS apps that put the screen in graphics mode, like DOOM or PrintMaster Gold.

The point where Windows will sometimes just die (and I've had it happen in linux too!!) is *exactly* where it switches to graphics mode. It happens on all manner of hardware, not just on some specific video card (and is not specific to VESA 1.2 or 2.0, nor whether 2.0 is real or faked) or motherboard or whatever.

I've become suspicious that it's something fundamental to how the mode switch is handled at the lowest level, therefore not unique to any particular app or OS. I don't know enough about video coding to speak intelligently about it , but I do know on machines where it's a regular problem, if Win32 startup is slowed down, it's less likely to happen. Makes me think some video memory write is sometimes unexpectedly delayed during the mode switch, doesn't get its ass out of the way in time, and gets clobbered, thus the black screen (usually for good). Ooops!

Re:Security Focus gets it right. I doubt M$ will

[bluebomber]

You are reading them all wrong. Microsoft has shifted focus several times in its history. From the DOS-type environment to Windows. To the LAN. To the Internet. And now Security. Yup, Security with a capital S because it will, of course, be MS-style security. They have played the games differently with everything else (LAN, Internet, all kinds of standards), and they will set the rules here as well.

Realize that it will take them three or four tries to get this Security thing down though. It has with everything else:

- How many incarnations has MSN had?
- Do you even remember Windows 1 or 2 -- or even 3.0? (I'm sure someone will reply in the affirmative, but most of you haven't)
- those stupid e-book tablets (haven't won here yet) or palm computing (same here)
- What was the first version of IE that didn't completely suck? (You want to say that IE is different, but it isn't. They basically play all their games this way.)

And with $20b in the bank, they can afford to have an army of coders comb through existing libraries looking for defects. They can afford to have scores of UI designers and HCI evaluators to see exactly how much security people are willing to deal with. Better yet, they can afford to screw up two, three, maybe even four or five times before they finally get it right. And the world will just have to live with it.

They will screw up someday. It might be Security that does it. It might be something else that brings them down. But don't just dismiss the new Security focus as FUD. Pay attention.

trust me!

[Anonymous Coward]

Announcing "MicroSafe"

Microsoft is extremely concerned about security. That is why we are launching the new "MicroSafe" program. Simply register with us online and submit your credit card and bank account numbers. Follow-up by sending us all of your money, jewelry and sensitive dosuments. We will safeguard these for you free of charge. You'll never have to worry about security again!

Privacy Policy: Microsoft will only share your MicroSafe assets with licensed partners and affiliates.

Ubbbb... Bruce Schneier sez....

[Anonymous Coward]

ActiveX should eliminate all controls that are marked "safe for scripting."

Doesn't he mean:

ActiveX should eliminate all controls that are not marked "safe for scripting."

????? I'm confused here.

Microsoft and the Internet

[Sourtimes]

If you remember the last big Memo Bill Gates Sent out was about changing Microsoft over to be an Internet Company and how long did it take for them to become an Internet Company? Not very long, so I think this Memo will be a big step for them. I think they will seriously Focus now on security since the Core of their Features are in.
If they want .NET to survive they have to make sure they can be secure along with having an easy to use OS.

In order to increase security worldwide....

[MoneyT]

....Microsoft will now begin implementing the MS Global Lock. The Global Lock will provide world security by sending all data, personal, corpoate or otherwise, to Microsoft HQ. This is designed to ensure that no company can implement any products which might subvert the MS Global Lock. Politicians will no longer be able to cover up data,and private citezens will no longer be able to take part in private discussions (this ofcourse designed to make life more secure for everyone). This data will be availible to no one except Microsoft. Trust us.

The scary thing is, I don't know if I'm being sarcastic or not here as this sounds like something M$ could implement. Makes me glad I own a mac.

Does BIll Gates Own Slashdot?

[pigeonhed]

1 memo = 2 slashdot articles.

I mean come on. This is why MS can do whatever they want, even opponents focus entirely to much on MS. Great Billy writes an email and the world wants to analyse it. Please less MS news unless really needed. To hear all the MS shit I could simply go to MSN.

Sorry I am just getting real tired of one or two MS stories a day. Most of which don't seem to be very thought provoking. Yeah sure MS cares about trust and safety. Right after $$$$$$$$$$$.

I see a story on a Linux distro what three times a week? Yet MS get day after day of their name in headlines. Has Redhat, Mandrake, Suse released no news?! More balance would be nice is all I am saying.

I can't believe some of you homos!

[Anonymous Coward]

You bitch and moan like women about Microsoft not being worried about security. Then when they plan on doing something about it you bitch and moan about that.

You stupid motherfuckers.

nas recommendation could squash linux?

[Benjiman McFree]

From the bbc...

The report by the computer and telecommunications board of the NAS said that currently software makers do not have enough incentive to ensure their products are secure.

It recommended that the US Government consider amending laws so that software makers can be held liable if their products put the public and businesses at risk.

--congress could also be afraid of viruses containing political messages, hmm..

Considering the fact that most all software is hackable, until secured, only those with deep pockets would be left standing.

I wonder if those doing the reports aren't predispositioned for desired conclusions by lawmakers. On it's surface, this looks like it would be good for the industry and it seems like a sell with the linux crowd as many linux people complain about msft's weak security, however this could be a poison pill for free software distributors. I feel peer review is the only for sure way to get code secure, so any legislation should EXEMPT software makers who release their source code AND allows for modifications and sharing of those modifications; otherwise, if the east coast code fails to make this exemption, take it for what it is; an attempt to squash everyone but those with big pockets, ie msft!

Craig's analogy is pretty weak

[RodeoBoy]

It seems that he confuses the real issue here, Security, with another, Safety. These are different trust acts. If I believe in the safety of my car I may drive it. If I trust the security of it I would leave my laptop in it, but of course I would never do that and I dought if the auto industry has the motivation to make a more secure vehicle ever. I also really dought that MS has that motivation either, beyond a simple PR game. As long as the OS doesn't get used for things like airplanes or nuclear plants safety is not an issue for MS OS's. If OS crash caused death...well then we would know were most Windows users would be.

I worry that the industry on all levels, (vendor, developers, admins) will never gain that leave of trust because security is not the priority for us and we often drop the ball, just MS drops it the most and in very big ways. But still this issue is important for everyone in the industry not just the vendors, though considering their position they play their role is the most important. Lets face it all OS and Apps have security issues, some a lot more than other, and even the most secure system is made moot if the admin or developer is not awaire of security issues relating to their jobs.

On another note there were some very good suggestion on how to improve security in the other articles. The one that caught my eye is using the most secure default settings. I work in a MS world and a lot of my development work is web based Enterprise apps, so I have a IIS box on my home machine to play with and learn on. One of my favorite games is to expose my box to the internet and see how secure I can make it. In the case of default setting in IIS and NT this is a lot of work. The funny thing is that I started this game prior to the release of code red. My box survived it, much to my suprise. So MS made all these fancy patches to address security problems that partically could have been avoided by better default settings. Of course that would not address the fact that many of these feature had/have huge security holes, but the effect of code red and friends would have been greatly reduced with better default settings. From looking at the log that I keep on HTTP requests I recieve, Perl and REG EX are a wonderful things, the majority of infected requests at my door come from @home installs. Of course the percentage is due more to the nature of how these worms scan the net (start local then go more global).

Critique of your apologetic

[kindbud]

Back at the start of the 1990s the general consensus in the computing industry was that UNIX could never succeed outside academia because it was chronically insecure.

Citations, please? By most accounts, Unix had already penetrated far outside academia by the time the 1990's rolled around.

...UNIX generally and Linux in particular are not exactly fault free. ...How can anyone who runs sendmail throw stones at Microsoft?

So what? Does one sin excuse the other? Is there any lack of focus on Unix and Linux security issues? If I run IIS do I give up the right to criticize Apache?

...sendmail is a textbook case in how to write software that can never be secure.

Never is a long time. What box-breaching flaws are in the latest release? Oh, you were referring to those older releases still installed all over the place. Like the old NT 4 boxen, and the unpatched IIS, and Win95's nukable TCP stack, and ... yeah.

My retort is the same as Microsoft's: UPGRADE

The program breaks every single one of the rules Bruce and Adam set out.

Bruce and Adam are not the only ones writing rules. Appealing to authority plays well to the unwashed masses who don't know any better. That's why it's a favorite of Microsoft spin doctors (and government spin doctors, and media spin doctors, and...)

UNIX only became secure as a result of trial and error.

This is partly why it has the level of trust that it does. We have experience with it, and know what to expect.

For many years the main contribution to the security world from the UNIX security architecture folk was discouraging people from using shaddow [sic]password files.

I think you meant "encouraging people to use shadow password files".

Win2K and XP have Kerberos and PKI integrated into their core.

What does that mean?

The standard condfiguration supports IPSEC, S/MIME, SSL, Kerberos, Smartcard login, Encrypted File system. Measuring security in terms of cryptographic features Microsoft wins hands down (Microsoft are good on features).

Microsoft is also good at winning irrelevant feature comparison contests. What is there to assure anyone that these features are any more secure than the other featureful crap that got Microsoft into trouble in the first place? How do we know these services do not harbor even bigger holes than the ones we know about already elsewhere in the OS? At least with IIS, we can have a clue that it ought not be left turned on except where it is required. Who is going to turn off security "features" as a matter of course, even if it's the right thing to do, as it is with IIS features? Today's features are tomorrow's embarrasing exploit. It matters not one bit whether the features are characterized as the "security" type of features. If they are written poorly, they can be exploited. If they are not needed, but are enabled anyway, they pose a needless risk. Needless risk is where Microsoft excels.

The problem I see for Linux is complacency. There are too many weenies out there whose knowledge of security is actually minimal who tell people Linux is secure because that is what they have been told.

That's pretty fucking funny. Complacency on the part of MCSE-types is why Microsoft software is such a problem. Nimda was not propagated by web servers running on Linux. It was propagated by IIS webservers running on Microsoft systems operated by complacent Microsoft admins.

But Linux users and distro preparers are learning. Newer distros come with everything turned off. Even after it was shown that unwitting NT and W2K users' PCs were propagating worms because the users had no idea a web server was even running, much less that it needed patching, XP still comes with everything turned on.

Wake me up when XP2 ships, and let me know if stuff is still on out of the box.

Windows has a great security architecture that the crappy applications completely bypass.

If it was a great architecture, the apps would not be able to bypass it.

Re:Critique of your apologetic

[Zeinfeld]

For many years the main contribution to the security world from the UNIX security architecture folk was discouraging people from using shaddow [sic]password files.

>I think you meant "encouraging people to use shadow password files".

No, until the first copies of crack started to circulate the issue would regularly start flamewars on the security lists. The original description of the UNIX password feature made a big deal of the fact that the password file was world readable. The argument Moriss used was that read protecting the password file was 'security through obscurity'.

Even after crack appeared it took quite a while for people to realise that the exhaustive search attack was becomming practical.

[sendmail discussion] Never is a long time. What box-breaching flaws are in the latest release? Oh, you were referring to those older releases still installed all over the place.

sendmail is insecure for the same reason that Outlook is insecure, the program provides an excessive and unnecessary degree of complexity. The vulnerability in sendmail is the complex macro rewrite rule engine. The vulnerability in Outlook is that it will execute active code in email.

The problem with both pieces of code is akin to radioactivity. No matter how long you wait there will always be some level of insecurity. The insecurity is there because the program does something that is a fundamentally bad idea.

Swapping out sendmail for one of the excellent alternatives is a much better solution than upgrading. Equally running the 'turn off active content' patch on outlook is a good plan.

DING DING DING

[Anonymous Coward]

DRM is exactly what this is about. Maybe PR, too.

see:

http://cryptome.org/mpaa-v-net-mg.htm

http://www.wired.com/news/politics/0,1283,46655, 00 .html

"At the heart of the fight are two questions: whether computer users can continue to be allowed to have the abilities that computers have had since their invention, and whether the content companies can survive in a world in which users have that power. What's been missing from the debate so far has been the users themselves. It seems safe to say that most computer and Internet users like to have choices -- choices both of the content they consume and of the kinds of tools they should get to use. Still, maybe citizens would say they're willing to give up "general-purpose" computers and willing to use, instead, systems designed to prevent them from engaging in willynilly copying, if that is the price you have to pay for compelling music and movies and television over the Internet.. "

...

Not all that is written is knowledge

[pHDNgell]

I've been in enough situations where an application implemented by someone who didn't think through the design clearly enough had to be rewritten to meet new fundamental requirements, or, in some cases, to even work.

I don't believe that any actual programmers (i.e. the people who occasionally state they need to rewrite something) would make such a statement. As delicate as software is these days, it shouldn't be too much of a stretch to assume that some things cannot be repaired. Often, a prototype is thrown together as a proof-of-concept and needs to have its functionality designed to fit into a proper application, but instead, stuff just keeps getting glued onto the original prototype.

In a recent case, I had a very large application that was written in perl. It performed very badly and was all but impossible to extend. The business specification for the next version of the application included a lot of functionality we would not be able to add to the existing code base. We determined that we could, more quickly, create an entirely new code base in a new language that included all of the new functionality and all of the old functionality that was actually still used faster than we could've retrofitted the new requirements into the old code. We did.

It's ridiculous to think that the sum of work of a ton of junior programmers makes up an implementation that's worth retaining simply because it's there.

Re:Not all that is written is knowledge

[ergo98]

Let me reiterate that at no point did I ever say that software never needs to be rewritten, but rather that there are hoardes of software developers who always have "a better way" mantra, and whose approach to any coding issues is "rewrite it" (I've worked with quite a few of them. It's a classic "not made here" approach, or rather a "not made by me" approach, and they always have loads of superficial reasons to justify their rewrite conclusions). Of course 6 months later it's the exact same situation when the next continual rewriter comes in, shakes their head with a dismissive attitude, and claims that it all needs to be rewritten to encapsulate function X...

This same mentality goes into code reuse: Put together a group of developers and you'll find there are a couple that just never seem to be satisfied with common components/third party tools: There is always some spurious scapegoat reason why it just won't work and clearly needs to be rewritten or custom made, because blah blah blah. I've done it myself: The classic "why use their component when I can just spit it off myself". In software development it is easier [at the beginning] to take the first step to rebuilding it (because that seems like "progress") than it is to understand and fix what is already there.

Trusting Microsoft

[myov]

This reminds me of a presentation I was at last year, by a director of IT at a large bank division (the kind of place where you need a 5 year police check, etc). The key quote I remember was "Trust can't be bought or sold - Trust is earned". Considering MS's history, what have they done to earn my trust?

My Reply to Bruce Schneier

[Euphonious Coward]

Here's what I sent to Bruce Schneier, for his letters column.

If Microsoft's claimed change of policy about the security of their software is, in fact, a sham, we should see detectable consequences. As you noted in your news.com article, any actual change must result in a major slowdown in releases of new products and product features.

Before any such change (or lack of one) is evident, though, the first hint must be a change in their P.R. approach to discovered holes. Until now their spin has been that security holes just don't matter very much. They posted patches on their (indifferently maintained) site, but wouldn't do anything so expensive as recalling the faulty product from the distribution channel, or notifying affected customers, or offering refunds (never mind paying customers' expenses).

Now that security holes have been officially recognized, they can't be treated as merely cosmetic -- the equivalent of a Cracker Jack box with no toy -- but a real response is expensive. If the new security focus is a sham, expect to see more official denial. Most security holes will get only P.R. treatment, portrayed as "ordinary" bugs, or blamed on incompetent users, insufficient firewall protection, or "terrorist" hackers. There might be a quota, where no more than four holes per year may be treated as (expensively) real, while the rest are officially buried.

Their problem is that secure software isn't just software that has been audited for buffer overflows. Software is so complex that almost any fault can have mysterious consequences, any of which may (also) be a security hole. As the OpenBSD Project has explained for years, the only secure software is correct, reliable software. You don't get that by adding a security officer or auditor to each product team. It takes a complete overhaul of the software production process, and a complete turnaround in the attitudes of the entire engineering and engineering management staff. Without such a wholesale overhaul, the flow of bugs and (consequent) security holes will continue unabated, despite any management prohibition.

I sat next to a Microsoft coder (and sometime manager) on a flight from Seattle recently. He explained that as long as a coder's bug count was below some level, the bugs could be ignored, and the coder could continue implementing new features. If the bug count crossed the threshold, he would have to stop until it was brought back down -- not to zero, just to the limit. This systematic tolerance for faults of all kinds is why their software is so bad today, and it won't change quickly. Nothing in the press release suggested that they saw security as inextricably connected with reliability.

In the meantime, P.R. games are far cheaper, and arguably more effective. Is the problem really that Microsoft products are shabby and insecure, or that they are now perceived so? Everybody who would like to continue business-as-usual will say it's the latter. They will play up the effectiveness of MS's "responsiveness" to security holes, and pretend that "effective response" is a substitute for shipping reliable code to begin with. Reliable code, after all, doesn't generate fawning press, or indeed any press at all.

I saw a similar process in action, starkly, sixteen years ago. IBM and HP had both introduced their first PCs with internal 10-megabyte disk drives. The HPs cost a little more. IBM offered theirs with a "service contract" at about twice the price difference. Over the course of the next year *all* the IBM drives failed -- which, it turned out later, IBM had expected -- while HP's mostly survived. IBM got reams of favorable press about how good their service was, for replacing the drives on the spot (albeit only for customers who had bought the service contract!). IBM came away with a reputation for good customer service. HP got creamed.

In summary, if the new security policy is a sham, expect to see Microsoft engage in periodic, massively orchestrated "responses" to selected embarrassments, and to become much more reticent about the rest. Expect no change in their warranty disclaimers. Expect analyst reports proclaiming that MS products are now more secure than the competition. The effect will be a net decrease in the ability of their customers to maintain secure servers, yet if the P.R. campaign succeeds, most customers will perceive the "security problem" as solved, and continuing reports as stubbornly persistent old news.

What is a Buffer Overflow?

[Cheshire Cat]

Pardon my ignorance, but I've seen this term used quite a bit in regards to bugs. What exactly is a buffer overflow, and how does it work? How does one prevent a buffer overflow from happening?

SOAP and CGI

[Zeinfeld]

The difference is subtle, with CGI programs attacks would affect the backend, deleting accounts, intercepting charge cards, outputting misinformation, etc.

The difference is far from subtle, the major difference between CGI and Web Services is that in the early days of CGI people would have cshell scripts processing the queries.

So in a short time people discovered that you could cause all sorts of programs to be run simply by sending a query of the form http://xx...xx?a=x;rm+-rf+* which would result in some script executing

greet x;rm -rf *

Give or take the correct URL escape hackery.

Rob and Ari discovered the joys of shared libraries pretty soon after their CGI hack. OK CGI is easier to get started in than the Apache or NSAPI plug in architecture, but it is a lot more secure. What do people use though?

The fact that there are still books arround with three inch spines and the letters CGI on the front cover selling by the hundreds in Frys tells me that there are plenty of folk using what was a one night hack by two undergrad students who have since mended their ways. Even so those same folk will go off and throw stones at Mr Softy.

Incidentaly I was in the next room when Ari wrote the CGI spec and I can assure you that the idea that there might be a security issue did not occur to him when he was writing it.

The difference is that at least on the client side is that if I hack a website with SOAP web services the results can now affect the software running locally. Thus manipulating software on the client side to do things they were not intended to do.

No, this is not the difference. In IIS the Web service runs as just another back-end service provider.

SOAP does make it easier to export a DLL library to the Web. So if an attacker got control of a machine with Visual Studio .NET they could cause the individual all sorts of grief by exporting their system DLLs as SOAP services, but there are already trojans that allow execution of arbitrary code and the firewall should not allow incomming HTTP requests on the internal net in any case. So yes SOAP provides an additional and somewhat more artistic way to torment a machine that has been captured, but it does not introduce a new way to torment a machine.

Re:SOAP and CGI

[simm_s]

My point is SOAP can be used as RPC. Thus I could use SOAP to make a function call, pass in some arguments, and get a return value.
see: using soap as RPC

If I exploit the web server and manipulate the CGI programs to return bogus values you are introuble.
If I exploit the web server and manipulate the CGI/SOAP programs to return bogus values you are even more trouble.

(simm_s) The difference is that at least on the client side is that if I hack a website with SOAP web services the results can now affect the software running locally. Thus manipulating software on the client side to do things they were not intended to do.
(Zeinfeld) No, this is not the difference. In IIS the Web service runs as just another back-end service provider.
If you read what I wrote, I was talking about client side not server side. I wrote that twice for goodness stake!

The difference is subtle to the unknowing end user since both CGI and SOAP provide services to the end user. With CGI programs in the backend, I log on to the website and content is generated dynamically. With SOAP my program makes a function call, the CGI/SOAP backend generates a return value to be used by the program. CGI is for web browsers, SOAP is for software in general (that is the danger).

Re:SOAP and CGI

[Zeinfeld]

With SOAP my program makes a function call, the CGI/SOAP backend generates a return value to be used by the program.

What you mean is that a SOAP client hooked up to (say) an XKMS trust service is subject to a greater degree of risk than a Web browser surfing Slashdot. Well Duuhhh!!!!

The protcol is irrelevant at that stage. The vulnerability comes from the fact that a large number of Web services are intended to support some pretty high trust applications. For example people are entirely serious about using Web services to move very large sums of money arround. XKMS is designed to be used to validate public keys used (amongst other things) to authorize very high value transactions.

But the people who are managing that type of application are quite aware of the risks involved. The risks are intrinsic to the application and the use of Web Services is incidental.

Nobody raised a fuss when we layered OCSP over HTTP - and that protocol was reviewed by pretty much the whole IETF security area.

Re:SOAP and CGI

[jo42]

> Nobody raised a fuss when we layered OCSP over HTTP

Well, why don't you people throw away all the other protocols and layer everything over HTTP? IMO, layering shite over HTTP is a Bad Idea (tm).

- When all you have is a hammer, then the rest of the world looks like a nail.

regression testing

[David Jao]

First of all, apt-get on Debian stable never seems to have these kinds of problems, so why can't Microsoft get it right?

Second of all, if you actually read the article, you'll find that the systems were in fact test systems, so the IT professional was doing exactly what you recommend. And, based on the results of the test (namely, the systems were unable to incorporate essential security patches from Microsoft), I'm sure you and I would agree that Windows XP is unsuitable for production use.

Which was my point.

The eweek article I linked referenced several sources, of which I only quoted one. I could understand if it was one particular configuration of hardware, but the diversity of negative experiences seems to indicate that this problem is more general than just one configuration.

Re:NEW AND IMPROVED MOD DOWN???

[PetzoldC]

It was not original or funny at all.

There is only one reason -- liability

[unixpro]

There is one and only one reason for M$ "new" focus on security. I remember reading an article (I think the link was through SlashDot, although I'm not positive) that said the congresscritters were considering removing the liability protection software makers enjoy. This "new direction" is the M$ attempt to head off any such legislation.

Keep in mind

[PetzoldC]

Keep in mind the fact that microsoft will not simply stop and do only security/bug fixes. It is now just the priority.

IMO, this was actually planned by microsoft. They got lightyears ahead with their technology, with features, now all they have to do is sit on it as it sells, and create bug-fixes. Not only does this make the product more stable and secure, but they also have an initial standard for things like .net that will not change. That is crucial.

MICROSOFT PRODUCTS ARE SECURE!!!

[Anonymous Coward]

Oh no! This can't be. How then can I order
tons of armaments from Lockheed, from
Smith and Wesson, and from General Dynamics
without being detected? Microsoft is the
greatest company in the world! Bill Gates
is blessed by Allah. You slashdotters are
evidently pro-Israeli. You are removing the
one thing that allows us poor Arabs the
ability to destroy this infidel nation in
our midst. Bill Gates, do not believe what
these Pro-Linux zealots are telling you.
Your products are great, and VERY SECURE.

We have been smuggling American-made weapons
into Palestine, Afghanistan, Chechnya, Somalia
and the Philippines for years! The Republican
and Democratic parties are paying for the goods
and shipping without their knowing it. All of
this courtesy of Bill Gates. All this done
securely! Without the armaments producers
themselves not knowing we ordered them!
HOW MUCH MORE SECURE CAN YOU GET?

Re: SSH & SSL

[Omniscient Ferret]

OpenSSL provides lots of hooks for various types of crypto. OpenSSH (probably) just hooks onto those.

Free market baby

[sun_hardware_rules]

Your argument that people 'have to accept it anyway' is very interesting. I am unable to understand how you, or anyone else, *has* to buy Microsoft software? I can think of atleast 1 decent competitor that offers nearly everything Microsoft offers, Apple Computer. Sure the apple does cost more when it comes to hardware but you get what you pay for. Same goes for Sun on the server side. In reality, no one is FORCED to buy Microsoft software but rather people CHOOSE to buy Microsoft software. They COULD pay more for the Apple. They COULD hire expensive admins to manage a cluster of 5,000 Unix boxes. In short, people will continue to use Microsoft untill something "better" comes out. And remember that each person has a completly different view of what exactly "better" is!

Re:Free market baby

[xonker]

My point is that, given Microsoft's position, most people see no alternative to buying Windows. You can't argue that most people actually like Windows. Most people just resign themselves to using it because it's what comes pre-loaded on their PC, or because the applications they use only run on Windows. No other business has this kind of predisposition to remain dominant.

Yes, you can go against the stream and use Apple, or Linux, or *BSD on the desktop -- but it's not a simple decision. It isn't an equal comparison -- not because Linux or Apple's OS aren't as good as Windows, but because when you decide to use something else, suddenly you have all these compatibility problems. They're not the result of deficit on the behalf of the MacOS or Linux -- they're the result of the existing dominance of Windows, and the assumption that Windows will continue to be dominant. That's a very hard trend to change. The average customer isn't up to fighting that trend, if they're even aware of the alternatives -- which I would have to say that the majority of people still aren't. Not well-informed, anyway.

Apple is a joke. Not the OS -- the prices for the hardware. The majority of Apple hardware is exactly the same -- the RAM, hard drives, video cards, -- the only real difference these days is the CPU, which is lagging behind x86 by more than 1GHz the last time I checked. Sorry, you're not getting what you pay for, you're getting a lot less these days. It might have been true five years ago when SCSI disks were the standard for Apple and they had a better graphics system, but it's no longer true. Price an Apple machine vs. the same hardware on Dell's site or HP's or Compaq's. Either the folks at Apple are content to remain a marginal part of the computer business or they're idiots. You can't enter a market where your main competitor has >95% and maintain a price point that's much higher than the competition with no real advantage over their product. Then again, I doubt that Apple would live through a price war with Dell, Compaq, HP, IBM and Gateway long enough to gain 10 to 20 percent of the market.

People usually do not choose to buy Microsoft software -- they choose to buy cheaper hardware (PCs) and many people (still) aren't aware that there's any real choice.

I'd like to see a survey of computer buyers where they're asked "how did you decide to buy a Windows PC?" -- The majority would probably say "what, I had a choice?"

On the server side, many companies do choose Sun or IBM or a Linux or *BSD solution. Microsoft doesn't have a monopoly in that market yet, though they surely covet it.

In short, people will continue to use Microsoft untill something "better" comes out.

The vast majority of Microsoft's business practices are dedicated to snuffing out any competing products that might pose a threat to one of their product lines. Considering their deep pockets and willingness to do anything short of murder (so far...) to protect and extend their monopoly this isn't necessarily true. And you know it. Arguing that "the market will decide" might be true -- if the market ever really got to choose. As it is, Microsoft does everything it can to keep that from truly happening. That isn't the market making a decision, it's a stunted list of options being presented to the market. It's very much like voting in presidential elections, most people suck it up and vote for the lesser of two evils rather than voting for someone they really believe in because (like the last election proved so well) the odds of a third-party candidate winning are virtually nil. It's technically a choice, but even people who are aware of Linux and Apple are afraid to invest in an OS that might go the way of OS/2, BeOS, Dr-DOS and so on. Again, that's not really choice.

Re:Free market baby

[Anonymous Coward]

willingness to do anything short of murder (so far...)

How do you know?

And your starter for fun...

[troff]

Has anybody considered...

- Bill Gates, possibly the most hated being in the entire world of technology;
- His statement, that from now on, Microsoft will focus on security, implying their software will be secure;
- The possibility that maybe, just maybe, this might not be lip service or a smoke screen;

- The number of both hackers and crackers who'll stand up and take this as one frickin' huge challenge for the fun of it?

Wabbit Season, Duck Season, renewed Micwosoft Season?

Ah the irony!

[Anonymous Coward]

Trustworthy???!??

After the MS-DOJ trial, MS wants to convince us they are capable of it?

The Janitor and the Vault

[karlm]

However, if you have used Office XP, you will notice that it prevents you from executing attachments, by default.

This still leaves the user with the "Janitor and the Vault" problem. Does Bill gates use the same key for his office door and the company vault full of bearer bonds? If he does, hten he needs to either not allow the janitor to clean his office, or he needs to give the janitor acess to his office and the vault.

The propper way of doing this is to allowte user by default to xecute attachments, but the attachments are sandboxed so they can't make network connections, can't create file handles, and basically canonly play sounds and display pretty graphics. If an email attachment needs to do more than this, then something's wrong.

The *nix world isn't much better, btw. I'd love to see the Unix process model modifed so that executables by default ran as a seperate uid from the user invoking them, and unable to do anything except write tings to the screen, ply sounds, and open files owned by the execuatable. If an executable needs a file handle for one off my files, it needs to pop up a dialog box and ask me nicely for me to open the file for it, This wouldn't necessarily mean major code changes, but it would cause problems for many daemons unless the daemons were run setuid root or something almost as bad.

Ah well, Apple has always ahead of its time.. maybe Apple will ge this right and really force me to go out and go get one of those meaty SMP RISC boxes.

Re:Not security: trust - in "established" companie

[Fly]

The above post is not a troll, silly. According to Craig Mundie, "It will require [...] business practices that ensure accountability and high-quality service." He also states, "we must build trust into these systems from the ground up." It seems like he's painting targets that he will claim Microsoft can address as a big company rather than as a group of programmers hacking the kernel across the globe.

I'm not buying it, but then I can read C. Those who cannot read C can trust in Red Hat and SuSE to keep tabs on the kernel hackers, but Red Hat and SuSE probably do not wish to spend their marketing dollars attacking such a target, and they cannot spend as much as Microsoft can. Plus Linux vendors cannot claim the "ground-up" ;-) stance that Microsoft claims it is using to ensure trustworthiness (not security.)