Slashback: Gopherectomy, Portacinema, Disunity

Slashback tonight with a quartet of updates. So, read on for more information on portable video viewing (and instant recording!), United Linux and one analysts view of What it All Means, Microsoft's answer to a Gopher hole, and why easily guessed passwords sometimes save the day.

Throwing the gopher out with the bathwater. An Anonymous Coward writes: "As reported on News.com and discussed on Slashdot, MSIE's gopher support had a serious security vulnerability that allowed your machine to get ROOT'ed.

Well, it seems that Microsoft is unwilling or unable to make the fix, so it is removing support for the gopher protocol from IE. Not that MSIE's gopher support isn't very poorly implemented anyways."

Kept out of the U.S. by the secret conspiracy, no doubt. Buggalo writes "When I saw the article about the Pogo Flipster I thought I'd mention this too. Of course, it's not available in the US (not yet at least), but it sounds cool anyway. It plays MP4 video as well as MP3 audio. One thing that differentiates it from the Flipster is that this one includes video inputs so you don't even need a computer to get anything onto it. It also seems to have a larger screen. From what I can tell it has 64 megs of flash memory built in, and has an SD memory card slot as well. Sorry the website is in Japanese, but you can use Babelfish to translate it."

Not betting on a United front. dgb2n writes "Smart Money Magazine published an excellent article covering the business implications of the United Linux consortium. It provides some good insight into Red Hat's business model, stock price, and future prospects and names a potential winner in the Linux market."

At least this one aspect is happy. Hellkitten writes "The password for the database has been found, it was as simple as 'ladepujd', the name of the database's creator spelt backwards This previous Slashdot article explains the problem they had.

Aasentunet posted this notice, telling the password and thanking everyone that helped"

ZDNet has the story here as well."

Comments

Don't Do What Donny Don't Does

[ergo98]

It isn't very poorly implemented?

Re:Don't Do What Donny Don't Does

[Anonymous Coward]

First post and it's redundant? Whose the retard that applied that mod? There should be public mods so we can flog the poor miscreant.

The confusion

[King of the World]

Not that MSIE's gopher support isn't very poorly implemented anyways.

Er, wot?

Re:The confusion

[King of the World]

Moderation Totals: Insightful=2, Total=2.

Er, wot?

Re:The confusion

[sholden]

Not that MSIE's gopher support isn't very poorly implemented anyways.

Er, wot?

You have trouble parsing sentences of the form:

Not that A isn't B.

???

For the english impaired, it means that A isn't B is false. And in a lot of cases, thus A is B.

So the quoted sentence means:

MSIE's gopher support is very poorly implemented.

But stated in a more diplomatic style, which I guess is not so common for slashdot :)

Re:The confusion

[Swaffs]

Except that in your example, B is also a negative, cause the confusion by using a triple negative.

Re:The confusion

[DahGhostfacedFiddlah]

B contains a negative quality - it isn't a "negative" itself, in the sense of negating anything. It's only by arbitrarily assigning something good to be "positive" and something bad to be "negative" that you can make that argument.

Re:The confusion

[sholden]

B contains a negative quality - it isn't a "negative" itself, in the sense of negating anything. It's only by arbitrarily assigning something good to be "positive" and something bad to be "negative" that you can make that argument.

B was in fact "very poorly implemented anyways".

Could you please point the out the negative in that statment, because I sure can't see it.

Re:The confusion

[Lemmy Caution]

A logician wouldn't see the negative. A linguist or a cognitive scientist would.

Re:The confusion

[Anonymous Coward]

Erm, why not take the path of least resistance. It's Micorsoft, it's a standard, therefore it's badly implemented.

Re:The confusion

[rschwa]

[Samuel L Jackson]
English, motherfucker! Do you speak it?
[/Samuel L Jackson]

Re:The confusion

[sholden]

A logician wouldn't see the negative. A linguist or a cognitive scientist would.

So spell it out then.

"very poorly implemented" doesn't seem to contain a negative in the sense that "isn't very poorly implemented" would be a double negative.

"not implemented" would be a negative I agree.

Do any of the following also contain negatives:

* very well implemented
* poorly implemented
* badly implemented
* averagely implemented
* extremely poorly implemented
* implemented

How about:

* quickly implemented
* slowly implemented

Which of those is 'negative'? Or is the word 'poor' some new negation that they didn't teach me in school.

Re:The confusion

[Lemmy Caution]

"Poorly" modifies implemented in a way to suggest it is less than ideal - it negates the adequacy of implementation. In a strictly logical analysis, it's a modifier, not a negation of "poorness." But human semantic potential is based on the activation of nodes, not on the parsing of context-free grammar. The difficulties in immediately coming up with a correct interpretation of that string have to do with the fact that "poorly" is going to generate inhibitory activation into the "implemented" reading.

Another way to look at it is to see a progressive scale of implementation, which is a natural reaction to seeing words of gradation such as "poorly" or "well." "Not" implemented will be one extreme, "perfectly" will be another. An unqualified "implemented" would appear in the middle of that line. Between that unqualified "implementation" (say, a 0.5 on the implementation grade) and "not" (say, 0.0) "poorly" might appear as 0.2 or 0.3. If there's a threshold value for negative that might be influenced, say, by a perception of the need to re-do a task, and "poorly" is below that threshold, then it will be "parsed" as a negative (or, more accurately, there will be some activation of the node for negation.)

Even people who are fluent at parsing utterances as logical propositions will show difficulties when you task them with, say, coming up with the correct inferences within (x) amount of time (this is a very common form of experimentation for cognitive science research). Remember, human brains are parallel processors which can, in some context, emulate serial ones, but at a cost of effiency.

Tsop Tsrif

[GoogolPlexPlex]

...So that's what my forgotten Slashdot account password was...

M$FT never ceases to underwhelm me

[jazzbotley]

Now if only my employer would agree to let me fix all the security holes in W2K by UNINSTALLING. I can dream, can't I?

Re:M$FT never ceases to underwhelm me

[keysor]

Apparently you haven't seen the official Windows Me Support page. The big highlighted box at the top says "How to Uninstall Windows Me".

Now THAT's support!

No more gopher? What a cop out

[Anonymous Coward]

Next thing you know, they'll drop support for 75 baud cradle modems. Damn Microsoft! Damn them all to hell!!!!

Portmacinema?

[ObviousGuy]

It's nice to see how quickly the password was hacked into. Now maybe people will realize how encryption and password protection is simply a smokescreen for system infiltration by hackers.

Did the data need to be encrypted? Nope.

Re:Portmacinema?

[bilbobuggins]

Now maybe people will realize how encryption and password protection is simply a smokescreen

Ummm... AFAIK it wasn't cracked it was guessed. Just b/c the administrator chose one of the crappiest passwords ever you can't fault the system.
That's like when someone kills themselves drunk driving you say 'see, roads are dangerous.'

Re:Portmacinema?

[littlerubberfeet]

Overlooking the fact that his password was his name spelled sdrawkcab. Which is VERY bad password security

Gopher probably is poorly implemented..

[rufusdufus]

If I were the manager of IE, I'd just rip out support for gopher too. Why support this protocol which nobody uses (in IE) but has at least one major known security breach? The testing and validation of the bug fix's security, as well as the the rest of the code, would cost way more than its worth.

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

Supporting many obscure protocols is one of the best way to justify bloat. Since Microsoft has arrangements with Intel (basically their software requirements must follow Moore's Law), I predict that the gopher code will return, or more simply that it will be turned off but remain in IE.

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

Except for people who actually use it.

Re:Gopher probably is poorly implemented..

[Osty]

(complete reposting, for the parent is an AC)

Supporting many obscure protocols is one of the best way to justify bloat. Since Microsoft has arrangements with Intel (basically their software requirements must follow Moore's Law), I predict that the gopher code will return, or more simply that it will be turned off but remain in IE.

Right, so there's a big conspiracy for Microsoft to create bloated software to force hardware upgrades. Right. And that's why IE 5.x was slimmed down and much faster than the old IE4? Hrm, looks like that right there breaks your argument. But go ahead and continue believing in the conspiracy theory, because it's apparently a lot more interesting than believing that Microsoft will add and remove features based on real criteria, like customer demand and usefulness.

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

But go ahead and continue believing in the conspiracy theory, because it's apparently a lot more interesting than believing that Microsoft will add and remove features based on real criteria, like customer demand and usefulness.

Like keeping the **popular** gopher client alive and well?!?!

Re:Gopher probably is poorly implemented..

[SirSlud]

And that's why IE 5.x was slimmed down and much faster than the old IE4

See, if you really think customer demand and usefulness doth an MS product make, you're just as bad as our conspiracy theorist. Of course it enters the equation. But if you think its the only factor, keep dreaming.

Customers dont know what to demand. Go ask your mother what the next feature of Windows should be. Most people dont know. I dont believe that MS and Intel have an agreement to push hardware requirements, however, the possibility that execs and project managers 'suggest' things to eath other (hey, keep that feature in there, whats the damage, or hey, we're thinking of do this and that, what do you think) doesn't require a conspiracy to influence the design decisions. And if you think glib, ignorant purely business strategy speak doesnt influence decision decisions suggests that your no less niave than he is conspiracy theorist.

Re:Gopher probably is poorly implemented..

[thesolo]

NoPopIE [daishar.com], Internet Explorer popup killer (win2k/xp only, for now)

Why not just use Mozilla instead, and they you don't need 3rd party software to kill extra windows??

In my honest opinion, if the browser doesn't let you turn off parts of javascript that you don't like, it wasn't written with the user in mind.

Re:Gopher probably is poorly implemented..

[Osty]

Like keeping the **popular** gopher client alive and well?!?!

"Popular" here is relative. Of the "customers" that use IE, I'd guess that much less than 1% even know what gopher is, much less know that IE supports it and actually use the functionality. So in the broader scheme of things, is it really that important to keep functionality that only some couple thousand people would ever use vs. the security concerns for everybody? I'd choose the latter, just as Microsoft did. Prove there's a viable market that demands a gopher client, and I'm sure MS will happily provide that market with such a client. However, I don't think such a market exists in a large enough form to be anything but marginal.

Re:Gopher probably is poorly implemented..

[Osty]

See, if you really think customer demand and usefulness doth an MS product make, you're just as bad as our conspiracy theorist. Of course it enters the equation. But if you think its the only factor, keep dreaming.

While I didn't explicitly say that customer demand and usefulness of a feature were all that go into making feature decisions, I can see how you would read that out of my post. I wasn't trying to make that point. Obviously other factors matter (say, feasability -- if the cost and time-to-market of implementing a customer-demanded and/or useful feature is too expensive, it probably won't get done until V.Next).

I dont believe that MS and Intel have an agreement to push hardware requirements, however, the possibility that execs and project managers 'suggest' things to eath other (hey, keep that feature in there, whats the damage, or hey, we're thinking of do this and that, what do you think) doesn't require a conspiracy to influence the design decisions. And if you think glib, ignorant purely business strategy speak doesnt influence decision decisions suggests that your no less niave than he is conspiracy theorist.

I think you'd be surprised at the amount of autonomy given to product groups, and even feature teams within product groups, at any company (not just Microsoft). Sure, the higher-ups will usually need to sign-off on the big-picture design, but do you really think BillG or Steve Balmer care whether or not IE still supports Gopher (using the current discussion as an example)? Maybe the feature team leads or the product group leads are in communication with hardware companies like Intel (probably only if their product is related in some way to that company), but in that case I would classify that business relationship as a "customer" relationship (some may call it a "partner" relationship, but that's essentially the same thing except that the "partner" has a little more direct control over feature suggestions).

Also, let me reiterate that I believe this applies to all companies, not just Microsoft. I'm sure Apple's software division isn't in cahoots with their hardware division to slow down OS X so people will ditch their G3s and go buy G4s (if so, then X.1 wouldn't have been released). AOL likely doesn't conspire with AMD or Intel to push hardware sales by writing a crappy, bloated walled-garden UI. And so on, and so on. It's just business, not tin-foil hat paranoid conspiracies.

Re:Gopher probably is poorly implemented..

[SirSlud]

Two things:

1. No, I do not believe this gopher issue had anything to do with any partnership. More likely, it was the 'well, the code was written by some temp who was here 10 years ago' (or better yet, to be topical, the code was borrowed by someone we've lost track of, but thank god they licensed under BSD or we'd have had to write our own ;) I dont think the conspiracy guy had much water in this case.

2. Of course, Apples hardware and software divisions are 'in cahoots' (if I were a stockholder, I'd hope so, they work at the same freakin company) .. they might not be 'in cahoots' to add this feature, drop that feature for driving each others sales. But it doesn't take a market analyst to understand that hardware people /rely/ on software people to push the latest and greatest to push hardware. It might not be a conspiracy, but the hardware camp leaning on the software camp to drive demand for various types of hardware, and vice versa is called 'business strategy'. Hell, its in the press releases. Thats the truely funny part about both conspiracy theorists and their naysayers who deny all intentions of said conspiracy. While the methods of using leverage across hard/soft-ware markets might not be as in the dark or 'cool' as the tinhats might like it to be, it still stands that tactics like this are used. It's kind of funny - it seems people are often more complacent of 'intent to conspire', so long as its done in plain view. I still dont think it excuses cases where that leverage is taking precendance over solid engineering design.

Another poster made the wise observation that given how much of MS's revenue comes from new computer software royalties, they do have a massive vested interest in keeping the hardware upgrade cycle very short in order to keep the market fueling the damand for new computers, and thus provide a steady, reliable revenue stream.

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

Customers dont know what to demand. Go ask your mother what the next feature of Windows should be. Most people dont know.

Bad logic. It's like saying "most women don't want sex." Sure, if you go up to a woman and say, "would you like sex?" many of them will tell you to go fuck yourself. Instead, you get their clothes off, and all of a sudden they realize they wanted sex all along.

It's often the same way with customers. They don't know what features they want (or need) until they're actually using the damned things.

(Actually, often times they *do* know what they want. "Just make the f***ing thing work!" is something customers have been demanding quite vocally since the first computer shipped, and we're only very gradually giving it to them. For the sake of completeness, women sometimes say the exact same thing.)

Re:Gopher probably is poorly implemented..

[Osty]

2. Of course, Apples hardware and software divisions are 'in cahoots' (if I were a stockholder, I'd hope so, they work at the same freakin company) .. they might not be 'in cahoots' to add this feature, drop that feature for driving each others sales. But it doesn't take a market analyst to understand that hardware people /rely/ on software people to push the latest and greatest to push hardware. It might not be a conspiracy, but the hardware camp leaning on the software camp to drive demand for various types of hardware, and vice versa is called 'business strategy'. Hell, its in the press releases. Thats the truely funny part about both conspiracy theorists and their naysayers who deny all intentions of said conspiracy. While the methods of using leverage across hard/soft-ware markets might not be as in the dark or 'cool' as the tinhats might like it to be, it still stands that tactics like this are used. It's kind of funny - it seems people are often more complacent of 'intent to conspire', so long as its done in plain view. I still dont think it excuses cases where that leverage is taking precendance over solid engineering design.

I think the difference between what I'm trying to say and what you're trying to say is this: you make it seem as though making software slower is the goal. I don't believe so. Yes, software drives hardware, and yes, newer software typically runs slower on older hardware. That's not because the developers set out to make the software run slow on old hardware. Instead, the idea is that as hardware advances, so can software. To give an example, let's look at Windows XP. The fancy new gui can be a bit of a resource hog. However, Microsoft has provided very granular controls to turn off the effects you don't want, or even switch back to the "Classic" style (which is actually native controls, not pixmaps that look like the old style). If the goal here was to slow XP down on old computers, those features would not have been provided. Instead, the goal was that as computer hardware advances, Windows can do some more cool presentational things. Don't like those, or your machine can't handle it? Turn them off. Windows XP runs just as well on an old p200 (with a liberal amount of RAM) as did Windows 2000. But if you have the hardware, why not take advantage and have a nicer looking display (if you don't like the Luna style, check out ThemeXP). Same goes for OS X. The goal was not to make the new OS slow on older G3s to drive G4 purchases. Instead, it was that the new hardware gives more processing power that can be used on trivial things like all the fancy alpha blending and scaling in OS X. The X.1 patch sped things up, not slowing them down to force people into buying dual 833 G4s (or whatever).

A business decision that consists of, "Let's make things slower so that people will upgrade their hardware," is a bad idea. Something more along the lines of, "Today's hardware is more powerful than that of two years ago, so let's use it. People will probably need to upgrade, but c'est la vie," is much more acceptable. Same end result (more or less), but the means are different.

Re:Gopher probably is poorly implemented..

[SirSlud]

Good point. Although I wouldn't say it can never happen .. maybe we reach a 'featureset limit' (like the lawnmower, hasn't really changed too much, the technology changes inside it, but its featureset remains relatively constant.) Given that the hardware and software world are seperate in the computer world, I really wouldn't put money on it never happening in the future.

After all, if decision decisions are grey (you can never proove one method of solving something is implicitly better than the other, as you can justify different expectations and requirements for a chunk of code .. ie, favour speed over memory, memory over speed), I really dont think its out the question that design decision that has no obvious answer is left to whatever happens to make more money in the end, even *if* that includes favouring some implementation that is slower for the purpose of driving new hardware.

I see exactly what you're saying, and I dont think it happens at all these days, but I could see it happening in the future as computers and applications begin to reach their featureset limits.

Thanks for the dicussion tho, you provided good examples of why I might have a little tinfoil around the ears. :) I dont think organized conspiracies happen very often, but I do believe that flippant decisions with questionable justifications can be made without stirring the pot too violently.

Re:Gopher probably is poorly implemented..

[Osty]

Wow! What a polite person. I wonder what you're doing on Slashdot? :) (to butcher an IRC quote from years ago ...) Anyway, interesting discussion, and I agree that in the future what you've suggested may happen. I'm not saying don't be vigilant, just don't get too caught up in the cloak&dagger stuff to the point where you confuse conspiracy with reality.

Re:Gopher probably is poorly implemented..

[grungeKid]

No, IE 5 *appeared to be* slimmed down since it just upgraded the components that had changed between IE4 and 5.

Re:Gopher probably is poorly implemented..

[Osty]

So why, then, could you install IE5 without first installing IE4? Try it.

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

Because (Tada!) you need to install several service packs before you can install IE5. Guess what sort of code is contained in some of those service packs? What, you thought the IE/Windows integration was magic?

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

Utter bullshit. You can install IE5 on a Windows 95 Initial release vanilla install.

Service Packs my ass!

Re:Gopher probably is poorly implemented..

[Fjord]

I have done this and you don't get the same end as installing IE4 and then IE5. Most notably, you don't get active desktop and the quicklaunch stuff on the start bar. Because of this, when I went from IE3->5 on NT4, I had to uninstall IE, then do 4 then do 5, because I really like the quicklaunch stuff (I can make different sets of icons for different projects and turn them on or off at will).

If you did 5 on 98 or above, you would already have all that stuff, though.

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

Microsoft will add and remove features based on real criteria, like customer demand and usefulness

Like the talking paperclip? OR Bob?

Re:Gopher probably is poorly implemented..

[Anonymous Coward]

hehehe...and there is no mafia.

bad password

[GoatPigSheep]

The password for the database has been found, it was as simple as 'ladepujd', the name of the database's creator spelt backwards

thats not a very smart choice of password, using your name.

at least it wasn't 'god' or 'sex'

Re:bad password

[Anonymous Coward]

That was the point of the story.

...and why easily guessed passwords sometimes save the day.

Re:bad password

[littlerubberfeet]

somewone watched Hackers one to many times....

Re:bad password

[nullard]

somewone watched Hackers one to many times....

Is that possible????

C
r A B
a n u
s d r
h n

Re:bad password

[Anonymous Coward]

that's not my name.

Re:bad password

[Placido]

at least it wasn't 'god' or 'sex'

Whoah! Good passwords! ;)

Most common passwords...

[areguan]

Since everyone knows the most common passwords are god and love. Does this breakthrough mean that 'ladepujd' will become one of the next most common ones as well.

brandon berg,

(\_/)
( ..)
(*)(*)

chicks dig *nix

I was born on RedHat.
Raised on Mandrake.
But Debian made me the man I am today.

Backwards?

[Nept]

The password for the database has been found, it was as simple as 'ladepujd', the name of the database's creator spelt backwards

are you sure that's the name spelled backwards? spelling it 'djupedal' looks more backwards to me ... :)

Re:Backwards?

[damiam]

It's probably something more like D. Jupedal.

Re:Backwards?

[Anonymous Coward]

Actually Djupedal means something like:
"Deep Valley" translated from Norwegian.

Re:Backwards?

[blowhole]

Or it was his stage name as a comically lethargic disc jockey on a tandem bicycle. DJ U. Pedal.

Re:Backwards?

[hta]

are you sure that's the name spelled backwards? spelling it 'djupedal' looks more backwards to me ... :)

Americans......
"djupedal" means "deep valley" in Norwegian, and is a reasonably common surname.
American cultural imperialism is already imperiling the Norwegian heritage with given names like "Roger" and "Angela", but the surnames are still holding on against the flood.
Where is Ivar Aasen when you need him.....?

Re:Backwards?

[Jaysyn]

Oh, now it's our fault that Norwegian parents give their kids names that happen be used in all English speaking countries? How did we pull that off?

Jaysyn

Re:Backwards?

[Anonymous Coward]

Fucking Norwegians. Expect the US to adopt, study, and know expertly Norwegian culture and language. Arrogant pricks. They are imperialist dogs for trying to force their culture down our throats.

Re:Backwards?

[subgeek]

the thing about "cultural imperialism" is that it is fought by the "victims." if people don't give up money to the invading culture, it cannot spread. the problem is that people don't always realize that they are buying the entire package and not just the entertainment or the convenience they want.

and on a lighter note...

i'm an american, but i do my part to preserve things norwegian. i buy jarlsberg cheese and apoptygma berzerk cds. actually i just buy those things because i like them.

Gopher support shouldn't be in IE

[dirk]

Why should IE continue to support Gopher? It is a protocol that is rarely used. It is outdated, and there is no need for it in IE. It's what is commonly refered to as program bloat. It's not needed and should be removed. For the .001% of IE users who do use Gopher, they can use a seperate Gopher utility, which will probably support it better than an all-in-one option like IE. Isn't program bloat one of the things everyone has against MS? Shouldn't this decision be applauded?

Re:Gopher support shouldn't be in IE

[Anonnymous Coward]

Because the RIAA isn't looking for MP3 sites, the BSA isn't looking for warez sites, and the IDSA isn't looking for ROM sites on the gopher:// protocol. Oh well, the clued already aren't using IE anyway, so no loss.

Re:Gopher support shouldn't be in IE

[Anonymous Coward]

If they're going to rip out functionality because it's easier than fixing it, I'm just disappointed they didn't rip out the least secure component...

WWW

Re:Gopher support shouldn't be in IE

[MavEtJu]

Why should IE continue to support Gopher?

"Welcome to Internet Explorer. With this you can easily go everywhere on the Internet. Except for sites which have protocols that we have problems with implementing(*). Have a nice day.

(*) This is everything except FTP and HTTP. Even if there are problems with the implementation of FTP and/or HTTP, we will not remove them(**).

(**) This will happen after we've implemented the MS-PPTP(***) into our IIS servers and have replaced TCP/IP with the MS-PITY(****).

(***) Microsoft Private Propriatary[sp] Transfer Protocol is a trademark of ...

(****) Microsft Protocol for Internet TechnologY is a trademark of ...."

Re:Gopher support shouldn't be in IE

[Anonymous Coward]

Wrong. The clued in ARE using IE. There is no other useable browser. The zealots are not using IE and complaining bitterly that nothing works. Get your head out of your ass before speaking next time...

Re:Gopher support shouldn't be in IE

[Anonnymous Coward]

You keep right on thinking that, MS fanboy.

Re:Gopher support shouldn't be in IE

[Our Man In Redmond]

Oh great. Now you've gone and let the cat out of the bag. Next thing you'll be telling everybody that people use FTP servers running on nonstandard ports to trade . . .

um, oops

Re:Gopher support shouldn't be in IE

[ealar dlanvuli]

Unfortunatly Mozilla totally blows Internet Exploited out of the water in usability and rendering capabilities. You should try it.

I can't stand using that excuse for a web browser that is IE since 0.9.9 release or so.

Re:Gopher support shouldn't be in IE

[Anonymous Coward]

Why do you dumbass moderators mod up these blatant karma whores? This is the most obvious fucking post.

When is Slashdot going to have a filtering function that removes anything moderated as "Insightful"?

Re:Gopher support shouldn't be in IE

[Anonymous Coward]

Silly little boy. If you remove all the bloat, what part of Windows do you have left?

Re:Gopher support shouldn't be in IE

[caca_phony]

The zealots are not using IE and complaining bitterly that nothing works.

There are warnings all over gopherspace not to use IE for gopher. IE has always sucked at gopher. No graphic web browser currently does gopher+, at all. And yes, this does mean I use gopher.

Re:Gopher support shouldn't be in IE

[Tottori]

Why should IE continue to support Gopher?

Because IE is supposed to be a web browser. The original concept of a web browser was to provide a unified interface to Internet resources.

Naturally, this is an invitation to software bloat, although if the browser is modularised it needn't be so bad. But arguably the user interface benefits are so compelling as to compensate for the conceptual ugliness.

By removing Gopher, Microsoft are moving away from the concept of a web browser and towards the concept of a proprietary content viewer.

Re:Gopher support shouldn't be in IE

[Anonymous Coward]

For the .001% of IE users who do use Gopher, they can use a seperate Gopher utility, which will probably support it better than an all-in-one option like IE. Isn't program bloat one of the things everyone has against MS? Shouldn't this decision be applauded?

MS decision applauded?! HELLO! WAKE UP! THIS IS SLASHDOT!

-- Jake.

Re:Gopher support shouldn't be in IE

[RegularFry]

The original concept of a web browser was to provide a unified interface to Internet resources.

No it wasn't. It was originally supposed to be an interface to HTML viewed over an HTTP interface - to which I say Good Riddance. Everything else came with (I think - someone more knowledgable may have an earlier reference) Netscape. I don't think NCSA Mosaic even had FTP access in its earliest incarnations.

UnitedLinux...

[rob-fu]

is a good thing. Homogeny can do nothing but help.

Bad passwords and old software...

[kzinti]

According to a report and interview on NPR All Things Considered this afternoon, it only took about an hour to discover the password. The hard part was finding a copy of the old DOS-based database software that was capable of opening the database.

The institute now keeps copies of all its passwords locked in a safe. Of course, if all its passwords are as bad as the lost password, then what's the point?

--Jim

Re:Bad passwords and old software...

[Dr. Nonsense]

"The institute now keeps copies of all its passwords locked in a safe."

And where do they keep the code or key to the safe?

Re:Bad passwords and old software...

[Anonymous Coward]

And next in the news, Locksmith needed due to lost combonation...

Re:Bad passwords and old software...

[Anonymous Coward]

Well, I could tell you, but then I'd have to kill you...

Re:Bad passwords and old software...

[Erasmus Darwin]

"And where do they keep the code or key to the safe?"

If it's the main safe, there would presumably be several trusted individuals with the key or combination. That's quite different compared to the password used on a project done by a single person.

But it doesn't really matter. Cracking a safe is relatively easy compared to attempting to recover the password from a proprietary application.

Re:Bad passwords and old software...

[Anonymous Coward]

>And where do they keep the code or key to the safe?

In the safe, of course :] Have to keep it safe from those l33t0 hax0rz... ;]

Besides, there's always TNT...

Re:Bad passwords and old software...

[Anonymous Coward]

The actual database was in DBase for Windows format, compressed and split into 1.44mb chunks by MSBackup in DOS 6.0. But of course there was a catch.

Apparently MSBackup used the compression routines in dblspace.bin (DoubleSpace), and with the whole Stac-compression deal that made MS switch to DriveSpace, newer versions of DOS didn't have the right compressor.... so you needed a copy of DOS 6.00 (not 6.22 or whatever) to get it to decompress.

Fun, huh?

Re:Bad passwords and old software...

[bluGill]

Not an issue, a good locksmith (who knows safes, which isn't all good locksmiths) can get into any safe in less than a day, but the effort will leave physical evidence.

Re:Bad passwords and old software...

[Captain Chad]

Actually, this is not quite correct. The NPR interview said it took an hour to discover the password *and* determine the correct version of the software. Furthermore, the majority of the hour was used up in determining the version. Apparently the password existed in plain-text within the data file, and it only took a few minutes to discover it.

Re:Bad passwords and old software...

[mks113]

Don't have to listen to NPR -- read Slashdot

I think this is the guy who is being "recognized". I'm working night shifts, and was watching some of this unfold on Slashdot. I'm quite sure there was someone else who used a different method of getting the password -- a utility which found the first letter of the password, then looked through the backup for words that started with "d" and found it quickly. Why can I not find those posts when I'm looking for them!

On a side note, this file was created before it was given to the museum, so their password policies did not cover the issue.

It is good to see the power of the internet and hackers used for good. All too often hackers only get mentioned in the negative sense.

Michael

ECLIPSE

[phriedom]

The solar eclipse has begun. Don't look at it.

Re:ECLIPSE

[phil reed]

OK, it's over now. You can look again.

I wonder...

[FATRanger]

How many /. reader's use their name spelt backwards as passwords ;)

Re:I wonder...

[scrote-ma-hote]

Me!.

Wait no forget that. Let's not tell anyone I said that eh?

Re:I wonder...

[Anonymous Coward]

My password is drawoC suomynonA

Re:I wonder...

[rednaxel]

Actually, I use it... as the name of my company: bw("Alexsander") = "Rednasxela". After minor adjusts (removing S & A), it becames Rednaxel.

Well, this password crack worked well...

[Oopsz]

...But we should all take it as a lesson. Use strong pass phrases!

Re:Well, this password crack worked well...

[agentZ]

I disagree. The lesson we should take away is that there should be a password recovery mechanism.

If this person had used a strong password and strong crypto, all of their work could be lost! The password recovery mechanism has to be difficult enough to deter an attacker (e.g. require physical presence of company CIO, etc), but easy enough to do in an emergency. This could be necessary for untimely deaths, disgruntled employees leaving without turning over the access devices to their accounts, etc.

Re:Well, this password crack worked well...

[Anonymous Coward]

"The lesson we should take away is that there should be a password recovery mechanism."

Maybe Microaoft can help: we can keep all the passwords in a Microsoft-controlled DB.

Re:Well, this password crack worked well...

[thelen]

I heard recently about a software package (no reference, sorry) for managing company resources based on a security model of aggregate permissions. Suppose the administrator for a system dies (as in this Norway case), two non-administrator employees might together be given permission to access the database as admin.

The software is based on a point system where a person at a particular organizational level would possess N points to contribute toward a group effort requiring security clearance.

Guess that's not too good if you're an abusive employer though... "Mutiny on the LAN!" ;)

Re:Well, this password crack worked well...

[wirelessbuzzers]

That's already in PGP. You can make split keys easily. And it is easy to program your own: to make an m-of-n system, where you need m of the n pieces to recover the password, let r_1 through r_m-1 be lists of random integers 0 to 256, with lengths equal to that of the password.

Then share number s of the password, part i is r_1[i]+s*r_2[i]+s^2*r_3[i]+...+s^(m-2)*r_m-1[i]+s^ (m-1)*password[i] all mod 257. If you have m of the shares, say keys numbered s_1...s_m, you reconstruct (leaving out the [i]'s this time) as password=key_s_1/((s_1-s_2)(s_1-s_3)...)+key_s_2/( (s_2-s_1)(s_2-s_3)...)+...+key_s_m/((s_m-s_1)...).

I hope that isn't patented, it's just a back-of-the-envelope calculation with VanderMonde matrices. All you have to do then is have everyone encrypt their share(s) with a different password, and integrate the key-rejoining routine with the password-entry system so that the employees don't get to see it after reconstructing it, and you're done. The cool thing about the system is that m-1 of the shares give no information about the password, assuming the random number generator you used is good enough.

Re:Well, this password crack worked well...

[brwells]

And then what are you going to tell your shareholders when the news comes out that your database was cracked in a couple of minutes by a script kiddy? And then it happens again, and again, and again?

If you follow good computing practices this problem would never happen.

1. Every application or system should have an administrative userid with the ability to change all passwords.

2. This userid should be guarded like fort knox.

3. The password for this userid should be changed on a regular basis.

4. At least two people should be involved in the password change, and preferably each one should only know half of the password.

5. Each time the password is changed it should be recorded in twice. One record should be stored locally in a secure place such as a safe. The other copy should be stored in an easily accessible secure offsite storage facility.

6. A third party should be responsible for verifying the process has been completed and report to management any deviation from the procedures.

7. Management approval should be required for retrieval of the password and the password should be immediately changed after usage.

This may sound a little extreme, but it is very easy to implement. If these or similar procedures are followed you will never lose the password and you won't have to resort to using week passwords.

Re:Well, this password crack worked well...

[agentZ]

An interesting idea, but how do you cope for users forgetting their passwords on a daily basis? If we assume that the administrator(s) can change the passwords for users, there has to be more than one administrative user. (Somebody has to man the tech support desk every day!) How can you guard the admin password like Fort Knox if it has to be given to several people?

Re:Well, this password crack worked well...

[Misuta Supakulo]

No, this is a lesson in documention. The password should be documented, and kept in a safe place. Hmmm, I wonder what a good way to do that would be. How about written down and put inside a safe? This is hardly rocket science here.

Re:Well, this password crack worked well...

[brwells]

You grant junior-admins or helpdesk operators the ability to reset user passwords. The users should not be allowed to change administrative, service, or system passwords.

In the NT world there is a default usergroup named "Account Operators" that have this ability.

In a production environment the admin passwords should only be used when making changes or for emergency fixes. Both of these situations would require management approval or notification and the admin password could be "checked out".

We have a little over 3500 servers worldwide at my company and this is the process we have in place. And the process works.

Sighting today in Redmond, WA, US...

[Anonymous Coward]

Bill Gates wearing full Viking armor and singing "Kill the GO-PHER, Kill the GO-PHER, Kill the GO-PHER!!!" to the tune of "Ride of the Valkyries." ;-)

Re:Sighting today in Redmond, WA, US...

[Anonymous Coward]

...With my spear and majick helmet!...

Inspirational password!

[DJ Uptime]

"djupedal" has proved inspirational. I've been looking for a new Slashdot ID....

Re:Inspirational password!

[svvampy]

DJ micro Pedal?

Actually reading the article...

[Aexia]

It's not clear whether backward last name was the actual password. Both the thank you notice and the news article say that was a password submitted by users.

Re:Actually reading the article...

[elmegil]

In coverage of this on NPR this afternoon, the current keeper of the database whose name I can't remember and probably couldn't spell anyway, stated unequivocally that the password was the backward name.

Whoa, Microsoft...Lied?

[Anonymous Coward]

IE implimentation of Gopher can get you rooted (bloody typical), call comes down from above to yank support. Makes sense, in an MS sort of way.

Wait a minute...didn't they just tell us that Windows ISN'T modular?

Bastards!

Quite interesting...

[numark]

So Microsoft is stepping up the removal of old code from Windows?

Hrm, so this means that Internet Explorer will be gone from the OS completely in a few months? Cool!

Re:hey

[Graspee_Leemoor]

You're an anime fan and a troll- take him away!

Protocol manager

[hackwrench]

What Microsoft should add is a protocol manager that shows all the protocols your system can access, whether it be through Microsoft or other 3rd party vendors like Real's prn protocol

Re:Protocol manager

[wbajzek]

like Real's prn protocol

Wow, they were really thinking ahead when they named their protocol!

Re:Protocol manager

[Anonymous Coward]

in windows (err, in the windows, I run), theres a 3rd party app called protman that does this.

Re:Protocol manager

[Anonymous Coward]

otherwise known as a non-sucky firewall

Re:Protocol manager

[jhines]

Or actually deliver the object orientatied OS, they promised years ago, back when they had one to compete against?

OS/2 had the ability to manage multiple applications per object, a feature I miss.

Gopher IE Exploit

[Tempura_Roll]

This is yet another reason Microsoft should open the source for IE.

Re:Gopher IE Exploit

[Anonymous Coward]

Yeah, look how good Mozilla's gopher support is.

well, well

[Anonymous Coward]

lol, Microsoft better not just remove every feature that has a security hole in.. or lots of people will have to go back to DOS in a couple weeks.

To clarify why parts are "impossible" to remove

[rufusdufus]

Removing gopher will effect a very very small number of people, and probably no 3rd party software vendors.
Removing HTML rendering AND HTTP support (which is what removing IE equals) would screw many many users and thousands of 3rd party software vendors who rely on this support from the OS, in in fact render the system unusable as too many components rely on this support, 3rd party and otherwise.

When MS says Windows is not modular, they are using a legal, not technical, argument. This is based on past cases where, for example, Ford was banned from buidling pick-up trucks with covers (ie snugtop) because it was an optional module.

Re:To clarify why parts are "impossible" to remove

[Anonymous Coward]

Removing HTML rendering AND HTTP support (which is what removing IE equals) would screw many many users and thousands of 3rd party software vendors who rely on this support from the OS, in in fact render the system unusable as too many components rely on this support, 3rd party and otherwise.

Hell, ADDING it to Windows screwed the web badly enough, and I'd argue it made the system unusable in the first place.

Re:To clarify why parts are "impossible" to remove

[avarame]

When MS says Windows is not modular, they are using a legal, not technical, argument. This is based on past cases where, for example, Ford was banned from buidling pick-up trucks with covers (ie snugtop) because it was an optional module.

Well then, by thunder Microsoft should be banned from producing an OS with a browser included, because it's an optional module!

Microsoft should be banned from including a Microsoft-branded browser, and if they want to keep IE they'll have to spin it off to a child company. This would be legal under that precedent (though the interaction would have to be watched) - it's the same as Ford including another company's cover with their trucks, which is perfectly legal. The court case only bans Ford from including a Ford-made cover.

Instead they could take Apple's standpoint on the issue: HTML rendering services and APIs are provided, some kind of simplistic HTTP is provided, but a browser (i.e., complete application using those tools) is not part of the OS. Until recently, Internet Explorer and Netscape were both included with the OS (though IE was the default, grr...). This changed with OS X because until very recently there was no OS X-native version of Netscape. With the next version of OS X, due out in late summer, Apple probably will once again include both.

Why?

[on by]

Seriously, why? What difference would it make?

GNU/Linux is open source and it has plenty of security problems and exploits...

Re:Why?

[Codifex Maximus]

Don't forget to shred, burn and grind the ashes too. While yer at it, make sure there are no video cameras operational in your area. Also, don't speak the letters as you type or write em. Make sure you write on a solid surface that leaves no indentations. Look over your shoulder to make sure no one is watching you type!

Re:Why?

[wirelessbuzzers]

Because Diceware is so much easier. Just roll 5d6 a couple of times, and you have a secure password, à la "cleft cam synod lacy yr." Well, so the paranoid ones of you will use 10 words to match the strength of the hash, but...

Gopher is not part of Windows

[tato (and tato only)]

Fortunately for Microsoft, the Gopher implementation in IE was inextricably integrated with Windows. I guess only the HTTP part of IE can not be removed without breaking the whole operating system.

Re:Gopher is not part of Windows

[Anonymous Coward]

I don't think you know what the word inextricably means. Stop using it.

MS (non) Gopher

[Floyd Turbo]

This reminds me of an old joke by George Carlin (or at least I think it was Carlin).

Newscaster:
A man got on to an eastbound bus and killed three people. He then took a transfer, got onto a westbound bus and killed two more people.

As a result, bus authorities say they will eliminate the transfer system.

Why?

[Anonymous Coward]

Why don't people site down, write down a 10 digit passwd consisting of numbers, letters and symbols, then right it out over and over again untill they memorize it, done, everyone has a good password

Anagram Fun Competition!

[Graspee_Leemoor]

Who can come up with the best anagram of "Slashdot Editor" ?

My best effort so far is: "Oddest oral shit".

Have fun!

Your friendly neighbourhood AC

Re:Anagram Fun Competition!

[FlowerPotAdmin]

Who can come up with the best anagram of "Slashdot Editor" ?

How about "Drat, I sold those!"?

Re:Anagram Fun Competition!

[martinde]

A TODDLER HI TOSS

Re:Anagram Fun Competition!

[wirelessbuzzers]

how about "Toss RedHat idol"? or "idle as short dot"?

Thanks to Wordsmith's Internet Anagram Server for these.

Re:Anagram Fun Competition!

[fatphil]

Slashdot editor=
A shortest dildo...
... at sordid hotels.
Or shitted loads.
Sods loathe dirt.

FP.

Re:Anagram Fun Competition!

[Iguanaphobic]

A toddler shit so.

I think

[djupedal]

...the password was selected as to be easy enough to discern in the event of death.... After all, these are not state secrets we are talking about, now are they. A password was obliged and enabled, that's the simple driver. Beyond that, not much was to be gained by making it cryptic.

the first

[Anonymous Coward]

Slashdotted Gopher server. Whatever next.

Re:no agreement needed

[Splork]

if ms and intel didn't continue to release software that continually pushed the hardware requirements they would both lose their largest source of revenue: new computer purchases!

fool.

[jcsehak]

it was as simple as 'ladepujd', the name of the database's creator spelt backwards

What an idiot. I, an 31337 hax0r, am much smarter. My password, "78sne4ml;w" is composed of random characters, which nobody would ever guess. Lam3r.

Re:fool.

[stere0]

Dear jcsehak,
I apologize for disturbing you, but you seem to have omitted your slashdot password in the parent post. This could also just be a typo in the password you gave.

Would you please reply with the correct password?

Re:fool.

[blowhole]

Dear stere0,
We apologize for the inconvenience, but our records indicate that your order for a "Swedish-made pensu pump" did not process correctly. Please respond with your credit card number, expiration date, and mother's maiden name.

japanese zaurus

[frankmu]

the japanese zaurus has a video adaptor so you can download movies to your zaurus. unfortunately, i don't think it's available for the us version (we have the ARM processor, they have the SH processor, i think) you can still view movies on your zaurus without a problem. smoother than the palm 505, i think

Red Hat Red Ink

[Quirk]

If worse turns to worst, Red Hat could always become a bond fund for fixed-income retirees.

Funny, but then stacked up against the MS 40bn catastrophe fund even as bond funds MS still rules. The analysis was sound, and, sadly resonantes with the big questions Red Hat has yet to answer. IBM's brilliant play of the Linux market was worthy of note. Bill Gates stole the OS market from IBM when MS dumped OS/2, maybe IBM is looking to steal that market back. Mmmmmm a real fight between the Big Dawgs would be a spectacle to behold.

Back what?

[TheFlu]

Good thing my name's not Bob.

They hire CS majors, eh?

[ealar dlanvuli]

"The problem is that you are dealing with 50 million lines of code and everything depends on everything else,"

I'm prety sure that was established as bad form, oh, about 20 years before MS's birth.

They never cease to amaze me with thier forward thinking 'inovation' though... Apparently spagetti code must be 'the wave of the future'. I guess I must not be hip enough, my boss better hirry up and fire me!

Re:They hire CS majors, eh?

[Anonymous Coward]

that was supposed to be funny!

/cry

Re:No more gopher? What a cop out

[thesolo]

Next thing you know, they'll drop support for 75 baud cradle modems. Damn Microsoft! Damn them all to hell!!!!

The sarcasm and humor in the parent post aside, this is a very serious issue.

I think most of us know that Gopher is not used very much anymore, so MS supporters are definitely downplaying this hole. However, by not releasing a patch and instead just removing Gopher support, MS is leaving millions of people still open to vulnerabilities!

Not everyone who uses IE is going to upgrade to the next version of IE which will have no Gopher support. Not everyone runs WinXP, and can install the latest service pack that turns off Gopher support. People are going to keep their system the way it is, but because a patch is not available, they will be vulnerable to arbitrary code being executed at system-level just by clicking a link. And god forbid someone DOES actually want to use Gopher under IE, I guess they can't upgrade to the next version of IE. (Hey, they can always use Mozilla though!)

This could have a major spiral effect too; think of the Code Red worms. When worm writers realized that people were not patching their system, they released variants of the same worm, to do even more damage. If malicious people now hear that MS is not planning on patching this vulnerability, they might very well have a field day with it.

I guess all that talk from MS about their "trustworthy computing initiative" was exactly what we all thought; complete and utter hogwash. This type of behavior is simply unacceptable, but especially from a company that claims to be on a company-wide security audit.

[Offtopic] NoPopIE

[Osty]

Why not just use Mozilla instead, and they you don't need 3rd party software to kill extra windows??

Because I like Internet Explorer? Because it was a learning experience to develop a browser helper object? Because everybody keeps saying that Mozilla can do this and IE can't, while that's obviously not true? Because I wanted to? If I use Mozilla, then you're right, I don't need 3rd party software to kill extra windows. Instead, I just need 3rd party software to browse the web. All right, so I'm a lemming because I prefer IE, or because I don't know that mozilla is "better", or because I'm too stupid or lazy to download a 3rd party browser instead of using the built-in browser. Too bad, I don't care.

Re:[Offtopic] NoPopIE

[Anonymous Coward]

Instead, I just need 3rd party software to browse the web.

All hail the first party.

Gopher

[Codifex Maximus]

I remember using gopher back when search engines were just getting started. If you couldn't find it on the search engine, you could always try gopher.

I kinda miss it... sniff. Poor lil guy.

Re:Gopher

[fatphil]

I remember using gopher when that was the only available option. It was never a choice - it's a pants interface.
If I wanted to find something, then I always used _archie_ (because there were no search engines as such).

FP.

Re:Gopher

[MobyTurbo]

I remember using gopher when that was the only available option. It was never a choice - it's a pants interface. If I wanted to find something, then I always used _archie_ (because there were no search engines as such).

Gopher had a search engine, Veronica. It wasn't a very good one though.

[OT]Re:Backwards?

[Anonymous Coward]

about your sig: soooo true.

Re:[OT]Re:Backwards?

[Anonymous Coward]

damn straight...i hate vb

Re:No more gopher? What a cop out

[MrResistor]

However, by not releasing a patch and instead just removing Gopher support, MS is leaving millions of people still open to vulnerabilities!

Not everyone who uses IE is going to upgrade to the next version of IE which will have no Gopher support.

Yeah, but those are the same people who wouldn't install the patch, so what difference does it make?

Actually, it's much more likely that people will install the new version of MSIE than that they will install a patch.

I agree that it's a cop-out, and probably indicative of MS' security future, despite all their lip-service to the contrary, but lets be honest here; people are stupid, so there will be millions left vulnerable no matter what MS does because those millions are too ignorant to protect themselves.

The only thing they could do that would actually make a difference is release the patch as a worm that would patch it's own exploit after emailing itself to your whole address book.

uh, no

[twitter]

Removing gopher will effect a very very small number of people, and probably no 3rd party software vendors.
Removing HTML rendering AND HTTP support (which is what removing IE equals) would screw many many users and thousands of 3rd party software vendors who rely on this support from the OS, in in fact render the system unusable as too many components rely on this support, 3rd party and otherwise

Nope, try again. M$ could care less about other software, as you can tell by their conatantly changing print methods. The reason M$ claims that IE can't be removed is because they put it in EXACTLY the way they were forbiden to by the federal government: spagetti coded into the OS itself through innumerable DLLs with multiple undocumented and unrelated interfaces. This kind of code mixing, like passing disk access through the GUI, is one of the reasons M$ is so unstable. IE is always on because it recieves many unecessary function calls. What you get when you try to remove IE is a box that won't boot. I doubt even Bill Gates knows what you get when you leave it in, besides poorer.

Re:Password

[Anonymous Coward]

I don't know if the password happened to be the former administrator's name spelled backwards but it definitely was the reversed name of one of the folders in the backup set.

What about Mozilla

[smw1218]

So I tried to read how gopher on IE was so poorly implemented with my preferred browser,Mozilla 1.0, and all I got was a blank page. Nothing but whitespace. I had to open up the only other browser on my box to read the page which is as you may have guessed, IE.

very frustrating. I will have to bring this up at the release party after I am totally sloshed.

Re:What about Mozilla

[nvainio]

Well, the document blames them all - IE, Netscape, Mozilla, Opera, Lynx. IE just being the worst.

Re:What about Mozilla

[Anonymous Coward]

the page loaded for me..
It took a bit.. initially it was all blank.. then poof.. lots of text.....

You always figure it out right after posting!

[rdmiller3]

The password for the database has been found, it was as simple as 'ladepujd', the name of the database's creator spelt backwards

So it took them what, maybe an hour to figure this out? but the plea has been circulating for several days...

It's been true since I can remember: the larger the audience from which you beg a clue, the sooner you'll find it yourself, and the dumber you'll look because of it!

How much ya wanna bet the folks who panicked wish they had just asked one or two buddies to help them out? :-D

Re:No more gopher? What a cop out

[GSloop]

Or they could spend a few of those billions making secure code in the first place.

Pleeeeeze - it can't be that hard scanning your code for unchecked buffers! So I don't think that fixing the thing even after the fact would be that insanely difficult...

Lastly how about software liability?

The only time that MS really fixes things (or anyone else for that matter) will be when it costs them. When they have to go before a jury, and explain how they didn't use any due dilligence, and that that total system crash that took down the First Interstate Loan Center (Portland Oregon) in the early-mid 90's for hours and hours every week was their own fault. (As I recall it was an undocumented switch in the TCP stack that fixed the SNA session dying thing...) [I know, I had friends that worked there then - NT 3.1, 3.5? dunno]

When companies no longer can shield themselves from liability by claiming that software is _SO_ different than the rest of the known world, they'll actually do somthing - till then, just get ready to take it like a good consumer!

Cheers!

Re:FIX Online to download!

[Anonymous Coward]

I saw this on the TechTV message boards, some pivix has created a program to patch it. I got it from http://www.pivx.com/gopher_smoker.html hahahah! they said 'we clean up microsoft's mess again!'

Gopher - n.

[Anonymous Coward]

gopher Pronunciation Key (gfr)
n.
Any of various short-tailed, burrowing rodents of the family Geomyidae of North America, having fur-lined external cheek pouches. Also called pocket gopher.
Any of various ground squirrels of the genus Citellus of North American prairies.
Any of several burrowing tortoises of the genus Gopherus, especially G. polyphemus of the southeast United States.

I was wondering where all the HOLES were coming from!! No HUMAN can write code *THAT* crappy.

Homogeny can do nothing but help...

[ejungle]

...spread viruses/virii/whatever.

In all seriousness though, I do like to see a reduction in duplication of effort. However, diversity is a fundamental construct of open source philosophy. So as with anything else, United Linux has its positive and negative aspects.

You're wrong.Bill Gates is nothing like a valkyrie

[Ilan Volow]

Bill Gates in no way resembles a loud, fat, big breasted nordic messenger of doom.

It had to be Balmer.

DOD needs similar help

[Anonymous Coward]

Hi, I'm with the DOD.

I'm posting anonymously because I'm embarrassed.

We've lost the password to the secret satellite missle defense network.

If one of you could please hack it to recover the lost pasword, and email it to us, like you did for those Norwegians, we'd really appreciate it!

Thanks!

Oh yeah, the address: mailto:sdi@area51.gov

If you find the lost password, and that email address doesn't work for you (e.g. your DNS client doesn't have a compartmentalized security clearance that would let it even look up the domain name), then you can just post it to Slashdot, and we'll read it there.

Thanks again!

Re:dirtypanties

[Anonymous Coward]

That's nice, but I would like to hear more about "filthypenis"!

TIA!

Re:No more gopher? What a cop out

[ncc74656]

I think most of us know that Gopher is not used very much anymore, so MS supporters are definitely downplaying this hole. However, by not releasing a patch and instead just removing Gopher support, MS is leaving millions of people still open to vulnerabilities!

They ought to just hire Bill Murray and be done with the problem. (Hey, it wouldn't be any worse than anything else they've done...)

Re:No more gopher? What a cop out

[sniggly]

This vulnerability is so easy to exploit (javascript popup to a gopher) its driven me and a couple of other people I know to use mozilla almost exclusively on win boxes. Unfortunately Mozilla doesn't render everything MSIE does (apparently checking your page in netscape hasnt been a priority for many web developers anymore).

Gopherectomy?

[Anonymous Coward]

Is that what you have to do after a felching accident?

Re:No more gopher? What a cop out

[bertilow]

by not releasing a patch and instead just removing Gopher support, MS is leaving millions of people still open to vulnerabilities!

I don't really understand why MS should bother releasing a patch to this. That would be totally redundant since the Mozilla team has already made a very nice patch available to all. It's a bit of a download, but not much more so than the usual MS patches, and it's actually worth the download time. It fixes lots of other stuff too, e.g. the 'position:fixed' bug.

Lesson learned: Don't password unless you need to

[Hellkitten]

UPDATE: It appears that ladepujd was not the password to the actual database, but to the backup of the database, put there by the backup program

The password to the actual database appears to be reidar (the creators first name)

And before you all start bitching and moaning about bad password security. The database was an index of a collection of about 14000 documents and books and stuff, and would have no value unless you owned those documents. So basically there was no need for a password, and it probably was only there because the program asked for one. After all the guy was not an admin (as a lot of posters seem to believe) but a researcher and if the program wants a password you give it one. But not beeing completely clueless he used an easy password, since there was no need for a strong one

The problem arose because when Reidar Djupedal died, and his collection was donated to the museum, noone knew the password, and indexing 14000 books and documents takes a lot longer than cracking passwords

The thing I hope to see in the future is that this story about the password and the ensuing problems, slashdotting and cracking actually is told at the museum, we as a collective entity could become a part of Norwegian history :)

Re:No more gopher? What a cop out

[Anonymous Coward]

OMG LOL Your to funi I laf at you're funi LOL PLZ tell more jokes!!1 LOLOLOL

Bill Gates in no way resembles

[dpilot]

Neither did Elmer Fudd.

(Presuming the parent was a reference to one of the best Bugs cartoons ever.)

Re:Bill Gates in no way resembles

[RegularFry]

Seconded.

But then, Fudd wasn't playing a Valkyrie, was he?

Re:No more gopher? What a cop out

[gosand]

This type of behavior is simply unacceptable, but especially from a company that claims to be on a company-wide security audit.

And here is the scary part - MS sees this as being a fix to a security issue. I have no doubts that this will be spun to show that they ARE concerned about security*.

*provided the user upgrades to the latest release of IE. Of course, it would be even better if they had to upgrade the whole OS to XP. (picks up recorder) Note to self: email the boys in development and tell them to only remove the Gopher support in IE for XP. Use the usual excuse that it is the only technically feasable solution... Oh, and pick up a new kicking-puppy on the way home.

obligatory movie reference

[WebMasterJoe]

This reminds me of Spaceballs (slightly paraphrased)

1! .... 2! ..... 3! .... 4! .... 5!

That's the combination? That's the kind of combination an asshole would use for his luggage!

Re:No more gopher? What a cop out

[slide-rule]

... but lets be honest here; people are stupid, so there will be millions left vulnerable no matter what MS does because those millions are too ignorant to protect themselves.

Interesting (and depressing) thing occured last week here at work. Couple of us "linux" nuts were talking to a "windows" nut about the need to at least keep up on system patches, etc. Now, he's a very brilliant engineer and can get around in a computer system more so than you'd otherwise think when you heard his reply: "I don't care. I really don't." This even after we explained it wasn't about someone taking stuff from his system as much as it was about someone using his system to attack others. He is smart enough to do it, understands the repurcussions of not doing it, and still doesn't care. It was at this point that the couple pro-linux nuts in the discussion realized that there was honestly nothing we could say to move his opinion.

In other words, you have to figure that, as many clueless people are not patching their systems, our co-worker represents a large number of quite saavy people that are completely apathetic to wanting to be bothered. They don't have the interest to want to take the time; we can't reach these people using fear or logic. How, then, do we protect ourselves?

Re:No more gopher? What a cop out

[Fjord]

Still, there are people like myself that stick will IE5.5 because it's the standard for the applications they are working on. You can't install two versions of IE, so I can't just quickly use one and then use another for surfing.

Of course, I use mozilla for the majority of my surfing, but I'll check pages that don't work in IE (9 times out of 10 they don't work there either), and I could be gamed into seeing a page that doesn't work, switching over to IE, and then being sent by javascript (which detects my browser) to a gopher exploit.

Correction (Re:Gopher support shouldn't be in IE)

[Simon Brooke]

MS-PITY... Microsft Protocol for Internet TechnologY

No, you've got that wrong: it's MS-PITA, the Microsft Protocol for Internet Telecommunications Access.

== firewall Re:Protocol manager

[leuk_he]

Mod this ac up!

Destroying the village to save it

[Sloppy]

(MS dropping gopher reminds me of an old BASIC joke...)

Ready

LOAD "FOO"

Ready

RUN
?Syntax Error on line 45

Ready

45
RUN

Re:You're wrong.Bill Gates is nothing like a valky

[subgeek]

valkyries aren't neccessarily loud and fat. They were beautiful women. They became known as loud and fat as a result of the hefty opera singers who played the part of the valkyries in wagner's operas.

but that being said, i'd still say that bill gates does not resemble a beautiful woman by any stretch of the imagination. Ballmer doesn't either, but maybe you remember that he did demonstrate his musical talent by dancing. possibly not what wagner had in mind.

Nononono....

[RegularFry]

No conspiracy, just the fluid nature of software. It always expands to fill the available container, which in this case is the tolerance of the user to the software being slow. New software puts pressure on this barrier as the developers get new hardware, and, at a certain pressure, the user gives in and buys a new!faster!better! computer. The developers will (unless they have other specific goals) create software that is at (or below) their tolerance limit on their machine, but now, knowing that the user has the faster machine, needs to buy an even more zippy box because, damnit, developers need the best, because a debug cycle must be slower than an end-user cycle, and it's the debug speed that the developer works to. Can you see the positive feedback loop coming?
The effect of the feedback is increasing because hardware manufacturers aren't going to release new! hardware unless it's faster!better!, but I'm not entirely sure why it's exponential other than that it's a positive feedback system with all real poles that hasn't saturated yet, and that's what they do.

Re:Nononono....

[RegularFry]

I completely forgot my point. My point was that Microsoft and IBM aren't in an explicit conspiracy except as the primary gain generators in the feedback loop. The only reason it's them is because they're the market leaders.

News.com sucks lemons

[billcopc]

As quoted from the M$ Gopher article:

Marc Maiffret, 21-year-old security prodigy and chief hacking officer for eEye Digital Security, doesn't fault old code for security problems. He said that programmers who don't review the code before using it are at fault. Old code may have more security holes in it, but those holes should be caught, he said

Okay, so they're interviewing a 21-year old who thinks he knows more about Microsoft's code than Microsoft itself. Yes it's true, in a perfect world we would all have infinite time to review legacy code and peek into shared libraries, but the matter of the fact is that fundamental reason we reuse code is to save time and effort. If we all spent our time rereading and retesting code whenever we glue it into something else, we'd be better off starting from scratch every time.

This kid is a fast-talking idiot, nothing more.

Microsft goes one to many... FIX for bug here...

[Anonymous Coward]

Just as predicted, news media this week seems to be covering the MSIE gopher root exploit with a new focus on Microsoft and their real problems with security, not just the latest hole. One company even goes as far to say that they 'cleaned up Microsoft's mess, once again'. With 18+ un-patched vulnerabilities in line for a fresh MS-fix, this may be the straw that breaks the camel's back.