Slashdot Mirror

← Back to Stories (view on slashdot.org)

Visual Studio .Net: Now with more Viruses

Posted by ryuzaki0 on from the trustworthy-computing dept.

News.com breaks the story (and 8000 readers submit) that Microsoft distributed Nimda-infected copies of Visual Studio .Net in Korea. I don't even know what to say here; nothing seems adequate, except to point out that "trustworthy computing" does not seem to have had any effect whatsoever. News.com just updated their story to point out that it probably won't infect the people who installed Visual Studio .Net, but it's still a rather nasty faux pas for a company that's supposed to be cleaning up its act.

18 of 396 comments (clear)

  1. So.... by Jacer · · Score: 5, Funny

    Did McAfee or Norton give this press release?

    --
    --fetch daddy's blue fright wig, i must be handsome when i release my rage
  2. Microsoft should be applauded for this by Saint+Aardvark · · Score: 5, Funny
    They...um...made sure that it was a quality worm that went out the door.

    None of your shoddy open-source crap here, no sir!

    --
    Carousel is a lie!
  3. Not entirely Microsoft's fault by 1000101 · · Score: 5, Insightful

    The "third party" that translated the software into Korean had something to do with the problem.

    1. Re:Not entirely Microsoft's fault by timeOday · · Score: 5, Funny

      So how do we tell "Genuine Microsoft Quality Products" from "Shoddy Software Created By Third Parties And Put Out By Microsoft"? Is the hologram a different color or something?

    2. Re:Not entirely Microsoft's fault by Jason+Earl · · Score: 5, Insightful

      That's a load of hooey. Microsoft's customers didn't ask them to use a third party to translate the files, nor did they purchase the product from the third party. If Microsoft can't even handle the elementary security step of scanning the product for viruses before putting it on a CD, how do you even know that the mysterious third party isn't replacing important DLLs with DLLs that are functionally equivalent but have a hidden backdoor.

      Clearly Microsoft isn't really checking these files. Which means that when Microsoft says "Trustworthy computing" what they are really saying is that you should trust them, and all of their "third party" allies despite the fact that they have a horrific track record.

    3. Re:Not entirely Microsoft's fault by chris_mahan · · Score: 5, Insightful

      [This post contains language you might find offensive]

      Isn't Microsoft entirely in control of selecting the vendor (the translation/locatization company)?
      Would Microsoft be liable if the translator had said: Fuck you and You Eat Dog Now in the manual? Of course.

      Another silly analogy. My VW beetle was assembled in Mexico. Do you think VW says: "Oh, sorry, those damn mexicans screwed up?" when I have a problem with my car? No. They say: "We're sorry, and we'll fix it right away at no charge".

      They don't even mention the outsanding factory workers south of our border. They just take it like men and deal with it responsibly.

      That's why I prefer VW service over Microsoft's.

      --

      "Piter, too, is dead."

  4. Give it a rest by Anonymous Coward · · Score: 5, Insightful

    Slashdot is rapidly becoming useless with the constant derision it heaps on Microsoft. Let's have more computer news and stuff about FreeBSD and Linux and less "make fun of" news about Microsoft. As if Linux doesn't have it's problems. You might end up like Larry Ellison and his ridiculous "Unbreakable" claims.

    Of course, that's a problem with the Linux crowd. Feer of being, and being seen as, professional.

    1. Re:Give it a rest by namespan · · Score: 5, Insightful

      I don't know where to start.

      Slashdot is rapidly becoming useless with the constant derision it heaps on Microsoft. Let's have more computer news and stuff about FreeBSD and Linux and less "make fun of" news about Microsoft.

      Slashdot is hardly rapidly becoming useless. There is no lack of abundance of news about FreeBSD, Linux, Apache, Space, OS X, Wireless, and just about any other significant I/T and geeky topic.

      And while Linux has its problems, and you may not share the editors views about Microsoft, there are two facts about Microsoft that are hard to ignore:

      1) They are huge. Absolutely huge. They have a lot of influence in the I/T and software industry.
      2) Sometimes their market presence and control gives them reputation beyond what's deserved.

      You may not agree with #2, but consider: .NET barely exists right now. Their ads make it look like people are running serious production solutions on it right now. They claimed months back that Trustworthy Computing was their #1 priority. They just made a major gafe. They've ignored simple security problems for years because it suited them.

      I wouldn't claim their technology is useless. It has its high points, a few better than open source alternatives. The problem is that it's all too easy to fall into "They're big, they're #1, so it must be the best" viewing of Microsoft. Most of us who bring up reports like this one do so because we've put up with far too much of that kind of reasoning.

      As if Linux doesn't have it's problems. You might end up like Larry Ellison and his ridiculous "Unbreakable" claims.

      Of course, that's a problem with the Linux crowd. Feer of being, and being seen as, professional.

      Well, that wasn't anything like our petty digs at MS.

      Do you mean afraid to make claims like Microsoft's "Trustworthy Computing" initiative and Oracle's "Unbreakable"? I don't see this as a problem in the open source world. OpenBSD is the only distro that comes close to making anything like an unbreakable claim, and it has history to back it up. We speak softly and upload running code. We release timely information about bugs, security holes, and patches. Cover ups are few. That's professional.

      Of course, yet again, it's so easy to confuse "big" and "professional".

      --
      Libertarianism is rich wolves and poor sheep playing gambler's ruin for dinner.
  5. The Cost of Outsourcing by Real+World+Stuff · · Score: 5, Insightful

    According to the Article, it appears that "Microsoft's flagship developer tools picked up the digital pest when a third-party company translated the program into Korean...".

    Ultimately it was MS's responsibility to verify they did not shit in their own bed, but how many of us look at every line of code in a distibuted or outsourced project.

    Just my $.0199999

    --
    If we don't fight for ourselves no one will.
  6. That's One Degree of Separation! (tm) by elsegundo · · Score: 5, Funny


    Leave out the middleman when it comes to distibuting viruses! Give it straight to your customers!

    --


    The revolution will be televised. Blackout restrictions apply.
  7. Slamming MS by glh · · Score: 5, Informative

    OK, someone messed up.. but it isn't as bad as it sounds. First off, it wasn't MS that put the virus in, it was some third party thing they used to convert the language to Korean. However, MS should have at least run virus scan on it before they shipped it. Second, the person running VS.NET would actually have to install IE 5.5 over IE 6 (why would anyone do that) and browse a certain help file in order for it to get infected.

    I'm not trying to defend MS. Just pointing out the facts (or at least how they were stated in the article). On one hand it's kind of funny to read through all the quick one-liner jokes about MS (definitely worth a chuckle) but I think MS isn't quite as bad as they're being made out to be.

    By the way, anyone know the company that wrote the nimda infected software?

    1. Re:Slamming MS by _xeno_ · · Score: 5, Informative
      Actually, according to the article at least, Microsoft did scan the files for viruses prior to shipping. However, they apparently have it set up to only scan files that they expect to be there, and therefore missed the added Nimba file. The way I read it, the Nimba file is not really part of the package and can never be accessed in normal usage of the product, and can only be accessed if the user goes looking through the actual help files that come with the system.

      Assuming that by "help files" they mean "VS.Net Documentation" then there are quite a few help files covering everything from JScript, VB, C#, C++, to the Windows Platform API, the C# class library, and more - which means it'd be practically impossible to manage to find the one Nimba file amoungst the croud. However, if they just mean tool help, then that content is a lot more limited, but I somehow doubt that is the case.

      I have to wonder how much about that "scan only files that should be there" is really spin doctoring, and if they didn't really scan the disk and are instead coming up with an excuse for having missed the presence of the file.

      Anyway, the Slashdot writeup is, as usual, way overblown in its anti-Microsoft slant. If they're going to write tirades about McAfee scaremongering, then they probably shouldn't do it themselves.

      (And, by the way, Michael is the author of both articles...)

      --
      You are in a maze of twisty little relative jumps, all alike.
  8. Maybe a re-brand? by rfsayre · · Score: 5, Funny

    Viral Studio .NET??

  9. DOJ Take Note by Paul+Lamere · · Score: 5, Funny

    This is just another example of Microsoft trying to bundle everything with windows. Now that they are bundling Nimda, Melissa is going to go right out of business.

  10. Life Imitates Art by Kozz · · Score: 5, Funny

    Truly, life indeed imitates art(satire). Microsoft Bundles Worm with IIS .

    --
    I only post comments when someone on the internet is wrong.
  11. Re:What... the... hell.... by Ooblek · · Score: 5, Informative
    You should have realized it was a joke - however lame it was.

    By the way, this is just another example of a premature attack by OS zealots. Just as the case of the cross-platform virus discussed previously, the Nimda file is installed as part of the help system, but is never loaded by the help system. As the tounge-in-cheek editorial posted by the illustrious Slashdot editors put it, "Only a complete moron would get infected by this virus." So unless someone in Korea is stupid enough to uninstall IE 6.0 (required for .Net to run), install IE 5.5, and then load the Nimda file, it is unlikely that they will get infected. For every MS goof, there is an equal goof in the OS community. (But we all know people that point that out get modded down....)

  12. Cool! Virus Free! by Cheap+Imitation · · Score: 5, Funny
    Leave it to Microsoft to change the meaning of "Virus Free".

    Now, instead of meaning it ships with no viruses, it means they include them at no extra charge!

  13. Re:Just another reason to complain by Jason+Earl · · Score: 5, Insightful

    You are missing the point. The problem isn't really that Microsoft is shipping a virus (although you have to admit that this is pretty darn funny). The problem is that Microsoft is shipping files that they don't know about. This file could have been anything.

    Microsoft has set up their business so that their customers have to trust them. There is no way for Microsoft's customers to verify that Microsoft software is safe. Yet time and time again Microsoft has shown that they simply are not particularly trustworthy. It has gotten so bad that it isn't just /. that is laughing at Microsoft. This particular story was published by CNET (which is a very Microsoft-friendly news source).