Slashdot Mirror
Windows 98, Me, NT4, 2000 and XP SSL Flawed
JoeSmack writes "In amazingly unexpected news, ComputerWorld is running an article that says the
SSL security hole found in Internet Explorer is not a flaw in the browser, but in the operating system itself." The article mentions
that Konqueror was patched against the same bug in 90 minutes.
Sweet time? Indeed, saying that the Konquerer team fixed it in 90 minutes makes them sound very irresponsible, not proactive : Every change like that can have hundreds of ramifications, and I assure you that there is a programmer at Microsoft who could point to a particular segment of code and say "There, we just need to change that line right there". But after several high profile incidents where someone did a change and it broke a dozen large applications, they seem to be a lot more weary about that nowadays. Working in software development, I've seen many situations in large systems where someone wanted to rush out an incompletely thought out feature or fix and the net result was disaster.
You do have some valid points that should be addressed and probably will be over time. But, lest we forget, this bug was reported to Microsoft a very long time ago. Furthermore, MS has not been trying to fix the bug. Instead they chose to try to place the blame on Verisign.
Regardless, of whether Verisign should shoulder some of the blame or not, Microsoft simply dismissed a potentially serious problem. A week later, we find out that, not only is it Microsoft's problem, but it is in the OS itself not just the browser like we had thought. Conversly, KDE was able to identify the problem and produce a fix in 90 minutes.
Now, to your point about the availability of the patch to everyone, as I said you have point. But, if you check out KDE's site you will find that they clearly state that they do NOT distribute binaries. KDE distributes source code only and that patched source code is, and has been, available. KDE leaves binary distribution up to the distros to handle. So, Suse and Red Hat et al need to step it up a bit but, KDE did a great job!
The BugTraq post describes the nature of a MOTM exploit using this vulnerability.
A BugTraq reader was able to successfully demonstrate this using dsniff and OpenSSL as his tool kit. Screenshots on his site illustrate this, with his own bank account!
"Flyin' in just a sweet place,
Never been known to fail..."
How many people out there are REAL Windows Admins? Seriously? I bet not that many are true windows admins. Using windows does not qualify you as an admin. I'll admit I'm very weak on my nix admin but that's because I don't bother learning about it. In my mind Windows 2k can be just as good an OS. I bet many of you don't know that Microsoft's knowledge base acutally keeps track of all it's bugs and patches for them before they stick it on Windows Update for the rest of the masses. I bet many of you don't know that microsoft has a tool called hfnetchk ... what does it do?.. It'll download the LATEST patches that microsoft has available for you to use. It'll check your system to see what patches are installed and what aren't and give you a report telling you which article # in MS knowledge base you can find the patch for you problem. More tools you want?... How about Qchain... (which i know many of you don't know about either) that lets the user install multiple patches WITHOUT rebooting your system multiple times. For IIS Windows has IISlockd .. which many wanna-be admins didn't bother finding out during the time when nimda worms were going crazy. And the list goes on I can easily list pages worth of other tools that windows has that most people don't know about because they're ignorant. If anything I'd say windows has done a wonderful job by making people lazy.
But let's take a step back. I bet many of you are saying pfft the Nix machines have this and that tool. Think about that for a moment.. why would a multibillion dollar corporation, who have a million times more resources then the average linux programmer, not bother to make a similar tool for windows if it's so useful? Kinda defies logic doesn't it especially since nowadays with IBM's backing of linux MS needs to compete performance and feature wise even more (or are you going to tell me that MS has a stranglehold on IBM?).
So before anyone else goes on with the typical. . "wat you expect form MS"
read up about what MS really has and acutally maintain an intellectual conversation