Slashdot Mirror
Microsoft Word Security Flaw
JWL-23 writes: "cnn.com is reporting that a Microsoft Word flaw may allow file theft. Furthermore, they plan on not fixing Word 97, leaving millions of users out in the cold. Yet another reason to try OpenOffice.org." It still takes more than running Word to expose the contents of your hard drive though.
Well, that sounds like an excellent motivator to try harder to get it right the first time!
If you want to make an apple pie from scratch, you must first create the universe. -- Carl Sagan
Thank god I downloaded openoffice last night.
My sister's entire school district is switching to it, it's cheap and open source, so theres no "were not going to fix it" crap.
Schools have been sold on the idea that students need to learn the microsoft products for the business world. But I say if you learn open office you'll be able to use office 2000 should an employer some day down the road still be using it.
Chicago2600.net more than a lifestyle, its a survival trait.
I know of quite a few businesses that dont feel the need to pay for an upgrade when Word 97 does everything they need. There's no incentive to upgrade. (Even now, because they don't use the document protection features)
Seriously, I would like to hear one compelling reason to upgrade from Word 97 to a newer version if all you use word for is word processing and basic mail merge.
It is a shame that software development companies do not have a legal obligation to fix significant flaws...
This lack of responsibility on the part of proprietary software developers is one of the main selling points of open source software. It's so difficult to define what constitutes a "major" problem, and what the seller should be obligated to fix.
Allowing users to steal files obviously falls on the major problem side of the line, but many other problems are in a gray area that is difficult to define. Besides this, most users find that the bugs they consider to be "major" are different than those other users might consider important, based on the way they happen to use the software.
Just another argument for using open-source software whenever you possibly can. If you discover a bug like this and the author isn't willing to fix it, you can always fix it yourself. Why would you ever want to leave this decision to someone else?
First of all making bugs/exploits/whatever known to the public is a perfectly acceptable way of getting the information out to those who protect systems and those who need to protect themselves.
Secondly... are you just grabbing conspiracy theories out of thin air? Where did you even come up with this? I would like to know.
>Well, that sounds like an excellent motivator to
>try harder to get it right the first time!
Name one major software product that has been bug-free from initial release.
For that matter, name one major software product that has ever been bug-free at any point in its lifetime.
-l
Analyst Laura DiDio of the Yankee Group said companies are taking a risk by using such old software, but Microsoft should correct the problem because of its severity.
I am having a hard time getting my head around the concept that newer software equals software with "less risk". I do not understand why a product, open or closed, is inherently more "risky" due to its age. Perhaps she means un-patched old software? Is she advising users of a genuine risk, or is she making the case for a revenue stream and saying that IS Managers who do not stay "less old" in their application selections are jeopardizing their companies? Although she admonishes Microsoft to fix the problem, it seems her implication is that said managers are negligent, as opposed to the software vendor who may or may not patch the hole they wrote.
quote from the article:
"Microsoft suggests users view hidden codes in every document they open"
Most people I know don't even like looking at non-printable characters...
While they're at it, they may as well suggest that everyone examine binaries manually before they run them.
"I bet I'll get blamed for this." --Mayor Quimby
I receive documents for review and editing from up to 400 different people -- and I'm not even all that high up the food chain. This would easily work on me -- and I'm very security concious. This isn't like "don't click on attachments from people you don't know" -- it falls more into the category of "don't ever use word and outlook and office for what they're designed to do." (I know -- use OO... When somebody convinces the government to do that...)
I do not read or respond to AC's. If you want a discussion, log in. Otherwise, don't waste your time.
The auto industry is required to make parts available for 10 years past the model year. Makes sense.
Why not apply the same rule to software security fixes? Sure would do a lot to motivate better design.
"play up what a nightmare Microsoft malware is, and how easy and free OS software is"
No, I'd say use your head and give some insightful advice, rather than spout off like a ranting zealot. Don't "play up" anything. Give the truth.
Don't lie about how easy it is to install and configure the OSS equivalents. Don't pretend they're going to be 100% compatible. And in gods name, stop with the "microsoft owns your soul" rants. Once that user realises you lied, there goes your credibility, your 'stroke'. Next time they'll ask for advice from the kid at the counter of the local Office Depot.
If OSS is going to 'empower' people, it won't be through a bunch of FUD and politics. Let it sink or swim on its own virtues.
This isn't a message directed at you, but rather to all who want to actually help open source be taken seriously.
I don't need no instructions to know how to rock!!!!
FTA:
But, referring to Microsoft engineers, McGee said "there's only so far back they can go."
No. There's only so far back they WILL go. There is a HUGE difference. Microsoft has CHOSEN not to support it, it's not that they can't.
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Agree with the principle, however a Rare chance at file theft and a FATAL FLAW in an automobile are not even close to realistic comparisons...
Razzious Domini
I could be a GREAT KARMA WHORE if I could just shed the few morals I have left.
The logic of this eludes me.
If you are using Word97 and somebody else is using WordXP. The other person will get the patch.
Opensource software now...
You are using KDE1 and somebody else is using KDE3. Security Hole X that is in both. KDE3 will get 'patched' or at least fixed, I doubt that KDE1 will get fixed. The only benefit here is that you could potentially fix it yourself, but if you are using KDE1 i doubt you really would.
What we see depends on mainly what we look for. -- John Lubbock Now search for that bug slave!
Just my 2c!
"I'm a leaf on the wind. Watch how I soar."
-Hoban Washburn
That would be a great change to software copyright. Give software full copyright protection as long as it is supported (supported being defined as helpdesk support and maintenance). That way, MS (or any software maker) would have stand by the software that has been purchased instead of abandoning it like yesterday's newspaper.
When MS drops support for Word 97, Windows 95, DOS, or whatever other package, then that version should be free to copy. We still have many machines where I work that use Win 95/Office 97 (new Machines get Win 2K and Office 2K) and have apps out in the field (point of sale) that use DOS 6.22 and Desqview. We still have to license every PC that is used -- why shouldn't we get support if we are shelling out $$?
Beware of Sleestak
I write very basic Visual Basic scripts to automate the transcrition process for a large hospital. Miscosoft Word is completely insecure. Every Word document can contain one or more large complete applications that can interact with the internet, the network, a user's computer etc. Even with my very limited and basic knowledge I could (and have) accomplished the above. Every transcribed document in my department of this hospital is full of my code. If I was a certain type of person, the danger to patient privacy and confidentiality would be immense. I'm not like that but the idea that companies, hospital and governments world-wide use use Word on a daily basis is rather unsettling. I can only image the explots that someone who A) really knew what they were doing and B) lacked ethical standards could accomplish.
In the same week we wondered why Miscrosoft was making HP/Compaq kneel and beg to "be able" to provide MS Windows with each PC. (rather than Microsoft thinking themselves "lucky" to be moving so many copies of their software)....Along comes this as to where Microsoft may refuse to patch Word 97. Now I personally know of quite a few fortune 500 companies that are still 100% Word 97.....Would not this size and (clout) of a user base still warrant security patches to serious holes? (Well for most software companies it would -- but Microsoft's relationship..err..monopoly with their customer base in almost 180 degrees from everyone else.)
(+1 Funny) only if I laugh out loud.
Could a SlashDot editor please include this info as an update to the story?
I'd ask that it be modded up but its already maxed out.
Work for Change & GET PAID!
What, you mean linus still produces patches for 1.1.x? Or that samba still fixes holes in 1.8.x? Or that apache still fixes holes in 1.2.x?
<grub> Reading
You're confused: Microsoft released the bug. Qualcomm just did a little free QA.