UCSB Bans Windows NT/2000 in the Dorms

nick58b writes "The people in charge of the networks for all of the on-campus dorms at UCSB banned the use of Windows NT and 2000 on their networks citing security and network problems associated with them. While there are problems with NT/2000, Windows 98 and ME computers are still permitted. Students using these are "recommended" to upgrade to XP Home Edition. In other news, sales of Windows XP are way up at the campus bookstore."

Comments

What a scam

[jameslore]

Permitting Win98 and denying Win2k? For all it's faults, it's not as bad as the 9x series of exploits. Plus with Win2k up to SP3, it's likely more secure than XP.

Methinks someone wants to make some money...

Re:What a scam

[Anonymous Coward]

In related news, UCSB will require students to use ONLY textbooks from 1960 through 1975.

Re:What a scam

[madsenj37]

2000 back to 98? One step forward and three steps back.

Re:What a scam

[RAMMS EIN]

``Permitting Win98 and denying Win2k?''
That's what I thought... NT and NT-based versions support NTFS, which allows setting permissions on files for individual users, which should make the filesystem at least as secure as it is on UNIX systems. Of course, running as super user defeats this protection scheme, and I think many Windows users would indeed surf the web, check their mail, etc, from an administrator account.

Now of course the 9x series weren't designed with Internet access in mind. They don't have real multi-user support, so their filesystems are unprotected. However, their networking implementations aren't as deep in the OS as tehy are in NT systems. I could see how this could limit some damage. I still think it strange, though. Maybe 98 is less buggy than 2000 because it's simpler? Ah... the old KISS principle...

Re:What a scam

[Saxerman]

Permitting Win98 and denying Win2k? For all it's faults, it's not as bad as the 9x series of exploits. Plus with Win2k up to SP3, it's likely more secure than XP.

Methinks someone wants to make some money...

For the most part the trouble is not 'as of yet undiscovered security flaws' but known problems that go unpatched. Microsoft or otherwise no OS is 100% secure, so what does UCSB hope to gain by 'encouraging' their students to switch? From the article it sounds like they got burned by holes in win2k in the past so now they're afraid of it?

"While we understand that it is possible to run a secure Windows 2000 environment, past history has shown that this rarely happens on ResNet."

So, uh, why not? Sounds like that's going to be your real problem regardless of what OS you enforce. Unless the problem is the school bookstore has more of a markup on 9x and XP than win2k?

Re:What a scam

[MtViewGuy]

You're right about that!

Windows 2000 Professional with its Service Pack 3 and McAfee AntiVirus 7.0 (antivirus + firewall) is actually a reasonably secure OS setup.

Re:What a scam

[mpe]

Permitting Win98 and denying Win2k? For all it's faults, it's not as bad as the 9x series of exploits. Plus with Win2k up to SP3, it's likely more secure than XP.

Since XP is newer it's exploits are less likely to be known about by the "white hats".

Re:What a scam

[jasonla]

This has to be my favorite quote from the article.

"Our experience from last year shows that students either didn't know how [to protect their computers] or didn't care," said ResNet Coordinator Curtis Kline. "We could come up with a document that would explain how to secure Windows 2000, but it would be beyond most students."

Re:What a scam

[Dalcius]

Sorry if this is redundant, and I hope to God it doesn't get lost in the crowd.

I'm hardly familiar with remote-exploit holes in Windows. Can anyone enlighten me on why 98 is so insecure by default? =\ I'd be interested in any links or whitepapers or whathaveyou.

As to holes relating to the fact that all programs have 'root' access, that's obvious, but most folks seem to run their windows boxen as admin anyway, so I still don't see why 98 is worse off.

My impression is, the more complex (e.g. the more services) Microsoft software gets, the more holes the size of mac trucks will be present. I would think XP would be the worst out of the lot at this point (well, besides an unpatched NT4 server, hehe).

Am I way off?

Re:What a scam

[BlackHawk-666]

There's a ton of reasons why it's less secure, so I'll just cover a couple to give you a taste. 1. Although it asks you to log in before use you can just press ESC to bypass this and have complete access to the machine. 2. Anyone can change any file and there is no record of the action. 3. No firewall by default (most OS's don't but at least linux encourages you to use one). 4. It's not really supported anymore so any exploits out there are likely to remain in action forever. The only blessing for Win98 is that it has lot's less internet connectivity out the box. So, although it's piss easy to screw with if you have console access, there is less to attack with internet access. i.e. without FP Extensions, FTP, SMTP and Web Servers installed by default it is slightly more secure than the defaults with Win2000 (which now have well known hacks unless you service pack them). Students are unlikely to know they need to keep service packing their machines.

Re:What a scam

[Anonymous Coward]

1. Physical access = full access anyway, even an encryptet harddrive can be "formatted" with a reasonably big hammer.

2. If they have access (local or otherwise)

3. No open ports = nothing to firewall.

4. Any remote-root exploits, or just the usual remote-BSOD exploits?

Re:What a scam

[AvitarX]

It's kind of funny, because NT and 2K are both "professional" products you woluld think they would have the more savvy users (enthusiasts), but apperently not.

Re:What a scam

[octalgirl]

From a public school perspective, Win2k was a nightmare. Forget security, we didn't even get that far. If someone so much as tried to 'install on first use' the equation editor, administrator password was required. Or configuring their own Outlook (after they had been doing it themselves for years)- impossible - and they called that zero-admin? Sure, make everyone else the administrator and you won't have to do anything anymore.

Norton corporate script wouldn't run (admin pass again); trying to install one single lab printer so every student who sat at that computer would always see the same printer, impossible without scripts or pushing profiles. This increases the amount of training required for students to use the equipment, or takes a net admin away from LAN/WAN support and puts them in script/profile land. An english teacher just wants to bring a class in without any hassle or setup. Our legacy or propriety software apps - most wouldn't run without admin pass. And why the hell would we want to teach a bunch of students about CTRL-ALT-DEL to logon? I remember when Microsoft used to brag that was a great security feature. Do they really think everyone is ready to handle their own server? Just crazy. We stayed with 98 on desktops and used Win2K on servers. We are finally moving into XP, which is much easier to handle, and much easier to train 5000 users on.

Re:What a scam

[AvitarX]

" 1. Physical access = full access anyway, even an encryptet harddrive can be "formatted" with a reasonably big hammer.

2. If they have access (local or otherwise)

3. No open ports = nothing to firewall.

4. Any remote-root exploits, or just the usual remote-BSOD exploits?"

there is a way to ignore file sharing passwords on 9x, though at the university I go to all shared stuff is just MP3's for no password anyway.

Re:What a scam

[PainKilleR-CE]

Now of course the 9x series weren't designed with Internet access in mind. They don't have real multi-user support, so their filesystems are unprotected. However, their networking implementations aren't as deep in the OS as tehy are in NT systems. I could see how this could limit some damage. I still think it strange, though. Maybe 98 is less buggy than 2000 because it's simpler? Ah... the old KISS principle...

I'd think that 98 and Me are probably more complex because they were built on top of 95, which was built on top of DOS, rather than being built on top of NT. I could be wrong, though, as NT might be more complex from the start. It seems to me, at least from reading between the lines, that IIS might be the problem more than anything, as it takes a bit more work to install PWS on 98/Me than IIS on NT4/2k, based on the following statement from the posted 'article':

Residents' computers were compromised with several well-known vulnerabilities and used for all manner of unfriendly purposes such as the installation of viruses like Code Red and Nimda on other residents' computers, denial of service attacks, and port scanning.

Code Red and Nimda both can attack the 9x line, but Nimda specifically attacks IE, Outlook, AND IIS, which means that an NT/2k install with IIS enabled has one more open door. I really don't think it justifies it, as they could just state that any IIS installations found running on their network will be blocked, but it's a point in their favour. Otherwise, in general I'd look at requiring the latest service pack on 2k and drop NT4 and 98 (if not Me as well) from the network, given that both NT4 and 98 are close to the end of their supported life. All of that being said, I wonder how they've done with the recently publicized Linux exploits, most of which were similar in nature to these Windows exploits in that they were patched before the exploits really got underway, yet the affected users didn't bother to update their systems.

Re:What a scam

[Corrado]

Nah, it's more like:

"UCSB will require students to use ONLY textbooks published in 2003 which you can conviently purchase at the UCSB bookstore." :)

Re:What a scam

[TheStruuus]

Hmmmm.. my school just locks your port when you start DOS or port scanning... I would think this would be a more reasonable approach instead of banning an OS..

Re:What a scam

[innerlimit]

what if you run OS X? or even OS 9? or *nix do you HAVE to switch?

(too lazy to peruse the article)

Re:What a scam

[GlassUser]

Eh, sounds like you need an admin that knows what he's doing. I administer a lab that's used by doctors (read: no computer knowledge). Office installs features on demand without any input required. You can configure outlook to your heart's content. Each computer has an assigned printer, but users can connect to any printer they're allowed access to by themselves.

The legacy/proprietary app thing is not my problem. Legacy, easy, it wasn't made for a modern OS. Maybe it still makes the API calls right but they didn't understand the way the security framework was going. The proprietary issues are because you hire stupid software developers. Use the API or environmental variables to locate paths instead of hardcoding "c:\winnt\blah". Don't expect write access to anything in \bin. In short, use skills that aren't five years out of date.

Re:What a scam

[elphkotm]

You just need a translation... Professional = for Warez Monkeys.

Re:What a scam

[delta407]

From a private school perspective, Win2k is great. I don't know how you deployed software, but I don't leave anything to "install on first use" -- it's on the hard drive, on the network, or not available. (Microsoft makes tools that let you customize, say, the Office install; no serial number needed, no I Agree on the license agreement, and no Clippy if you so desire.) As far as configuring Outlook 2000, it can be done as a normal user, with the exception of "mode" (Internet or Corporate) which has to be done as administrator but can be done in the base system image. (You do image your clients, right?)

I don't know what product you're talking about, but Norton AntiVirus Corporate deploys cleanly (via Group Policy) without issues to speak of. The lab printer scenario is a little more complicated, but if you don't want roaming profiles, you can set a mandatory profile and give users a network home. The mandatory profile can include the printer. As far as legacy or proprietary apps go -- open regedt32 or Windows Explorer and change the permissions until it's happy. Then, change your deployment system to do that automatically: problem solved. Don't like Ctrl-Alt-Del? Disable it via Group Policy.

I don't like Microsoft, but things are far more usable under Windows 2000 than most people would think. Get some network imaging software, reasonably standard desktop hardware, and a Windows 2000 domain with appropriate Group Policy entries. It's really not that bad.

Re:What a scam

[astinus]

Sure that may be a secure setup, but how are you going to force 1000+ (estimated) users to download SP3 and buy McAfee 7.0? I seriously doubt too many college users have the savy to know they need these additional things. Ain't gonna happen.

Re:What a scam

[Anonymous Coward]

There's a ton of reasons why it's less secure, so I'll just cover a couple to give you a taste.

I guess I should have mentioned, I'm a computer programmer... I'm not new to the area. =) Possibly just ignorant.

---
1. Although it asks you to log in before use you can just press ESC to bypass this and have complete access to the machine.

One of the things that amazed me about the earlier versions of windows was the login. It essentially seemed to me that it was the work of a 14 year old hax0r who wanted to show his friends how k3wl he was because he could write a logon that, apart from show and to give a feeling of security, was useless (well, maybe individual desktops was a good point, but the password was useless past stopping dumb users).

---
2. Anyone can change any file and there is no record of the action.

True, but this is normal. You can set up log and config monitors on Linux, but then again, I'm sure they have those tools for Windows as well. The Norton registry tracker (correct name?) comes to mind.

---
3. No firewall by default (most OS's don't but at least linux encourages you to use one)

Very true, but what is there to protect? Once the user installs programs, yes, but besides user permissions, this makes it no different from 2K, etc. etc.

I'm still not convinced. I can see the inherent flaws in a system without user priviledges, but as I said, it seems to me that most folks run as admin anyway. It seems that with what I've heard from folks so far, it's still the rule of simpler is more secure.

Re:What a scam

[Dalcius]

there is a way to ignore file sharing passwords on 9x

I read about something in the NT4 SMB server that allowed a crack as follows:

When logging on to a 'secured' (heh) share, the password was sent along with the length of the password. The server would only check to see if the submitted password matched the real one up to the length submitted. Thus, send a length of 1 and brute force every possible character.

Two questions:

1) I read this in one place and I'm not sure whether this is correct. I haven't tested it. Can anyone corroborate this for me?

2) If 1) is true, which systems does it affect?

Excercise for the trolls on Win 9x: start > run > \\your_shared_dir\con\con (hope I remembered that one correctly).

I love how "keywords" can BSOD a windows box. They don't even *check*....

Re:What a scam

[Anonymous Coward]

"(too lazy to peruse the article)"

Then eat shit and die.

Re:What a scam

[Anonymous Coward]

Actually, McAfee AntiVirus/Firewall don't work as well as they lead you to believe. Having worked in their technical support, I can attest to the weakness of their software.

Re:What a scam

[Anonymous Coward]

But that reasonably secure OS setup still has the ability to install and run IIS. This is probably the reason why the sysadmins are banning Win2K and NT; one can no longer install their own IIS web servers. With all the users having 9x/ME, sysadmins rule out the possibility of an IIS problem. I see that solution only as a last resort though.

Re:What a scam

[Sj0]

That's actually what's wanted. The whole idea of administrator accounts is to ensure that users can't do things like install software. This is especially important in public schools, where the users are children who will install things like kazaa and games. There is the odd time where a user needs to install software legitimately, but more times than not, it will be students installing software which will waste bandwidth, fill up server space, and make your network a target for the upcoming MPAA DoS attacks.

Sure, there's a learning curve -- but more for the administrators. Instead of installing on first use, install all of office to the hard drive. It takes a little longer, but then you don't have to worry nearly as much about dealing with shares and stuff.

Of course, I'm just speaking from personal experience at the school I'm working at right now, so the circumstances might be completely different at the school you're working at. I can relate to having a group of people who are violently "not computer people", so perhaps in this situation, win98 was the best choice...but I hope to god you're at least behind a NAT. :)

Re:What a scam

[Anopheles]

From a public school perspective:

About the only thing we don't do for our students that you're doing is installing Outlook. We depend on the web-based mail client for that.

* We use Norton Antivirus Corporate Edition, and no administrative password is necessary for what we do.
* We have a method of installing printers so everybody sees the same ones- no scripts or profiles needed, it requires 3-4 extra steps per printer. Contact me if you want to know how.
* Ctrl-Alt-Del is the only option on campus. It's amazing what students will pick up when they're given no options. :)

It is definitely more work to do this from the beginning, and if recent budget constraints are not working in your favor, it is nearly impossible to change. However, we feel that our students benefit a lot from having a single login id, a single password, and secure access to all their network resources from anywhere on campus.

Re:What a scam

[Stonehand]

Win2K includes a link to "Windows Update" in the Start Menu, and they've (probably) got the bandwidth to download it... 10BT NICs are cheap these days. MSFT will cheerfully tell them about SP3 or other updates through that service (and if they leave "Critical Update Notification" or whatever it's called on, it probably periodically polls MSFT to check.)

As for McAfee and similar, they'll learn once their friends start mailing them attachments...

Re:What a scam

[Safety Cap]

3. No open ports = nothing to firewall.

Win 98 usually has port 137, 138, and/or 139 open by default.

Re:What a scam

[banzai51]

That depends. Are the Win2k boxen here administered by the individual users or the school? If through the school, then put up an Active Directory and push software. If by the individual users, then the problems for Win2k are no different than if they ran Win9x, WinXP, or some flavor of Linux.

Re:What a scam

[Trepalium]

I'll bet it's just students installing NT/2K without an administrator password, and therefore all the administrative shares (\\computer\\c$, \\computer\admin$, etc) are wide open. I really don't believe those administrative shares should ever appear unless you're part of an NT domain, although I'm sure someone would complain if it were ever changed.

Re:What a scam

[Anonymous Coward]

The fact is, that if Win2K is a security issue for the school, they probably already have NICs. That leaves just a few other options, either they haven't added an administrator password, or they are incompetent computer users, or both.

Re:What a scam

[Anonymous Coward]

Yea, for a public school W2k is terrible... I go to school in Onondaga county in CNY. We have the 1st all-W2K domain in the county... Most kids dont understand how a network works... Which poses a problem

Re:What a scam

[ModernGeek]

everyones tech suport is a bunch of morons who need a job, don't judge a company from their tech support, tech support is just a bunch of 30 year olds with no education reading from a book. Companies need to realise that tech support is representing the business to the consumer though.

Re:What a scam

[MtViewGuy]

Psst--the computers connected at UCSB are likely connected to a broadband Internet connection usually faster than what you get at home on DSL and cable modem. At those speeds you can download Windows 2000 Service Pack 3 reasonably quick. And of course UCSB could buy a large-scale license for McAfee VirusScan 7.0 and sell it to students for really cheap (like under US$20 per copy).

Re:What a scam

[octalgirl]

So many points, I'll try to be brief:

Software is deployed from the network (regular admin install). We don't put everything Office-wise in a ghost image (yes we image) because we have a lot of smaller hard drives, and other apps like AutoCad or ARC maps take priority over office. The first version of Win2K DID ask for admin password if a user clicked on an option that wasn't previously installed. Outlook, even pre-configured, asked too. A lot of this was fixed after SP2, but we had moved on by then. And interestingly, these things are now fixed in WinXP.

I know about the profile thing, but I still don't like the fact that I need to write a script to control everything. To take an app like Norton that ran just fine then require you to add it to group policy to get it work again is just crazy. Great option, if it were just an option, but that is the only way to get things working right. On the CRTL-ALT-DEL, we knew we could take it out, but decided if that was they way things were going, why sugar coat it? (Still think it's dumb) For Kazza, etc., - the only thing we found successful here was blocking it on the firewall. Somehow 2K or XP hasn't stopped the kids from finding something somewhere on the net they can install.

On printing, I would really like to know a way around the profile thing (for XP). In 2k there was a convoluted way of installing it, adding it to All User, then giving it full access. Who needs extra steps? It's just a printer - one of the simplest functions a computer can perform. In XP, that seems to have changed and now a little script does the job instead (run at the cmd prompt), but again - why? Why can't it just ask on install 'Is this printer for everyone who sits here, or just for you?' Third party apps have been able to do that since NT 3.5, why can't Microsoft do it for themselves? Overall the security flaws found in either Win2K or XP really don't affect us. We are not some secret lab that needs to keep things that locked down. Keeping kids from tearing up the desktops, and away from DOS is all we really need, and group policy handles that ok enough. A college of course has to worry about IIS and such.

Rant over (so much for being brief). But thanks for all of the good tips.

XP printing script:
rundll32 printui.dll,PrintUIEntry /ga /c\\%1 /n\\%2

At cmd:
scriptname targetcomputername printerservername\printersharename (done at every workstation)

Re:What a scam

[silentbozo]

At UCLA VShield is a free download to campus users (staff, students, faculty) and is recommended. I assume they paid for a site license, and since it's free, it makes sense to install it.

Re:What a scam

[Anonymous Coward]

Obviously you never heard of Windows Installer and Group policy...

As for "Forget security, we didn't even get that far." Security starts as soon as the OS is installed. Putting it on the backburner is asking for trouble no matter what OS you run.

People who make half hearted attempts at managing an OS should not complain, They have only themselves to blame.

Re:What a scam

[Latent IT]

10BT NICs are cheap these days...

I give up. I've been trying to figure out why you said that, but I can't. I'll just take this opportunity to point out that it's pretty hard to exploit a machine that doesn't have a NIC. ;p

good ol' campus LANs

[dotgod]

I remember when I lived on campus I used to get a kick out of busting out with a "NET SEND ALL blah blah" command. Good way to annoy everyone with an NT box. Of course I'm sure this isn't the reason they banned NT/2k since it'll automatically pop up on XP boxes too. The funniest thing I did with NET SEND was to send out a message asking all the single ladies to IM my roommate.

Re:good ol' campus LANs

[Ted_Green]

Yeah.

Windows messaging service was fun. One would have thought they'd disable it, but no. Local security permissions were bogus too, since they'd simply ghost the machines and reinstall the default image each week.
I think they finally got the picture when after a night of drinking we broke into the lab and made all the computers there execute the following script on startup: :1
net send * jesus loves you %username%
goto 1

Re:good ol' campus LANs

[Zayin]

The funniest thing I did with NET SEND was to send out a message asking all the single ladies to IM my roommate.

So, did he get laid?

Re:good ol' campus LANs

[dotgod]

So, did he get laid?

No, actually he got a bunch of IMs from guys who were pissed of because they thought he was the one who kept sending the popup messages. He came closer to getting beat down than anything else.

Re:good ol' campus LANs

[Anonymous Coward]

It's "net send *" not "net send all"

Heh. It's funny how other people also pretend to know what they're talking about and refer to the latter also.

Re:good ol' campus LANs

[HillBilly]

That reminds me of college a few years ago. Some silly little kid thought he would send a message to his friend next to him, instead he sent it to every computer. Of course the address was included in the message. (The address included building, room and the computer number.)

Within 1 minute that kid was out of the class and had half a dozen teachers and admin staff looking down on him. His face had drained of all blood and I think he needed a change of underwear.

Re:good ol' campus LANs

[Dynedain]

because I'm betting there were a lot of single ladies running winNT/2K

Re:good ol' campus LANs

[tweakt]

I would have had them IM me! Why should your roomate have all the fun ;-)

Re:good ol' campus LANs

[tmark]

Getting beaten up by a bunch of computer geeks (who else would run NT instead of one of MS' consumer OSes) - Now THAT would be embarassing.

Re:good ol' campus LANs

[Anonymous Coward]

(who else would run NT instead of one of MS' consumer OSes)

Obviously you're a moron, thanks for confirming it with this parenthetical

AC

Re:good ol' campus LANs

[dotgod]

Actually a lot of the dell boxes sold by the computer store at the beginning of last year had Win2k on them. The message would also pop up on XP boxes.

Re:good ol' campus LANs

[tezzery]

suuure, your 'roommate'

Re:good ol' campus LANs

[donutello]

Yeah! And that's why they were single!

Just typing some crap here to satisfy Slashdots lame lameness filter which doesn't recognize that intelligent comments can be made in less than 15 seconds....

I'll be the first to say it...

[dalutong]

Why did they not suggest GNU/Linux, FreeBSD, OpenBSD, etc? Everyone is almost certainly more secure than any out-of-the-box windows install (i say almost because i don't know if i'd trust a lindows install to be secure...)

I just don't get it. I was just at UMBC and they prohibit internet connections from anyone who doesn't have anti-virus software installed.

(you can still get on if you don't, but if they find out you lose your right to get online)

why not just suggest installing a more virus-resistant OS?

Re:I'll be the first to say it...

[redcliffe]

they're trying to sell winxp at the shop....

Re:I'll be the first to say it...

[cscx]

That's not good thinking. Joe User installing Linux would most likely install Apache, wu-ftpd (which is swiss cheese), sendmail (good for spammers) and all sorts of other goodies.

OTOH, Win2k Professional does NOT install IIS by default. In fact, you don't really get many choices during setup... you have to go in after the fact and install it additionally off the CD.

Re:I'll be the first to say it...

[kmellis]

They don't suggest those OSs because they would be even less secure in these student's hands than NT/2K was. The issue isn't one of the essential security of a particular operating system. The issue is that NT and 2K, in contrast to Win9x and XP, include some networking services, by default, that are relatively insecure, by default. It's not practical to attempt to get these relatively naive users to secure their OSs. Also, along with better security defaults on shares and IIS and other things, XP is more aggressively (naturally) supported by MS in maintaining its security via bug-fixes and patches--and they do so via a very aggressive transparent version of their auto-update mechanism. In practical terms, XP Home or Pro is going to be much more secure as installed on this campus residential network than many other OSs. Not because it's "better", and not because it's inherently more secure than other OSs, including NT/2K or a UN*X. It just is because that's how it plays out in this particular slice of the real world.

My problem with this is mostly financial. Obviously, they can restrict usage to their network any darn way they please. But there are inevitably going to be students who simply don't have the money to upgrade from NT/2K to XP. They're imposing a burden on those students that they should try to ease in some manner.

A good alternative would be a carefully crafted Linux distribution that they pre-configure and make secure according to their needs, and make it available on a CD-ROM. Again, though, even if the security issues were resolved with such a distribution (which would be relatively easy), they would still have to face the costs associated with supporting these naive users using Linux--which would probably be more trouble than it's worth. Thus, they simply say, "Use XP".

Keep in mind that in some sense, these types of administrators have less control over their networks than corporate admins do. They don't own the licenses to the OSs--they expect the students to supply their own OS. This gives them a lot less control over what's on their network. They don't have a right to lock the machine's configurations down to control security. They probably don't want to have too much involvement with the student's machines, since that would imply a corresponding degree of liability on their part for how the student is using it (meaning: doing illegal things). It's pretty easy for them to identify the OS that a student is using, so their solution (requiring XP) has the biggest benefit for the least cost.

It is completely absurd for anyone to assume that they are doing this because they have a vested interest in seeing more copies of XP sold.

Re:I'll be the first to say it...

[rainwalker]

That's not good thinking. Joe User installing Linux would most likely install Apache, wu-ftpd (which is swiss cheese), sendmail (good for spammers) and all sorts of other goodies.

You, sir, are misinformed. Unless Joe User goes and hunts down a really old version of any common distro, or deliberately selects a "Server" installation (which is the equivalent of Joe User installing Win2K Adv Server with default settings), neither apache nor sendmail would be installed, and *especially* not wu-ftpd. The default desktop installs of even not-very-recent versions of Red Had, Mandrake, and Suse do not install these services.

Re:I'll be the first to say it...

[Elwood P Dowd]

I say this as if I know it. I don't. This is just what I've heard.

Anyway, the pirated version of WinXP cannot be patched. At all.

The pirated version of Win2k can be patched easily via auto-update.

Once a healthy Win2k worm is developed, UCSB is going to have a lot of hurt due to unpatchable student machines. I did univ tech support with Win2k, and it was cake. XP might have some new dilemmas.

Re:I'll be the first to say it...

[kmellis]

As of right now anyway, what you can't do is apply SP1 to XP. Auto-update works, and all the other non-SP1 stuff words. Eventually, though, you're right in that the large number of pirated copies of XP on campus will end up invaludating some of what I wrote above, and effectively opening up an increasing amoung of security holes. At some point, the problem could be worse for UCSB with XP than it would be for NT/2K.

Re:I'll be the first to say it...

[Anonymous Coward]

You sir, are even more misinformed. Today's large hard drives mean Joe User installs "everything" to make sure that he isn't missing anything. Apache and Sendmail are both installed, and Kmail is set by default to use Sendmail. Additional steps are required to get Sendmail running, but Kmail suggests to Joe User that its needed.

As for Apache, its so simple, even Joe User can do it! At least that's what all the DIY articles suggest. Apache can be set up as a simple way to access/share information among friends, low cost way to promote self/business, etc.! says the DIY articles.

Re:I'll be the first to say it...

[Erbo]

Their user guide says you can use Linux or other Unix OS's, but they're not officially supported. And their news page says:

"For those of you who are using Linux on you computers, your computer may be at risk. Linux and other flavors of Unix are advanced operating systems. If you are going to run Linux you need to keep it constantly up-to-date. Vigilance is required for successful operation without putting yours and others data at risk." [Emphasis theirs]

So I suppose if a student ran Debian, subscribed to the announcements mailing list to keep abreast of security updates, and did "apt-get update/apt-get upgrade" frequently, and was able to prove the above to the ResNet people, they'd be OK.

Re:I'll be the first to say it...

[WebCowboy]

Hmmm... I know a lot of "Joe Users" would install "everything" just to try everything out, but at least in the case of Mandrake for the longest time, even if you installed every package/service they are DISABLED by default, and turning them on at install time brings up a big warning screen listing services that will run when the system powers up, informing Joe that running these increases the risk of security breaches and to take extra precautions. Sure Joe can install it all at once, but if he is dumb enough to click through a screen boldly marked WARNING like it was a Microsoft EULA then he gets what he deserves...

Installing the equivalent in Win2000 Server does no such thing--if Joe were to install everything on the Win2000 CD he would be running open HTTP, HTTPS, FTP, SMTP, SQL server ports etc etc--no warnings about admin accounts with blank passwords, installing latest patches, vulnerability to exploits or so on.

Considering installing a server configuration of either OS is intended for capable server admins, perhaps MS figured warnings were unjustified. However it's nice that Mandrake went that extra mile to allow at least SOME hardening of the OS with a click of a button at install time and warnings of the consequences--and wise too considering their OS is free and accessible to a wide audience.

Re:I'll be the first to say it...

[given_to_fly]

They dont suggest it because because contrary to popular belief the world does nto revolve around us geeks..

the majority of the people on resnet are not cs. i know i went to school there.. there was something like 300 cs majors and 1500 Engineering majors in a school o 15,000+ undergrads.

you try to manage a bunch of freshman sociology majors who are more interested in going down to DP to get drunk then pretty much anything else. Now try installing linux on those machines.
puh-leez.

Re:I'll be the first to say it...

[cscx]

Considering installing a server configuration of either OS is intended for capable server admins, perhaps MS figured warnings were unjustified. However it's nice that Mandrake went that extra mile to allow at least SOME hardening of the OS with a click of a button at install time and warnings of the consequences--and wise too considering their OS is free and accessible to a wide audience.


Could that be because Linux ships desktop and server versions on the same CD, and with Windows, there is a distince difference?

Re:I'll be the first to say it...

[devnull17]

Many colleges (including the one I'm on) have an MSDN academic alliance program, which pretty much lets anyone at the university acquire a copy of Windows XP (as well as Visual Studio,MSDN Library, etc.) for free... LEGALLY! I'm sure that the admins had access to something like this when making the announcement, as telling half of your students that they can't use their computers until they shell out $150 for an upgrade just wouldn't fly.

Re:I'll be the first to say it...

[Anonymous Coward]

Now try installing Windows XP on those machines. Oops, ran into the same problem.

This isn't just plain stupidity

[porkface]

I use Win2k primarily, and prefer it to all other Windows OSes. I know of it's problems and think I can guess what they're referring to and experiencing. But honestly, having worked tech support in the past, if these were honestly their only motivations for making this recommendation, they should be telling students to get Macs, not XP.

We will always see through this kind of bullshit. The best we can do is to educate others without seeming too fanatical to be taken seriously.

Re:This isn't just plain stupidity

[Anonymous Coward]

Buying a Mac is a bit more expensive than paying for a seat on a campus OS site license. It's also more likely to irritate the customers (students). When I was a student, I would not have gone to one of the schools that forced its students to buy a Mac.

Unless Steve Jobs decides to drop the campus pricing on Macs to the $50 range, I don't see your suggestion as particularly helpful.

Re:This isn't just plain stupidity

[PythonOrRuby]

You don't have to force anyone to buy anything. Just refuse to support OSes with chronic security issues.

"You can have your Windows machine, but don't come whining to the Help Desk when you have a virus. We told you how to avoid such things, and you chose not to take that advice to heart."

Legal Implications, hoax?

[phorm]

Are you sure this isn't a hoax? Has anybody verified it elsewhere other than the given URL's?
I could see a whole whack of legal issues of this. It looks like a tough ploy to push students towards buying XP, as it's quite likely a lot of the PC's (laptops etc) won't work in 98.

I'm not sure that "freedom of os" falls in "freedom of choice", but very likely it will be brought up. Out of all the windows, I've found 2k to be the nicest for crashing, and with a lot less security issues than the other MS operating systems.

In other solutions, putting a well configured *nix router or VPN box between the campus and the 2k machines would likely mask what O/S is being used, what info would they be gathering over the network that tells them who is on 2k anyways?

Re:Legal Implications, hoax?

[Anonymous Coward]

it's well publicized on the resnet website, and it was published in the daily nexus (school paper, i have a copy of the article). i'd say it's pretty solid.

Re:Legal Implications, hoax?

[porkface]

Legal issues schmissues. The school owns the network. And if a particular DHCP client or domain controller capable OS does something nasty, they can nix it. And furthermore, they can nix it regardless. Maybe you can have any OS you want in your dorm, just not on their network. Schools have been requiring students to choose particular computers (mostly hardware...Dell, Mac, etc) for years in order to make use of school provided services (tech support, file shares, groupware) with nobody standing up through the courts, so unless you're going to do it, it's not a legal issue. As always, there will be some kids smart enough to skirt the system, but this does affect the majority who don't know better, or who won't stand up for what they do know.

Re:Legal Implications, hoax?

[Anonymous Coward]

Yeah, I go to UCSB and included in my 'move-in packet' for the dorms was a notice that Win2K is banned from Resnet. Yes, it's a bunch of bullshit. I'm not sure how it identifies 2K, but I wouldn't be surprised if it's just through the HTTP user-agent field. You see, before you can access Resnet, you have to do a click-thru agreement via your web browser of choice saying that you'll agree to do the Right Thing, and so forth. People who have attempted to do this with 2K have discovered the click-thru screen is replaced by a notice that their OS is not compliant.

Re:Legal Implications, hoax?

[NeuroKoan]

Its not a hoax. *nix and routers (and I'll assume VPN boxes too) are not explicitly banned, but are severly frowned on (and not supported). Also, your machine gets monitored a lot closer then other machines.

Re:Legal Implications, hoax?

[sigwinch]

The school owns the network. And if a particular DHCP client or domain controller capable OS does something nasty, they can nix it. And furthermore, they can nix it regardless.

Right, just like ISPs. And just like ISPs, if they do annoying and idiotic things, one day they will discover that their rich and/or clueful customers will have disappeared.

Re:Legal Implications, hoax?

[^MB^]

No It's not a Hoax, i read it in the campus newspaper on friday.
Need more authentication than that? read my past posts.

Yes, one of the *nix users could set their box up to forward packets for their friends, but it probably won't happen on a large scale.

-Nick

Re:Legal Implications, hoax?

[AntiNorm]

So spoof the User Agent field then. It's quite easy.

Forced Upgrades

[rollingcalf]

Another tactic from Microsoft to force people to pay for an upgrade to Win XP? I wonder how much in donations Microsoft has given to UCSB.

Sure, some students will choose Linux as a result of this, but the percentage who do so will be small enough that Microsoft still profits from the 95%+ who upgrade to XP, especially since XP will give Microsoft tighter control over their PCs (all hardware changes must be approved by Microsoft!).

Re:Forced Upgrades

[The Bungi]

Yes, I'm sure Microsoft is just salivating at the thought of selling software to a bunch of broke starving students. As we all know, this is the segment of society that tends to pirate software the least.

Oh, and look over there. Some nice black helicopters.

Re:Forced Upgrades

[Queuetue]

Actually, don't you *have* to register XP, due to activation? Forcing this group to upgrade might also force them to actually *buy* windows for the first time.

Re:Forced Upgrades

[rollingcalf]

Well, it is a fact that sales of XP at the campus bookstore are way up. Here's a quote from the article.

The bookstore, which usually sells three to five copies of Windows XP in two to three months, has sold 30 copies in the last two weeks, according to Andy Schramm, student supervisor of the bookstore's computer department.

"Every customer that I've helped that bought the upgrade has bought it to upgrade from Windows 2000 and because of the ban, not because they felt it was time to upgrade their software," he said.

Bizarre

[Mr.Sharpy]

This is such a bizarre regulation. I can't for the life of me understand why they would want the students to us XP Home in favor of 2000/NT. As others have said, the Home edition of XP is if anything less secure than Windows 2000, except for the fact that it excludes IIS. If i remember correctly, XP Home does not even support domain based networking instead using workgroups only.

I can't help but feel like there are other motives here than "securing the network." I don't think it's Linux cheerleading either. Linux is potentially a much much larger security risk when it's configured incorrectly.

Re:Bizarre

[AntiNorm]

I can't help but feel like there are other motives here than "securing the network"

Such as, say, UCSB taking kickbacks from Microsoft in exchange for promising to sell more copies of WinXP...

Ugh.

[SlashChick]

The idiocy of some network admins never ceases to amaze me.

"Residents' computers were compromised with several well-known vulnerabilities and used for all manner of unfriendly purposes such as the installation of viruses like Code Red and Nimda on other residents' computers."

Oh, so you really meant to ban IIS, which is, after all, the software that contributed to most of these worms. Ironically, www.resnet.ucsb.edu is running IIS 5.0 on that very same evil Windows 2000 OS.

Want to know my guess at what happened? Since the admins weren't blocking web servers running on port 80 outside of ResNet, someone set up an IIS server and got nailed with Nimda, which then killed their ResNet web servers (assuming that they hadn't patched their web servers, which isn't much of a leap to make, considering they don't seem to understand the difference between Windows 2000 and IIS.)

"OpenSSL and Apache holes? Wow, let's ban Linux!" That's the same ridiculous leap they made in banning Windows 2000.

"While we understand that it is possible to run a secure Windows 2000 environment, past history has shown that this rarely happens on ResNet."

Nothing like insulting your users AND taking away their right to run a particular OS. You know, this IS an educational institution -- why don't you try educating them? Better yet, cut off ports that are spreading Nimda -- that'll make people figure it out really quickly.

This is ridiculous in every sense of the word, and I hope the students there organize and fight against this. If I lived there, I know I would be.

Re:Ugh.

[bshanks]

> Nothing like insulting your users AND taking away their right to run a particular OS. You know, this IS an educational institution -- why don't you try educating them? Better yet, cut off ports that are spreading Nimda -- that'll make people figure it out really quickly.

I agree completely. This is totally outrageous.

Re:Ugh.

[tshak]

Oh, so you really meant to ban IIS, which is, after all, the software that contributed to most of these worms. Ironically, www.resnet.ucsb.edu is running IIS 5.0 on that very same evil Windows 2000 OS.

It's not as ironic as you may think. Most of the works that you speak of exploit default configurations (samples directory public, IDC's, etc.). I properlly configured IIS box, with a few exceptions, is reasonably secure.

Re:Ugh.

[Anonymous Coward]

"I agree completely. This is totally outrageous."

What a totally useless post. It's totally pointless!

Unless... bshanks saw the name 'SlashChick' and just wanted to post some agreement!

That's just sad dude. Whipped and you don't even know the girl!

Re:Ugh.

[NeuroKoan]

They actually did ban linux. My freshmen year (4 years ago) my roommate and I had to petition to get a "unix-like operating system" on the network. But if they "caught us doing any of that hacking stuff" we'd be shut off and kicked out of the dorms. Funny thing is, we were hacked and we did our best to fend off the attack before we just shut off the system for a few hours (and reset all the passwds). :) We actually had the linux box up for about 3-4 weeks before they noticed.

UCSB has all sorts of stupid rules. One of my favorites was that no more then 1 IP per person per room... (which was way too easy to get around...)

When I applied for a job there, they turned me down for not having enough technical knowledge, but I didn't feel like it was a good time to tell them about how easy it was to bypass all their "safeguards".

Re:Ugh.

[York the Mysterious]

1) There are not enough PARCs (Peer Advisor for Residential Computing: the students that get ppl up on the net) to have them go around securing ppls boxes all day long

2) When schools try to educate students on how to secure their computers they tend not to listen. You might listen as a computer geek, but I can tell you right now that 99% of the people in my dorm building could care less about installing Windows 2000 SP3. I dont see this as UCSB saying that XP is more secure than 2000 because I believe that XP SP1 vs 2000 SP3, 2000 will win hands down. I believe that UCSB is realizing that 90% of students dont install patches and by having students run XP they are getting machines with 2 years less security holes plus an auto updating system to ensure that patches are regularly installed (assuming students ok the patches).

3) Why dont they just block the ports. Two things here. I was at a school with 350 machines that were regularly updated with security patches. Every box in the building had an image with the latest version of every app reimaged once a week. Even with this an a Cisco PIX firewall and NAT we still got hit by Nimda. All it took was one stupid student opening up an attachment and the thing flew by administrative shares. Blocking ports doesn't always help. Second thing I'm not sure how UCI (the UC system's ISP) works by 4C (The CA State College's ISP) is really tough about blocking ports. If the school blocks the port for Kazaa or Half Life the school loses their internet connection. Pretty tough, but they have strong feelings that the internet should not be censored. I agree with them even if it makes things difficult somethings.

Do I think this is a crazy decision: yes

Do I see why they did it: yes

Re:Ugh.

[Arker]

What you don't seem to understand is that it's no more work for them to verify that a system has been patched and/or had IIS removed than it is to verify that it's not 2k/NT. Enforcement is exactly the same either way, a simple portscan will suffice to identify compliant/noncompliant nodes in either case. So why do they demand the elimination of certain OS instead of removing/patching vulnerable components? I'm betting on incompetence. This particular outfit is pretty well known for that already.

Re:Ugh.

[Anonymous Coward]

Thats kind of scary

I thought they had a good CS program there, don't they have people with networking experience to actually get shit done?

Re:Ugh.

[Otto]

[i]2) When schools try to educate students on how to secure their computers they tend not to listen. You might listen as a computer geek, but I can tell you right now that 99% of the people in my dorm building could care less about installing Windows 2000 SP3.[/i]

This is an already solved problem. You install a scanning server type of thing. Several different programs exist for this purpose. Basically it scans the local network for vulnerable systems. If it finds a computer on the network that is vulnerable to a known attack, it talks to the routers and flat out cuts that computer off from the network. With a little more effort, it can send email to the computer's owner explaining why they were cut off and how to get access reinstated (patch your f'ing system). I assume they'd need to get their email on campus after getting cut off as opposed to on their own PC's. ;)

In any case, the biggest problem is keeping the scanner up to date. But solutions do exist to do this specific service.

Re:Ugh.

[lrocker]

Hehe. . yeah, I was there when you did that. The *point* was that people were putting up unsecured linux boxen and getting *hacked* (like you) and then your compromised box was used to launch further attacks from inside the "UCSB network", where UCSB admins would take all sorts of crap from the admin of whomever's machine was being attacked from a compromised student machine. See how it works?

And BTW, I did hiring for those jobs something like 4 years ago (maybe only 3) as part of a "peer review" type of process -- I was just a student -- and I remember recommending certain people not be hired because they spouted linux misinformation and thought they were bad-ass-bitchez because they pecked their way through the linux installer. So maybe I was the one who recommended you not be hired? Who knows, but the point is that running linux does not mean you have technical knowledge. Neither does setting multiple static IPs on your machine. Had you set 3 IPs (the hard limit was 2), your port would have been shut off.

So people (slashdotters in particular), don't confuse an admin _not_caring_ with not knowing. They know it's IIS, but they don't want to explain it to students who don't know that, and don't have the *time* to go trying to educate you on how to use your own *server* operating system! They're too busy helping peopole who drop hair-pins in their printers and can't figure out where the floppy drive is on their iMac.

Re:Ugh.

[Anonymous Coward]

Never EVER say "ppl" again.

Re:Ugh.

[Reziac]

And what about students who must use some wretched program that's not stable under anything but Win2K? How are they expected to complete their classwork? XPHome won't cut it there, not to mention needing newer hardware that the student may not be able to afford.

I suspect what they really intended was to ban servers (thus getting rid of filesharing loads on their network), but were a bit weak on the concept.

Re:Ugh.

[einhverfr]

Funny thing is, we were hacked and we did our best to fend off the attack before we just shut off the system for a few hours (and reset all the passwds). :) We actually had the linux box up for about 3-4 weeks before they noticed.

umm.... If your system is truly compromised, shouldn't you ge formatting and reinstalling? I guess the possibilities of back doors installed by the attacker doesn't bother you?

Re:Ugh.

[Anonymous Coward]

Funny thing is, we were hacked and we did our best to fend off the attack

What? Do you think you're a warrior or something.

Please. Wake up some day. KTHXBYE!

Re:Ugh.

[necama]

Depends on which part of the network you're talking about. Their resnet people are a joke (at least, they were five years ago). I remember their shutting down my network connection because they found my linux box (running no external services whatsoever, btw). When I called them about it, they had a problem with the idea that I might change my MAC address.

But, if you go to the campus backbone people, they know their shit. If memory serves, they can be found in Engineering I, or perhaps Phelps. It's been a while. :)

Re:Ugh.

[Eraser_]

If the school blocks the port for Kazaa or Half Life the school loses their internet connection. Pretty tough, but they have strong feelings that the internet should not be censored. I agree with them even if it makes things difficult somethings.

Welcome to the world of Traffic Shaping. Look at the MRTG graphs of UCSB's resnet, 40mbit at 75% constantly. I was just up there this weekend setting up my girlfriends XP machine, and i was reading their traffic shaping policy. If you ever want to be able to do ReallyFast inet there, try using HTTP. It's at the top of the list. They say they have "dedicated traffic" for people to play games on, unfortunatly, its on the same traffic as FTP and streaming audio/video, so the connection to like Battlenet is lagged, and my Digitally imported stream cut out every so often. Of course, at the bottom of the list is P2P, which really is where it does belong. (The major traffic hogs, which aren't really that educational, get put at the bottom of the pecking order, below the "more legitamite" online gaming, and generic web surfing)

The other thing i noticed, was during sign up, you plugged in your computer, and i expected to get a DHCP lease right off, well i did, so i used e-mail to check the connection, little did i know i needed to open up a web browser so i could see/sign their AUP. I was then told to shutdown my computer, rebooting wouldn't work, etc, in order to go online. run ipconfig /release && /renew, BAM, inet works.

Re:Ugh.

[York the Mysterious]

Traffic shaping is a beautiful thing, and here at San Jose State it has really made a difference in the past, but we're experiencing problems now that even traffic shaping cannot fix. We have a Packeteer PacketShaper 6500 that "shapes". It's a very powerful box that can shape up to 100mbit of traffic. We put Kazaa and Gnutella into a group and assigned them 2mbit. Well the first week of school I downloaded 1000k a second. Not bad at all, but come the second week when everyone had moved in I was downloading at 5k a second. It turns out we were actually using less traffic the 2nd week than the first. The problem was the way Kazaa's network works. We had over 40,000 incomming connections into the building every 30 seconds. This left our router running at 100% utilization ALL day ALL night. The routing table was constantly being rebuilt and it crippled our network. Right now I can download at 5k on average, 20k on a good day, and .5k all to often. .5k! Screw Kazaa. Even when they put everything but port 80 into a group with 1mbit it still downloaded at .5k. Our school now has to spend $40,000 on a new router that will only allow us to survive with Kazaa. I would really like to see Kazaa shutdown. It ruined our network.

Re:Ugh.

[Anonymous Coward]

Mod parent UP!!

Death to KAZAA
Death to P2P

Re:Ugh.

[Spoticus]

You know, this IS an educational institution -- why don't you try educating them?

Hmmm...perhaps that's precisely what they're doing and don't even realize it? Digital Rights restrictions/proposed legislation are plentiful, and getting moreso every day, and people (other than various well informed geeks) don't really realize it.
Even if they're not doing for educational purposes per say, they're still teaching people about the direction Digital Rights are going. Perhaps issues like this are just what people need to scare them a bit and let them see what's happening...

Re:Ugh.

[Spoticus]

And what about students who must use some wretched program that's not stable under anything but Win2K? How are they expected to complete their classwork?

Do you really know of any classwork that would require something like that? Good wordprocessors are available on any platform - and that's 99% of what is used for classwork other than the odd CAD app.

Re:Ugh.

[PW2]

I had a similar issue at UW0 - then 1 IP per person per room -- they even didn't like serial terminals

Re:Ugh.

[NeuroKoan]

And BTW, I did hiring for those jobs something like 4 years ago (maybe only 3) as part of a "peer review" type of process -- I was just a student -- and I remember recommending certain people not be hired because they spouted linux misinformation and thought they were bad-ass-bitchez because they pecked their way through the linux installer. So maybe I was the one who recommended you not be hired? Who knows, but the point is that running linux does not mean you have technical knowledge. Neither does setting multiple static IPs on your machine.

Good point. There is no way to know if I could have been good for the job or not. It doesn't really matter at this point. I think we can agree that I would have needed much more training then I would have admitted at that point in my life :P

But just so you know, we had 2 computers that used DHCP to get their IP and one statically set. Our port was never shut off.

Re:Ugh.

[NeuroKoan]

In retrospect, probably. But we were leaving in about a week anyways.

It was a learning experience. And we didn't do any damage (advertently or inadvertantly). But it was more luck then anything else.

Re:Ugh.

[NeuroKoan]

Actually, almost everyone at UCSB now as their stuff together. Since i've been here I became a webmaster on campus; the backbone people did impress me, although i never really worked with them directly (only periperially through e-mail and phone)

Re:Ugh.

[NeuroKoan]

What? Do you think you're a warrior or something.

Not particularly. The best thing we did was hit the powerswitch.

Re:Ugh.

[Reziac]

Actually, that's exactly what I was thinking of -- CAD apps, high-end image or video editing apps, and the like. Got an architecture or EE dept.?? Then you've likely got kids using CAD apps.

Win 9x more secure than NT/2K!!!??!?!

[Yousef]

Just what drugs are those admins on!
NT was bloat ware, but stable. 2K is Solid.
Unless you're some idiot paying to run IIS instead of running Apache for Free, I don't see where a security problem could be?
Add a personal firewall if you're that concerned. But recommending 9x or XP!
I'd check the Swiss Bank Accounts of all the Admins for recent cheques from Redmond!

Re:Win 9x more secure than NT/2K!!!??!?!

[dpt]

2K is "solid"? So I'm just imagining the BSOD yesterday. I see.

Re:Win 9x more secure than NT/2K!!!??!?!

[Anonymous Coward]

What, as opposed to Linux, which I saw coredump the other day? 2k *is* solid.

Re:Win 9x more secure than NT/2K!!!??!?!

[dpt]

I don't run Linux, you stupid monkey.

I'm sure w2k is solid for those with low standards and little education ie. used to rebooting every day, and crashes every other day, and who need "clippy the paper clip" in order to surf the interweb and practice their l33t h4X0r skillz, but I run FreeBSD so my standards are somewhat higher.

Re:Win 9x more secure than NT/2K!!!??!?!

[just another cynic]

I'm sure w2k is solid for those with low standards and little education ie. used to rebooting every day, and crashes every other day

Actually I use it everyday at work. I reboot it once a month. That's not often enough to really worry me. Before you have a go at me for being a windows user, I work as a Tru64 Sysadmin, and run Linux at home.

and who need "clippy the paper clip" in order to surf the interweb and practice their l33t h4X0r skillz,

Most people I know turn him/it off.

but I run FreeBSD so my standards are somewhat higher

Yes, I'm sure you much prefer the shitty hardware support (no hardware GL or decent SB live support? bah). Windows is a nice desktop OS, it's easy to use, pleasing to the eye, and relatively stable. That said, I prefer to a Linux based OS, as I like to tinker and I like the level I can customise it.

Re:Win 9x more secure than NT/2K!!!??!?!

[joto]

Well, actually, I tend to reboot my w2k machine about once a month.

Considering all the crapware I have installed, I think that is about acceptable. So, yes, I would say w2k is pretty stable.

On the other hand, I never reboot my linux box except for when I've had a power-failure, or kernel-upgrade.

Re:Win 9x more secure than NT/2K!!!??!?!

[Anonymous Coward]

Actually, W2K has run for several months without a hitch for me. Just because you can't properly administrate an operating system that is built to be easy-to-use doesn't mean that it sucks; it simply means that you are incompetent.

Move on, nothing more to see here.

Re:Win 9x more secure than NT/2K!!!??!?!

[Anonymous Coward]

NT was bloat ware, but stable.

Wow. NT was the only version of Windows that wasn't "bloat ware." Next...

Re:Win 9x more secure than NT/2K!!!??!?!

[Darby]

NT was bloat ware, but stable.
Not at all. According to Bill Gates himself, NT has an average uptime of 4 days. This is the actual figure he gave. Now, granted it was at the time of the 2K launch party, but it amazed me that CEO's worldwide failed to recognize that by saying this he was also saying, "We have constantly lied to you and you should immediately fire anybody at your company who recommended using our products."
Oh well.

2K is Solid.

For windows.

Re:Win 9x more secure than NT/2K!!!??!?!

[dpt]

A predictable response from an idiot. Next you'll be blaming "the drivers". Where to the Windows weenies get these standard phrases to shit back?

Re:Win 9x more secure than NT/2K!!!??!?!

[dpt]

Just because you can't properly administrate an operating system that is built to be easy-to-use

Does that imply you need an "easy-to-use" system? Maybe you should get that degree, and understand this computing stuff instead? Start with operating system design, please.

And Windows *isn't* "easy-to-use" if you need to do more than, say, playing solitaire. But I'm guessing you're just a sysadmin of some kind or other.

Re:Win 9x more secure than NT/2K!!!??!?!

[Anonymous Coward]

They probably teach 'em as part of the MCSE, or whatever.

Anyway, it's the same place where they learn that "fixing" fucked software, or the complete lunacy that is "the registry", makes them "totally l33t".

It's an interesting problem - these people coming into the industry think crashes/viruses/security fuckups etc are completely normal, and that you have to use your mad l33t skills to increase your "uptime", or else you're "incompetent".

The idea of software that is well designed, and just works, and doesn't need to be propped up with sticks, is completely alien to them. You'll be able to judge by the number of "all software is bad" responses ...

BTW did you notice the "I've seen Linux *core dump*" remark? LOL. Clearly they've read about "Linux" and "core dumps" somewhere, and just put the two together.

LOL! They did the opposite here at SLU

[tx_mgm]

if youre caught in the dorms with a copy of windows xp, you win a brand new disk format and a fresh install of windows 2000. they say its because xp exploits someting on the network that they dont want to fix....i dunno.
just kind of funny

Re:LOL! They did the opposite here at SLU

[fudgefactor7]

That would open themselves to many a lawsuit, asuming this is in the USA, of course. I suggest you tell your SLU admins to rethink their stance on this. That's unlawful entry, illegal use of someone else's computer system, (which is a violation of many new laws--unless SLU is the RIAA and they're just hunting MP3s), destruction of property (electronic, but property none-the-less), and a whole mess of other things. Sounds to me that the SLU admins (and whoever else wrote that code) need to be fired.

Re:LOL! They did the opposite here at SLU

[Anonymous Coward]

I would get an automatic rifle and go on a fucking jihad against any cocky Administrator who ever went so far as to delete one file of mine for simply running the operating system of my choice.

Not a scam

[Anonymous Coward]

I am a student at UCSB and the reason this is being done is because the average user in the dorms does not have the ability to properly secure NT or 2K from its default setup, while the default setup of XP has been deemed more secure.

Re:Not a scam

[lunaticmaster]

BUT, they are still allowing 98 and me????????? They have flaws galore, and good luck making them 'secure' So they ban the more stable and generally more secure operating systems in favor of a still relatively new operating system?

Re:Not a scam

[Jucius Maximus]

This is madness. It's like banning those ramps people walk up to get onto aeroplanes because you've got a problem with some pesky malcontents using the planes as large missiles.

Re:Not a scam

[BiggyP]

maybe they simply don't want any workstation level security, NT and NT2K give you secure workstations, 98 and ME do not, localy or network wise, XP home is a bad idea surely though, if they're using NT servers i seem to recall a distinct lack of NTAUTH domain log ons.

maybe they should provide linux for those users who do not want to go out and buy XP home or expose themselves with 9x, having said that, you could probably claim the same problem as with NT/2K with linux.

Re:Not a scam

[The Dobber]

The key factor here is that they are banking on the fact that Win9X will crash frequently enough as to be "offline" more often then not. You can't exploit what you can't see.

Re:Not a scam

[N3WBI3]

I got news for you 2K pro is as easy to secure as XP, just because an XP distro is 'secure' out of the box does not mean flaws wont be found (as there are with any OS/APP). So you buy youself at most **AT MOST** a month or two until your network is jst as insecure.

The school is treating the symptoms and not the problems, a swith to Linux/OSX/BSD etc would not make a difference either (maybe a little) because the base problem is that people are not going through the effort to secure their system.

The school should be focusing on security at their end and let the young adults in the dorms be responsable for their own computers.

Re:Not a scam

[Sj0]

How many Nimdas and Code Reds are there for Win9x?

Re:Not a scam

[Eeeeegon]

How many NIMDAs are there for win2k boxes without IIS (the default installation)?

How many NIMDA vulnerabilities are there for win2k boxes administered by competent people?

Re:Not a scam

[Sj0]

Isn't the whole point that college students, as a whole, are not competent techs?

Re:Not a scam

[Eeeeegon]

The competent ones shouldn't be punished by being forced to use another operating system; but yes i agree that Most win2k users aren't competent, and have never heard of 'windowsupdate'.

That's something the university should work on; Education instead of OS Bannings.

Re:Not a scam

[homer_ca]

Once NIMDA infects an IIS server it'll scan for open file shares on the LAN, and NT/2000 has more shares by default than 98 including the C$ share (i.e. the whole C: drive). If some warez kiddy is lazy and sets a weak administrator password, it's now less secure than Win98.

Re:Not a scam

[Anonymous Coward]

College students, as a whole, can't even spell "competent."

Re:Not a scam

[Sj0]

I never said I was a good typist or even functionally literate. Try not to make such assumptions about people.

Re:Not a scam

[Sj0]

Scandalous!!! I actually spelled it right the first time!

My first comment still stands -- I make no guarantee that I'm literate, to any degree.

Ubelievable

[twakar]

I can understand that changing the default settings in W2K may be above some peoples heads, never mind that fact that you're in university and presumably smart enough, or know someone smart enough to fix it for you, but this quote is ridiculous:
Some other options are to downgrade to Windows 98, get a free operating system such as Linux
(italics mine).

How can someone call a superior OS (notwithstanding the flawed perception that it is hard to configure) a downgrade, I nearly covered my monitor with coffee from that statement. If someone is forced to change OS's, that usually means wiping the drive. With a bare drive, I would suspect that Mandrake, Lycoris, Libranet and other distros would install much easier than would Win98. This is the end of my rant, but I will still continue to shake my head in disbelief.

Re:Ubelievable

[Com2Kid]

*sigh*

Some other options are to downgrade to Windows 98, get a free operating system such as Linux


Reformat that as a bulleted list;

Your options are as follows:

-Downgrade to Windows 98

-Get a free operating system such as Linux.

Notice the placement of the comma?

Once again

Some other options are to downgrade to Windows 98--*,*-- get a free operating system such as Linux

Re:Ubelievable

[amorsen]

Some other options are to downgrade to Windows 98, get a free operating system such as Linux

This sentence should be parsed: Some other options are to (downgrade to Windows 98), (get a free operating system such as Linux).

slashdot ?

[Anonymous Coward]

wow some people actually defending windows 2k/NT....i must be in the wrong place =)

Just curious...

[Sir Joltalot]

If somebody could elaborate the differences between 2k and XP. I'm don't really know much about what's different besides the cosmetic changes and the addition of extra crap (iMovie-esque things). And in this case, I really would like to know (out of curiosity mostly) what is different in XP that might make it more secure.

Also, like I said.. no Windows buff, but.. wouldn't the 9x stuff be less secure than NT/2k? Or is 9x just less stable, while the NT/2k stuff has more holes?

I tend not to really think about the differences between Windows versions and just think of it all as 'Windows' so this kinda interested me in a perverse sorta way.

Re:Just curious...

[Squozen]

You'd think that a 'network administrator' would be fully aware that every version of Windows has had horrible exploits and vulnerabilities. /bullwinkle mode on

This time for sure!

Re:Just curious...

[Com2Kid]

If somebody could elaborate the differences between 2k and XP. I'm don't really know much about what's different besides the cosmetic changes and the addition of extra crap (iMovie-esque things). And in this case, I really would like to know (out of curiosity mostly) what is different in XP that might make it more secure.

*sigh* Ok I'll bite.

XP is basically (and has been referred to on occasion by MS as) NT5.1 . Windows 2000 is using the NT5.0 kernel.

XP has had a few speed optimizations here and there as well as some built in "performance boosters" such as automatically defraging and optimizing the boot hard drive when the computer it otherwise idle.

All of this was basically necessary to implement so as to hide how the extra five hundred megabytes of bloat that came just with adding TWO features to Windows XP;

Skins and user switching.

(Yes, it took MS 500 megabytes to add those two features. Go figure.)

Oddly enough even XP pro lacks some of the functionality of Windows 2000. The ability to Lock a workstation is gone (Doh!), or at least hidden some wheres far far away. Horrible for security.

Also killing Explorer.exe in Task Manager is now A Serious Ordeal where as in Windows 2000 it was just another ho-hum task. I have seen killing Explorer.exe bring down an entire Windows XP system.

Some minor encasements to USB Mass Storage was made, and Internet Explorer 6 was shipped by default. There is also a cheesy personal firewall included with XP Home, but it hardly counts as a true security feature.

The Windows 2000 shell can actually be swapped out easily enough and another shell can be dropped in there. The Win9x line is the same way, very customizable. MS seems dedicated towards working against this though and integrating everything into one tight mess of tangled dependencies.

Oh yah, and XP likes telling you what to do. At least in Windows 2000 it was possible to beat some sense into the Machine, but in XP. . . . well the beating is still theoretically possible, but finding the sensitive spot to pound on is not quite as easy as it was with Windows 2000.

Also, like I said.. no Windows buff, but.. wouldn't the 9x stuff be less secure than NT/2k? Or is 9x just less stable, while the NT/2k stuff has more holes?


There is normally a pretty steady correlation between security holes and stability. When you have one, odds are that the other can be found to. Sloppy code is sloppy code.

That said, Windows 9x is both unstable and full of security holes. Quite frankly the poor thing was never meant to go 32bit, mine as well be forced onto the Internet and be made to play around with T1/3s doing DDoS attacks.

98 is rather fun in that you can do almost anything to it and it will take it in stride though. :-D I once set command.com as my shell, hehe, I had access to the full DirectX libraries and all that buuut. . . . :)

Really, nobody ever took full advantage of 98, hehe. Active Desktop could have done some nifty things. ;) (if only it was not so crash prone. . . .)

Re:Just curious...

[Herr_Nightingale]

the big differences from a security standpoint are several:

-lotsa bugfixes and plenty new bugs to fool around with... basically no net gain or loss here
-WinXP Home has no support for joining a domain... this is a bad thing if you rely on NT domain-style security (term used loosely here thanks you people for noticing)
-by default, you have to really try hard to find the three-finger-salute logon option.. you know, the one that generates a hw interrupt for local logon, that kind of thing. This, again, is a point in Win2K favour
-WinXP comes with a neato remote-DOS exploit in the form of the SSDP sevice (Universal Plug'n'Pray, the one the FBI was decrying as such a security threat. Those over-active whiners! ;)
-XP also comes with a "firewall" which basically does nothing - or, more likely, fools users (hey anybody dumb enough to use XP seriously deserves it) into thinking they're secure from remote attack. Until the latest worm snipes 'em, that is..

i think that's it... but those are the big ones that I've come across in my workplace. We don't use WinXP at all if we can avoid it, and the good news is that if you have an XP license (OEM too! woohoo!) you can upgrade for free to Win2k.

Re:Just curious...

[ThePeeWeeMan]

Actually, even under XP Pro, you can still lock your computer. I just did. :-)

Re:Just curious...

[Mwongozi]

You can still lock the workstation in Windows XP. Either press Ctrl-Alt-Delete and click "Lock Computer" (Just like in Windows 2000...), or, if you have a Windows key, just tap Windows-L.

Re:Just curious...

[Anonymous Coward]

Inbuilt Script Blocking is nice!

Re:Just curious...

[Zigg]

C-A-D only works if you have turned off "friendly logins" (IIRC), which is on by default in Home.

Re:Just curious...

[GlassUser]

How the hell did this fud get modded up to +5? This is complete garbage.

You're looking at this like a typical office nightmare, the geek wannabe that knows just enough to be difficult. You only see two differences on your desktop, and decide to proclaim loud and long that this is the only difference. Idiot.

The console interface backend is completely different. I mean totally. Through NT5.0, the GDI had a direct interface to console display hardware. Now it's all abstracted through an RDP pipe. This is what allows you to connect directly to the console remotely with an RDP client. It also lets you have sound, printers, etc, on the same client. You can skin it. Sure you can do this with PCAW or VNC, but they are MUCH slower and not as flexible.

What the HELL do you mean that you can't lock a workstation? Maybe you forgot how to? I do it dozens of times a day. Perhaps I can teach you with my next round of primary school students? Killing explorer is hard? Eh? Just the same. The only way it can bring down a workstation is if you have some garbageware or bad video driver installed. Doesn't sound like MS's problem to me (either they'll make it more secure and people will whine about monopolistic practices and taking everything over, or they open it up more and people blame them for third party crap they choose to install).

People like you make me wish there was some sort of basic internet usage license. Sigh.

Re:Just curious...

[operagost]

I'm not sure you're correct about that abstraction layer. Windows 2000 server has Terminal Services built into it, but it's essentially the same as Pro with a few registry hacks and the addition of some services. So either the abstraction was there in 2000, or it's NOT there in XP.

Personally, as a TS and Metaframe admin I don't think it's ANYWHERE. In 2000 terminal servers, you STILL can't shadow the console.

Re:Just curious...

[Com2Kid]

What the HELL do you mean that you can't lock a workstation?

Under the Aqua skin with User Switching enabled;

you cannot.

Hit Cntrl-Alt-Delete, notice the lack of the option. Goto start "turn off computer", still not there.

Killing explorer is hard?

Do it, start explorer.exe up again and watch in wonderment as XP takes a good 3-5 minutes to figure out what the fuck just happened. There is about a 25% chance that it will die on the spot and an even greater chance that it will not be the same after explorer.exe is restarted any ways.

The only way it can bring down a workstation is if you have some garbageware or bad video driver installed.

Video driver was XP's bundled GeForce2MX one (hey, I wasn't in charge of setting the damn machine up, heh), so hey guess what, it is MS's problem.

Re:Just curious...

[taernim]

Oddly enough even XP pro lacks some of the functionality of Windows 2000. The ability to Lock a workstation is gone (Doh!), or at least hidden some wheres far far away. Horrible for security.

Ctrl-Alt-Del and choose "Lock Computer"
How exactly is this hidden?

Re:Just curious...

[GlassUser]

Um, your point proves the bit about the abstraction layer. Win2k has a separate subsystem to generate an RDP environment. The console uses the direct device meta-interface, so you can't use RDP to connect to the console. WinXP however lets you connect directly the console with RDP (eg shadowing). I admin terminal servers (but not metaframe). I'm kinda familiar with this.

Re:Just curious...

[Brento]

Under the Aqua skin with User Switching enabled; you cannot. Hit Cntrl-Alt-Delete, notice the lack of the option. Goto start "turn off computer", still not there.

Sure you can, as long as you're a member of a domain. If you're not a member of a domain and you don't have any security set up, then you can't, but even if you just join a domain then you can lock your desktop no matter what switching you have turned on. I do it all the time.

Do it, start explorer.exe up again and watch in wonderment as XP takes a good 3-5 minutes to figure out what the fuck just happened. There is about a 25% chance that it will die on the spot and an even greater chance that it will not be the same after explorer.exe is restarted any ways.

Again, not on my desktop or laptop, but your mileage obviously varies.

Re:Just curious...

[Com2Kid]

Sure you can, as long as you're a member of a domain.

Which does what good for a stand alone computer?

Functionality was REMOVED. It used to be that by default ANY NT4 or 2K machine could EASILY be locked down. A very basic security practice that was mandatory in many locations. Now special steps have to be taken to enable this to be done to the machine, oh joy.

but even if you just join a domain

Yah, I'll just pull a domain controller right out of thin air. . . .

As I said, useless on a stand alone machine, such as, oh, say, the majority of computers out there in a non-business environment?

Quite convenient if there are youngsters in the house. Or just if personal information is being looked up, or if a person just wants to leave a clear "hands off" message.

On a secondary note, What in the HELL encouraged Microsoft to take a feature that once worked so easily and add more crud around it???

I mean seriously, if some things works, why DISABLE IT?? What the???

Re:Just curious...

[Com2Kid]

See the rest of this thread, it is or is not present depending on how the computer is setup.

If pretty logon and fast user switching are enabled and the machine is not on a domain (which counts for the fair majority of home users who are in the know and are stuck with / like XP, or for a variety of different labs and such), then Lock Workstation does not appear.

Re:Just curious...

[acarey]

All of what you said is true, but you omitted certain other pieces of information...

-lotsa bugfixes and plenty new bugs to fool around with... basically no net gain or loss here

Windows XP comes with Automatic Updating, so as bugs are fixed patches are downloaded and installed automatically (user configurable as to how "automatic" it all is).

-WinXP Home has no support for joining a domain... this is a bad thing if you rely on NT domain-style security (term used loosely here thanks you people for noticing)

Yes, specifically advertised as being a feature of XP _Professional_.

-by default, you have to really try hard to find the three-finger-salute logon option.. you know, the one that generates a hw interrupt for local logon, that kind of thing. This, again, is a point in Win2K favour

Easy if you're a member of a domain, unnecessary if you're not and user switching is activated, so while true I don't understand what your problem is.

-WinXP comes with a neato remote-DOS exploit in the form of the SSDP sevice (Universal Plug'n'Pray, the one the FBI was decrying as such a security threat. Those over-active whiners! ;)

See Automatic Updating above. Patches were released to Windows Update _before XP shipped_!

-XP also comes with a "firewall" which basically does nothing - or, more likely, fools users (hey anybody dumb enough to use XP seriously deserves it) into thinking they're secure from remote attack. Until the latest worm snipes 'em, that is..

Unfair. It's a perfectly functioning port filtering firewall. But it doesn't scan your mail for viruses or anything like that, which is what I think you're alluding to with this point. Having said that, doesn't Outlook Express block dangerous attachments now? (I have XP but don't use OE, so I don't know.)

Cheers
A.

It _IS_ a security/bandwidth problem

[gimlix2]

Just for the record, I work for Residential Computing at UC Berkeley (the analog of Resnet at UCSB, except it's at Berkeley :), so you know I'm not completely talking out of my ass.

This has been a topic of discussion recently at our office mainly because there have been a tremendous number of security issues relating to Windows 2000 (not so much with NT since these are students, not corporate users). I personally think that the move is a little drastic, but it will be interesting to see how this pans out at UCSB (especially how they will enforce it).

There will be people talking about how secure/insecure Win2K is. Allow me to give a common trait to all of the compromised machines:

1) Blank Administrator Password
2) Unpatched Windows (i.e. no Service Packs installed)

In nearly ALL the compromised machines, the computer is not updated and has a blank Administrator password.

The easy solution: install SP3!
An easier solution: set an Administrator Password!

All really simple solutions that would prevent 99% of the issues we have encountered thus far.

So I said it was a security problem. How is it a bandwidth problem?

Allow me to point to the DarkIRC and Nimda security bulletins we have written up by our security.

So you've got a zombie, what do you do with it? A number of things:

1) use the compromised machine in a DoS attack
2) use it as a FTP server
3) use it as a IRC bot ...

A script kiddie can just use a machine on a fat bandwidth pipe at will to his liking. It's definitely NOT fun when the pipe is already clogged as it is with folks and P2P apps.

So there you have... if you don't think it's a problem, it IS a problem. There are too many calls about this to our helpdesk to have it be a minor issue that everyone else makes it out to be.

Re:It _IS_ a security/bandwidth problem

[Warphammer]

I do have to wonder if cluefully-run 2000 boxes will be exempt. If not, that would be rather harsh. If so, you'd need some way to verify it...

Re:It _IS_ a security/bandwidth problem

[cscx]

I suppose we should ban Linux and Unixes as well as it _is_ possible (albeit difficult) to set a null root password.

Re:It _IS_ a security/bandwidth problem

[jsse]

We are running a 1000+ organization but our solution is much better than banning older release of windows to force students upgrade at their own expenses.

First of all, remind them of the security policies, and the consequence of failure to compliant

Second, we do not rely on individual machines in our network to ensure OUR network security. We include in risk accessment that clients machines are subjected to be exploited, and have plans to deal with it.

To minimize and control the damage, we blocks off unauthorized ports across segments. Say they could open port 80 to be access within their own segment, but outsiders cannot have access to it. Now the virus outbreak would only affect their own segment.

Of course, they could apply for the opening of ports with proper justifications and management approval.

Third and most important, install Software Access Management software on all Windows boxes. SAM enables admin to perform license management and remote controlling. Users may complain about about it, but it's your choice to use Windows, you've options to use something else.

Do not think we'd relax restrictions to Linux and Mac, policies require that each box must be tested(and challenged, on password, services and ports opened) by our tiger teams from time to time.

Just my two cents.

Re:It _IS_ a security/bandwidth problem

[Skwirl]

The easy solution: install SP3!

The problem is that Windows has a negative reenforcement thing going with patches. In fact, I tried to install SP3 the other day and Windows gave me a nice, vague error message. Regular users can get into a "if it ain't broke, don't fix it" attitude, since it seems that upgrading when you're not having problems is just asking to have your system wrecked by some stupid bug.

Re:It _IS_ a security/bandwidth problem

[ameoba]

If you're forcing people to 'upgrade' to XP, are you at least on the MSFT campus program where legit copies of MSFT software are available for free/reallyCheap?

Re:It _IS_ a security/bandwidth problem

[gimlix2]

The only way we have been able to verify that a Win2K box have been taken care of is when we do it ourselves... unfortunately, this only happens when we've already shut off the connection to compromised machines.

There will be a new security campaign similar to the bandwidth campaign we have (Be Nice to the Net) It has so far been a fairly effective educational campaign to inform residents about avoiding bandwidth wasting activities.

Re:It _IS_ a security/bandwidth problem

[Sycraft-fu]

Simple solution to most of your problems: put up a reflexive access list on the dorms. That's what we did where I work (U of A). Stops all server related problems and block any hacks that the attacker initates. No more intrusive than the NAT box most people have to run through on residential DSL or CM. We also have addtional measures like blocking NetBIOS at the edge and some NetRangers (for preotection of buildings without reflexive access lists) but really, throw a reflexive access list on your dorms and that by and large solves the problem with hacks since most of them are intiated by a remote computer.

Banning an OS won't do shit since ALL OSes are insencure in the hands of someone who doesn't know what they are doing. XP may be, genereally speaking, more secure to a newbie since it doesn't suffer from problem with blank administrator passwords in its default mode BUT that doesn't mean it's immune to problems. Nor is Linux for that matter, it would be a disaster to have a bunch of peopel that didn't know what they were doing trying to run Linux.

In a situation like the dorms where you don't have an ovveriding netadmin and you can't make users keep up to date a good access list really is the answer.

Re:It _IS_ a security/bandwidth problem

[scalis]

Regular users can get into a "if it ain't broke, don't fix it" attitude, since it seems that upgrading when you're not having problems is just asking to have your system wrecked by some stupid bug.

New attitude: If it aint broke, break it. Then fix it.

Re:It _IS_ a security/bandwidth problem

[Richardsonke1]

Do you think that XP requires an admin password?! Think again. I never tried to log in as Admin on my XP machine (made myself an admin) until I installed powertoys, which let me put administrator as one of the logins on the title screen. I was quite suprised when I found out there was no password.

Re:It _IS_ a security/bandwidth problem

[PeterHammer]

I have setup all manner of NT, 2K and XP machines. That includes NT server and Workstation, 2K professional and Server and XP Home and Professional.

The option to leave the Administrator password blank, and I reiterate the option, is only available on Windows NT and 2K. But at least it is there. On both versions of XP it is the Norm to leave the administrator password blank. I am not talking about the first user you setup, I am talking about the UserName ADMINISTRATOR. XP setup does not even warn you that such a user is there. I was blown away by that aparent lapse when I setup XP for a friend.

Try it. Logon to your brand new XP setup with username Administrator and no password.

It is mindblowing that "responsible" IT professionals will claim that Windows XP is more secure than Windows 2000. Just because hackers have not gotten around to it, does not mean the threat isn't there. We are talking about the same Kernel (practically) and the lame feature over function drive that seems to plague all Microsoft Operating Systems.

I commend the user that suggested that concerned IT departments use a standard LINUX distro with a tight security policy to distribute to computers on campus. You'll be doing the world and your students a favor, by showing them the power of LINUX.

Re:It _IS_ a security/bandwidth problem

[Anonymous Coward]

look. get nessus. select only the filter that checks for weak or nonexistent windows administrator passwords. scan your network. take the list of IP addresses that were vulnerable and ban them at your firewall. you can perform this single-filter nessus scan on a class B network in under 12 hours.

PROBLEM SOLVED

good god man, work for a living!

-s.

Re:It _IS_ a security/bandwidth problem

[Anonymous Coward]

he only way we have been able to verify that a Win2K box have been taken care of is when we do it ourselves.

select "vulnerable to Nimda" and "weak NT administrator password" from the nessus template list. scan your whole network. ban any IP address which fails at your firewall. tell people what they have to do to be compliant at your local FAQ.

to say that manual verification is the only way is to deny years of progress by the security community. don't insult us.

-s.

Re:It _IS_ a security/bandwidth problem

[Large Green Mallard]

Uh yeah. Force students to install software on their privately owned computers which reports back on what programs and stuff they have installed on them.

Thankfully there's an organisation around to keep people with this frame of mind in check. It's called the ACLU.

While university residences are just that, there are various landlord/tenant laws which apply, as well as restrictions on what public institutions can force students to do. Something about not living in a police state? :)

Re:It _IS_ a security/bandwidth problem

[Silvers]

My school has very few nimda/irc/ftp problems. Mostly it is because we have a firewall which blocks all incoming traffic but port 80 http, and we have a campus license for anti-virus software.

Maybe instead of spending some money UCSB just wants to take the cheap way out and ban some OS's in an educational institution.

Re:It _IS_ a security/bandwidth problem

[equiraptor]

Windows 2000 is a security risk without an administrator password. A friend of mine had a VERY good administrator password, but had an account on her 2k box for her dad, with a very simple password. The University of Texas Resnet disconnected her port. An email had been sent to everyone on Resnet about a week before saying any computers with insecure passwords will be taken offline.

Needless to say, my friend was pissed. She complained that is wasn't in the Resnet's policy, and that is wasn't even an administrator account, so what was the big deal? I found a nice way to say "change your ****ing password and shove it." which she did, and was back online with one phone call. O, and the person on the other end of the phone told her what the insecure password was.

Re:It _IS_ a security/bandwidth problem

[Anonymous Coward]

mod parent up. It would honestly not take more than 1/2 hour to write a script that automatically emails the owners of the most vulnerable machines and gives them a cookbook-style instructions on how to fix their password and install SP3.

Re:It _IS_ a security/bandwidth problem

[Anonymous Coward]

In nearly ALL the compromised machines, the computer is not updated and has a blank Administrator password.

A script kiddie can just use a machine on a fat bandwidth pipe at will to his liking. It's definitely NOT fun when the pipe is already clogged as it is with folks and P2P apps.

So...

1. Scan for machines with a blank admin password and block their IP.
2. Configure QOS on your lines.

I don't understand how restricting what OS students can connect to the network magically solves the problems of security and bandwidth consumption?

Re:It _IS_ a security/bandwidth problem

[Spy Hunter]

It seems like what you need is a program that does this:

1. Searches the network for Win2K machines with blank passwords (not hard, scan through network shares)
2. When it finds one, logs in, changes the root password, then leaves a note on the desktop and in the startup folder explaining and giving the new password.

They'd never let you do it, but it would be sweet :-)

Re:It _IS_ a security/bandwidth problem

[jsse]

You've the point. It's not quite right to force them to do anything, we are just admins nevertheless.

Fortunately for us, our users are not students(heh), and they do not need to comply to our policy, as long as they do not connect to our network.

Well, policy is policy, we always find people do they own way. It's easier to handle this situation. I believe it's much more difficult to enforce it on students. :)

Re:It _IS_ a security/bandwidth problem

[Large Green Mallard]

Oh yes, if the machine in question is owned by the company you work as an admin for, the users must obey your fiat of supported OS'es :)

What the!?

[malxau]

In other words,

• We consider granting exemptions but we won't.
• There are ways to fix Win2k but we won't tell you.
• We force an upgrade, but accept no financial responsibility.
• You need to 'upgrade' from Win2k Pro to XP Home?
• You're required to log on as 'administrator' and there's a security hole (duh!)?

This must be about money. There's just no logical reason UCSB could possibly come to this conclusion...

User Error Replace user:)

[colk99]

Now rember its not computers that are insecure its the USERS IE some people in those dorms probly only have ever used a computer for AOL, don't you think it'd cost less to educate the users, I am still seeing Nimba hits on all the boxes i admin, it seems like some users havent gotten the point!

Re:User Error Replace user:)

[Anonymous Coward]

"I am still seeing Nimba hits"

Is this a Lion King variant of Nimda?

resnet.ucsb.edu is using IIS on W2K

[Perdo]

http://www.resnet.ucsb.edu

The site that is telling students they cannot use W2K is running IIS.

The student's machines get compromised, and resnet get's compromised so some Admin who would otherwise get fired for not installing HIS updates, scapegoats the student's.

Crap sysadmin and non technical management are the cause of this.

If they were so worried, wouldn't they be running Apache?

Blown well out of proportion

[shoemakc]

The univeristy doesn't declare certain types of machines illegal, they just refuse to support them. I'd wager that very few, if any machines destined for college shipped with w2k pre-installed. This means owners of w2k machines either were knowledgable enough to install it themselves, or knew someone who was. Chances are they'll go to their savy friend for support, and not brave the lines at IT.

This isn't nearly the same situation as computers that shipped from Dell or gateway with no admin password set. That's something that could be easily overlooked. In these cases however, chances are the same people who installed w2k knew enough to at least put in a simple password.

And I think we can all agree at this point that a properly patched W2K Pro installation is just as secure (if not more so) as even a properly patched XP one. This really just has to be the case of college IT administrators being wooed by MS hype.

Re:Blown well out of proportion

[dotgod]

I'd wager that very few, if any machines destined for college shipped with w2k pre-installed. Actually, at my school, all of the Dell boxes sold by the computer store came pre-loaded with Win2k.

Re:Blown well out of proportion

[Anonymous Coward]

Nope.

They don't support Linux, but they let people (like me) run it, no problem.

But Win2K users are stopped just before they hit the EULA for Resnet that you have to agree to before you can use the network. You don't get a real IP address until your MAC is registered to your ID number, you don't get your MAC registered until you agree to the EULA.

Re:Blown well out of proportion

[wademoore]

You are severely mistaken. Last year and the year before, MANY MANY student computers shipped out with windows 2000 by default. I work at a University, and I will tell you that in those two years around 75% of DELL computers shipped out with win 2k on it rather than a win9x system.

College Networks ...

[SuperDuG]

Why is it that campus networks, where HIGHER education is supposed to be happening, that the networks are ran by complete half-wits. Doesn't anyone in a CS class know how to setup and maintain a network even a little better. And more importantly, aren't there student governments/councils that shoud be deciding these matters, not administrators. I still can't believe they're placing a ban on win2k, that's insane, and how the hell do they plan on checking the OS Ver anyways?

Re:College Networks ...

[gimlix2]

Two comments about this:

1) Just because someone is in a CS class doesn't necessarily qualify them to know how to setup and maintain a network. CS courses (if taught properly) will teach you the Science (the art of programming, if you will)... I know CS students that can program and design software really well, but can't fix their computer if it started spouting errors, yet on the other end, I know people that are superb with their computer skills (in terms of using, fixing, troubleshooting, etc.) but can't program their way out of a paper bag.

2) You can also check the OS version by running an nmap on machines to see what ports are open... Win2K/NT have some ports open that Win9X machines do not... this is only one method and it is definitely NOT foolproof... I'm not quite sure how their registration/security model works.

Re:College Networks ...

[SuperDuG]

Right, but you would think in the entire CS major area, there might be one or two of them who actually know how to maintain a network. I'm just tired of always seeing colleges who are more business oriented than learning oriented. I definantelly think they should be accountable to who pays their salaries, I know I'd be up in arms about the whole thing. Guess it's good that the only thing I need to worry about is packet shaping here at my campus.

Re:College Networks ...

[D iz a n k Meister]

where HIGHER education is supposed to be happening, that the networks are ran by complete half-wits

Because, man, we're all really into the HIGHER education, and you should be too.

Re:College Networks ...

[fire-eyes]

and how the hell do they plan on checking the OS Ver anyways?

If they use DHCP, that's one way. The dhcp client will include its operating system and version in its request. Of course, this can be spoofed, but i've never seen it done on MS boxen.

Re:College Networks ...

[Blahbbs]

Why is it that campus networks, where HIGHER education is supposed to be happening, that the networks are ran by complete half-wits.

Simple. It's Money. When the college can only afford to pay a sys admin less than $30K/yr (I know, I used to be one), you're not going to be getting the best or most experienced talent. Training? Give me a break.

Using CS students? Most of the CS students that I encountered were strictly programmers with little understanding of how the pieces fit together.

Occasionally, we'd run across a smart cookie or two and try to get them to help us out (and get paid almost nothing...).

Fortunately, I'm not an admin at a university anymore. I feel for them, though. A university sysadmin has a tough job.

Re:College Networks ...

[Kyn]

You think student council's should decide this?!? They're probably the only people on campus less capable of good decisions then the admin. Jeez...student gov't is just something hippie Liberal Arts majors do to put on their resumes. They're a joke. Literally. Last year a gnome and snail won the presidential/vice presidential elections at my school with a clear plurality but because said hippies wish to retain power for their hippie brethren, said gnome and snail were disqualified.

Damn hippies.

That's timid!

[Anonymous Coward]

The best thing to do is write a simple recursive batch file.

Batch file launches.

Batch file sends message.

Batch file launches itself.

Batch file sends message.

Batch file launches itself...

And etcetera.

Fun for the whole campus!

Re:That's timid!

[dotgod]

heh...did that one too, only I would always direct it at a specific node. I never had the balls to direct it to ALL

Re:That's timid!

[Anonymous Coward]

No one cares that you are dumb.

:1
net send * blah
goto 1

is already recursive. Thanks for playing. Pour superglue all over a curling iron. Stick it in your ass. Plug it in. Ahhhh, that's better. Thanks.

Re:That's timid!

[thesadmac]

Wait, isn't that iterative? Though I admittedly it does do the same thing in this case.

Read the story again

[Anonymous Coward]

I am a student here at UCSB and I agree with the resnet staff because win2k/nt systems can be more secure than win9x/me but in reality they are not. Considering only a few people use win2k and those few manage to be the ones with nimda/code red/etc. They also agreed that if you have to run win2k they you can aslong as you secure the system and talk to them about it. They even went as far as giving all of the students antivirus software ... but the students decided not to use it. I think XP is allowed because it would be hard for them to block XP Profesional without blocking the Home edition.

PS: I don't think UCSB is getting anything from Microsoft, because they agreed to run Linux on most of the servers here.

just my $.02

Wait a minute...

[guttentag]

UC Santa Barbara is banning NT/2000 in favor of XP?

I thought UCSB was trying to shed its image as a place where people go to avoid real work:

August 26, 2002 AP article:

Often ranked as a top party school in college surveys, the University of California, Santa Barbara has recently gained respect from one reviewer.

A Newsweek-Kaplan guide to college admissions named UCSB one of the 12 "hottest" colleges. The report, which was on newsstands Monday, praises the university's faculty, which includes three professors who have won Nobel Prizes in recent years, and its reputable graduate physics program.

"UCSB used to be known as a major party school," according to the magazine. "Now it's the party school with an increasingly impressive academic reputation."

The guide also lauds UCSB's unique doctorate religious program and film studies program.

The campus' seaside location earned a mention in the Princeton Review's "The Best 345 Colleges" guide this year. Students who were surveyed voted UCSB one of the top academic destinations for "Quality of Life: Beautiful Campus."

The school also made the list that ranks school that lack racial diversity. It was mentioned in a list of "Monochromatic Institutes" in the Princeton Review.

The wool has been pulled over your eyes...

[SlashChick]

"I am a student at UCSB and the reason this is being done is because the average user in the dorms does not have the ability to properly secure NT or 2K from its default setup, while the default setup of XP has been deemed more secure."

Oh, boy. You just took that hook, line, and sinker, didn't you? What exploits are running around on a default version of Windows 2000 that would cause problems with your network?

Answer: NONE.

The culprit you're looking for is IIS, which is NOT installed by default on Windows NT Workstation or Windows 2000 Professional. If you install IIS from the Windows 2000 CD, you will be vulnerable until you download the patch -- but to install IIS, you must explictly insert the CD after Windows 2000 is installed, find IIS, and install it. (By the way, this problem could be eliminated other ways, such as not allowing servers on port 80.)

The IIS version that ships with the Windows XP Pro CD is not vulnerable. But to say Windows 2000 is vulnerable to a common remote root exploit out of the box is simply untrue. IIS 5.0 is the scapegoat you're looking for.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

Because there is a difference between a piece of software that runs on a particular OS and the OS itself. This is the fact that the UCSB ResNet people seem to be forgetting.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

Because there is a difference between a piece of software that runs on a particular OS and the OS itself. This is the fact that the UCSB ResNet people seem to be forgetting.

Oh I'm sure they are not.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

Actually, I explictly mentioned Windows NT Workstation or Windows 2000 Professional, not Server.

Re:The wool has been pulled over your eyes...

[htmlboy]

Oh, boy. You just took that hook, line, and sinker, didn't you? What exploits are running around on a default version of Windows 2000 that would cause problems with your network?

Answer: NONE.

The culprit you're looking for is IIS...

Having worked on dorm computers, the bigger problem with win2k and winxp is usually the presence of an administrator account with no password. There's a good number of exploits out in the wild that use the absence of an administrator password to take over machines, presumably for DDoS. I'm not certain, but I think that if you tell the installer there will be only one person using the win2k/xp system, it skips the part where it prompts you to set a password for administrator.

Re:The wool has been pulled over your eyes...

[Amizell]

I'll say it again since someone modded down the other replies (why?? the man has a point):
On Win2k SERVER, sure. Not on professional. I installed it 2 days ago and I can definitively state that Win2k PRO (which is presumably what college students will be running most of the time) does NOT have IIS installed by default. So you may be right, but you are also irrelevant.

alex

Re:The wool has been pulled over your eyes...

[Amizell]

Having worked on dorm computers, the bigger problem with win2k and winxp is usually the presence of an administrator account with no password. There's a good number of exploits out in the wild that use the absence of an administrator password to take over machines, presumably for DDoS. I'm not certain, but I think that if you tell the installer there will be only one person using the win2k/xp system, it skips the part where it prompts you to set a password for administrator.

Seems like a blank admin password would be a bit of a security risk on ANY operating system. And NO you are spreading FUD when you say it skips the set password dialog. That is ludicrous. *Nix users will say ANYTHING to put down the "Evil Empire" even if they have no idea what they are talking about. Would it have killed you to try it (or look it up) before making a statement about something you're "not certain" of?

alex

Re:The wool has been pulled over your eyes...

[BlackHawk-666]

I have seen many Windows 2000 Pro machines with a blank admin password. It's not FUD, it's fact. That may be bacause when people are prompted to set the password they can accept the default which is blank...hard to remember since I haven't done an install for a few months. Also, IIS is installed by default on Server and Advanced Server, but not on Professional.

Re:The wool has been pulled over your eyes...

[LordKronos]

Well then try to explain why Win 9x is alright by them. It doesn't even begin to understand the concept of Administrator.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

Because NT/2000/XP create administrative shares on the machine when you install them. For example, your C: will be C$, D: will be D$. Therefore, if you have a blank administrator password, ANYONE can access your hard drives (or registry, or services for that matter).

You can connect to the box by:
net use * \\ipaddress\C$ "" /user:administrator

That will map an unused drive on your machine to the administrative share on the remote machine that is sharing the C:.

Re:The wool has been pulled over your eyes...

[Ryosen]

During the setup process, you are prompted to specify a password. However, at the same time, you are also given the opportunity to specify that only one person will be using the machine which, in turn, will disable the initial logon prompt when entering Windows. This is what he is referring to.

Re:The wool has been pulled over your eyes...

[Lord Ender]

It is easy to make a Win2K system with no password. It doesn't complain if you leave the Admin password blank. And 2K/XP *automatically* share the entire contents of the hard drive, *read/write*, to the admin account. 9X and ME don't do this.

Re:The wool has been pulled over your eyes...

[GlassUser]

It's FUD because that's an option set by the user. If you like, you can edit your winnt.sif to have an administrator password set by default (but still allow the user to select other options like normal - it will even reversably-encrypt this password so it's not apparent on casual inspection).

Why not just set a script that logs into machines with blank admin passwords and either sets something to notify the users, or just changes it? Post notices saying that if your admin password was blank, it was helpfully changed by IS staff and you can get it back by calling them (or something like that).

My point is, don't blame MS because a user aquired a network operating system and doesn't know how to use it.

Re:The wool has been pulled over your eyes...

[letxa2000]

My point is, don't blame MS because a user aquired a network operating system and doesn't know how to use it.

What? If only those users who really knew how to use their operating system were "allowed" to have a computer, we'd be back in the early 1980's in terms of how many people have computers.

The whole selling point of Windows has always been that it's so simple that anyone can use it. They're market is the idiots that don't know any bettre. Given that they know their market, it is entirely reasonable to criticize MS for allowing an admin password to be blank. If a user tries that the install should politely say, "You must provide a password." How difficult is that?

Re:The wool has been pulled over your eyes...

[Herkum01]

Yeah and the Windows 98/ME Administrator account totally prevents this, right? The fact is, the IT staff had a problem, and they figure the easiest way to resolve the problem is to blame the students and tell them to do something that you want. It has nothing to do with which OS they are using, If there was a version of Windows XP+ out there they would be blaming Windows Xp for having a security hole and that students now have to have XP+ installed instead. It is typical MS thinking, upgrade so that your current problems will go away.

Re:The wool has been pulled over your eyes...

[ichimunki]

*Nix users will say ANYTHING to put down the "Evil Empire" even if they have no idea what they are talking about.

Hey troll, who said anything about Linux or Unix so far? No one. In fact, the poster you were replying to cited personal experience using Windows as his/her backup for the statements. If he or she is wrong I think you can explain this without mentioning Linux or Unix in an ad hominem attack.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

once again proving that most of the trouble with 2k comes from clueless people pretending to know something about admin.
Okay chuckles, NT has a local administrator password which MAY be set to blank by a clueless luser, but 98 and ME have NO security whatsoever for access. Which one is more secure? *smack*
now go and RTFM. which for lusers means Read the F$cking Manual. It's NT, not bloddy rocket science.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

Correction, portions of IIS are installed by default on Server and Advanced Server if you enable Active Directory. In order to do this you need to either specify the installation of IIS at installation, or go through the Active Directory Configuration process and enable bits and pieces of IIS. No AD, No IIS needed. Win2k Pro does not have Active Directory as default either. How many students are going to be out there running Server or Advanced Server? The answer should be none. Unless they are running thier little cracked Warez version little the little wanna-be geniuses they are.
Running any OS with a blank password for admin is inherently silly no matter what religion you are. Running your little redhat vanity box with a blank password for root will get you the same results.
Looks like there are alot of clueless wanna-be admins out there.

Re:The wool has been pulled over your eyes...

[macdaddy]

I whole-heartedly agree. I have found 10 compromised machines on campus this past month. All are running Me or 2k. All of them had null Admin passwords. All of them were compromised on July 9th. Most of them had Serv-u FTP server installed and sharing French movies. All of them had a VNC server of some sort running. VNC is what I scanned the campus for to find potential compromised machines. The list was pretty darned accurate.

A friend of mine who used to work for K-State did something that's I'd love to require of all PCs on campus. The first thing he did was create an admin account of his own. The second thing he did was DELETE Administrator. He said he rarely had security issues with his machines.

Re:The wool has been pulled over your eyes...

[macdaddy]

See my previous comment on blank passwords and how they've affected my campus.

To the best of my knowledge Windows installer doesn't ask you to set an admin password durnig or after installation. I've heard this from numerous people now. That's bad practice if you ask me.

Also the last time I checked all versions of Exchange that were installed were by default an open relay. If I were keeping track of how many of the IPs I tested to see if they were open relays were Exchange boxes, I think the percentage of hirs would be around 80%.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

A GNU/Linux system defaults to "no password"! If the /etc/passwd file is not present, sulogin will happily allow a user to have root privilege without entering any password. Similarly, login and sulogin won't complain if a user leaves his/her password blank in /etc/passwd (a few passwd programs *may* complain if a blank or weak password is used).

If you don't believe me, try building a GNU/Linux system from scratch (www.linuxfromscratch.org). It is often necessary (or useful) to add an explicit init=/bin/sh to lilo.conf or grub/menu.lst - no amount of passwording will save a user from this!

Oh, and it is almost universal that "root" has, in effect, full rights to almost everything on the system anyway (a few files in /proc or equivalent are excepted).

However, the installer for a *packaged system* should surely at elast alert users if the system is likely to be highly insecure.

Re:The wool has been pulled over your eyes...

[raoula]

This is not correct. The logon options of Win2K/XP come long after the admin password has been selected. This option is the last thing it asks for right before the first person logs on to the system. And if it is going to be part of a domain, the single user logon is not even an option. Granted, W2K/XP allows you to have blank Admin passwords but that should be a matter of policy and scripts can be written to check for null passwords.

Re:The wool has been pulled over your eyes...

[tekman]

XP by default rejects all remote logons by users with blank passwords. So even though admin$ points to %systemroot% with r/w access for administrator, if administrator has no password, it can never be used.

Re:The wool has been pulled over your eyes...

[GreenBugsBunny]

I just installed win2k pro yesterday and it did ask for an admin password. It might have something to do with the choice between fat32 and ntfs filesystems (asks for ntfs, but not for fat32), but that's just a guess.

Re:The wool has been pulled over your eyes...

[ultimabob]

How did he delete the administrator account. I always thought that in Windows 2000, you couldn't delete it, just like the guest account, you could only rename it. With Windows ME, there is no such thing as Adminstrator, its a 9x based OS just like 95 and 98, no security.

Re:The wool has been pulled over your eyes...

[macdaddy]

He was an NT admin. I'm assuming he did it to his server farm. The guy was a Windows God. He's the only person I know that could actually keep an NT server up long enough to have over a year of up time AND actually be in use during that time. I'm a Linux/Solaris/Mac guy myself. I've contemplated trying that on Linux before; removing root. I always work with my own root user rather than root itself. It has it's pros. However things like vlock require *root's* password for unlocking and wouldn't work on my root user's password.

Re:The wool has been pulled over your eyes...

[ultimabob]

Right, an NT box up for over a year, removing adminstrative accounts, removing root, sure.....your either being sarcastic, or you have never adminstrated a computer at all.

Re:The wool has been pulled over your eyes...

[macdaddy]

Might be. I asked one of our techs after lunch and he thought it did ask. I've heard from others that said it didn't though. I'm not sure what the difference was though.

Re:The wool has been pulled over your eyes...

[Hestas Coyote]

In my experience, all versions of Windows since 98 and NT 4 do at one point during post installation ask you to setup a password. For 9x if you leave it blank, it will never ask you again, hence being able to boot up the machine and never have it prompt you for a logon. NT4/2000 will still require a password, however it CAN be blank. Meaning all you have to do is hit enter at the logon screen. XP is the most bizare. I have only installed it once but as I recall, it asks for a userid/password like 2000, only I believe it says the userid must be different from administrator. Which is odd since it went ahead and gave the account I created administrator access anyway, and still made an administrator account. Actually, as I recall now, it made me assign an administraotr password just like 2000, but made me create a new user to login as, but gave it administrator access, without me telling it to. That was just my experience. Others may vary.

Re:The wool has been pulled over your eyes...

[NickDngr]

Because NT/2000/XP create administrative shares on the machine when you install them. For example, your C: will be C$, D: will be D$. Therefore, if you have a blank administrator password, ANYONE can access your hard drives (or registry, or services for that matter).

Except XP does not allow remote login using accounts with no password.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

What are you on about W2k does ask for a password.
You can leave it blank if you want, but it does ask for a admin password. Just because you have to actually read the install screens before you proceed to the next, does not change the fact that is does ask for a password.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

To the best of my knowledge Windows installer doesn't ask you to set an admin password durnig or after installation. I've heard this from numerous people now. That's bad practice if you ask me.

oh god you are clueless. okay, windows does have its faults, but the worst thing in the the world is clueless armchair morons spreading uninformed nonsense.

1. windows DOES query you for a password at install. This is evident to anyone who has even installed Windows ONCE.

2. You can change *ooOOOOooo* BOTH *WHOA* the administrator user NAME and PASSWORD at ANY TIME.

genius. now go run along now, little l^Huser before I LART you.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

Win2k Pro/Server ask you for a UID and Password during installation. You can change both the UID and the password after installation. This first user, of course, has administrator access. This is not variable.

Re:The wool has been pulled over your eyes...

[vmfedor]

No matter what installation you go through, win2k still prompts you for an administration password. Even *if* the local admin account is left empty, the admin account for the server still isn't blank. (or let's hope so)

- vmfedor

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

No, you're confusing Win2000 with WinXP.

Win2000 asks for an Administrator password during setup and always prompts for a username/password afterwards. The password, however, can be blank, in which case the machine is immediately vulnerable to remote attacks.

WinXP allows the user to set the machine up as a single-user one without a password, which then bypasses the logon screen. However, WinXP never allows user accounts with blank passwords to do anything remotely (single-user, multi-user doesn't matter here), so there's never a security risk from blank passwords as long as the machine is physically secure. If you don't want a password, fine, you don't have to have one, but you can then only use the machine interactively (not with RPC calls from remote machines).

The one change of requiring a password for any remote access to the machine is probably the single biggest factor in making WinXP more secure than Win2000. At the end of the day, most users don't want passwords and most users don't want to use their machines remotely, so the solution is ideal. Users who do want to use their machines remotely have to set up a password (of course, if they use weak passwords they're still vulnerable, but not nearly as vulnerable as with blank passwords on Win2000).

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

Yeah and the Windows 98/ME Administrator account totally prevents this, right?

It's a pity there is so much misinformation on Slashdot. Windows 98/Me don't have Administrator accounts and don't expose all of the RPC knobs that Win2000 does, especially the administrative drive shares. If you run Win2000 with a blank Administrator password, anyone can access any file on your system, execute arbitrary code (in System context), etc.

WinXP plugs this hole by restricting user accounts with blank passwords to interactive logon, so using blank passwords won't open up any of the RPC services to attack.

Re:The wool has been pulled over your eyes...

[Anonymous Coward]

This isn't really true. Systems like UNIX (incl. Mac OS X) and NT expose a lot of remotely-accessible services that more primitive OSes like Win9x and the old Mac OS don't have. If your machine doesn't offer any remotely-usable services, there's nothing to attack, hence it's much safer from direct attack. It's not safe from an attack initiated by tricking the user into running a trojan, of course, but the more limited the system, the less the attacker can do with it once he's got it anyway.

How about requiring updated systems instead?

[cbreaker]

Throwing the book at Windows NT and 2000 is a pretty cheezy way to prevent network problems. And Windows XP won't make these problems go away.

The "problems" they mentioned were both IIS "flaws" which have been corrected for some time now. Any other flaws exploited will also most likely be present on Windows XP Home, which has IIS as well (called Personal Web Server; incidently you can install a version of it for Win9x as well.)

"But how would they be able to tell if you have the latest service pack installed," you ask? I say, "The same way that they will be checking to see what OS you're using."

This kind of thing is almost expected at a University that is dominantly Macintosh. I worked at Brown University, and it was the same way. The general idea is: Mac = Secure, easy, perfect, flawless and PC = Impossible, buggy, useless. And all this because Apple has always pushed their machines on the schools.

Then all these students get out into the workplace and say "Uhh... where's the Macs?"

Re:How about requiring updated systems instead?

[Utopia]

XP Home does not have a webserver and PWS cannot be installed on it
unless you use this trick

Re:How about requiring updated systems instead?

[cbreaker]

Alas, you're right but the point still remains. It is possible to use IIS with WinXP Home, and by using a trick to make it go is probably worse then having it out of the box.

Many of students at schools do lots of things with their computers, so I would say that the "well, normal users wouldn't do that" rule doesn't exactly fit.

Re:How about requiring updated systems instead?

[Spock the Baptist]

" Then all these students get out into the workplace and say "Uhh... where's the Macs?"

Speaking as a died in the wool Mac user:

--The number of viruses that Windows is suseptable to is at least an order of magnitude greater that for the Mac. Thus, Macs are much easier to adminster than Windows boxes when it comes to viruses, t-horses, ect..

--I have over the course of the last seven years found that Mac users have little problem working in Win95 and later when it comes to office type software, web browesers, e-mail, and the like. That's not to say they don't have problems with system level snafu etc. in Windows, but then again most Windows have problems with system level issues.

--That many workplaces don't have Macs is a shortcoming of said workplaces. (I think that with the advent of Jaguar more workplaces will start *seriously* looking at the Mac as solution to their computing needs, and IT issues.)

Re:How about requiring updated systems instead?

[thesadmac]

Yeah, last time I checked, there was about 1 virus for MacOS; and that was a fairly harmless one.

I guess us Mac users are too busy experiencing our "vast social lives" to bother with virus writing. Unfortunately mine didn't come with a manual and I'm not having much luck getting to it to work, and you know what Apple is like with returns.

Re:How about requiring updated systems instead?

[MAurelius]

Thesadmac, You wrote:

I guess us Mac users are too busy experiencing our "vast social lives" to bother with virus writing. Unfortunately mine didn't come with a manual and I'm not having much luck getting to it to work, and you know what Apple is like with returns.

I am so sorry your social life did not come with a manual. Mine did not either, but I have managed getting it to work out. Good luck with that return. Keep trying!!

"I'm all lost in the supermarket I can no longer shop happily I came in here for that special offer Guaranteed personality" (The Clash, 1979)

Sorry, I could not resist.

Marcus

Re:How about requiring updated systems instead?

[smash]

The "problems" they mentioned were both IIS "flaws" which have been corrected for some time now. Any other flaws exploited will also most likely be present on Windows XP Home, which has IIS as well (called Personal Web Server; incidently you can install a version of it for Win9x as well.)

Nimda also infected machines via the IFRAME exploit in both Outlook Express (sending emails to target machines) and also exploiting Internet Explorer via the same exploit when viewing a page on an infected webserver. It also attempted to write itself to any accessible network shares.

So no, you don't need to be running IIS to be vulnerable to nimda...

smash.

Nothing New

[Albinoman]

At the university I used to attend (Dakota State University), they wouldnt allow NT/2000 or Linux because they can be used as servers. Now of course they didnt seem to know that they could be used for non-serving purposes nor did they seem to know that 95/98/ME could be used as a server. This isnt to say they could tell what anyone was using but it does demonstrate how naive their computing services staff was (the students employed there generally knew better), and I doubt that they are somehow unique.

Since the student newspaper article is broken

[Anonymous Coward]

At least we can laugh at the leadin to it on the main page:

ResNet has ordered a preemptive strike against a dangerous piece of software loose on the residential network: Windows 2000. Windows 2000 was "primarily responsible for hundreds of major problems" last year along with Windows NT, according to the ResNet Windows 2000 Policy available online.

Hey UCSB Linux Users Group!

[unsinged int]

That is, if you exist. Only thing I could find was this and the server was horribly slow so I couldn't get much info.

How about all of you get on over and set up a table outside the campus bookstore? I don't think I should have to explain why.

Re:Hey UCSB Linux Users Group!

[dburr]

I am the webmaster for the Santa Barbara Linux Users Group. We have recently gotten a domain name for our site, so the official address is now http://www.sblug.com/.

The server can get slow sometimes because it is being run on my personal (home) DSL connection -- only 128K outgoing -- and I was probably uploading a file at the time, or something like that. Recently I had a cable modem connection installed (in addition to the DSL) to use for my own personal use, leaving the DSL to run my websites and e-mail (since it has a static IP), so this shouldn't happen in the future.

What, no news of choices?

[E-Rock-23]

Aren't NT, 2000 and XP derivatives in descending order? Wasn't 2000 based on NT? XP on 2000? And we all know that they all have security issues (not to mention XP slows the HELL out of people's machines), so why even bother banning NT/2K without banning XP as well? If they're so worried about security, why not make the latest service packs available to students instead?

And why does this announcment not mention anything about alternate solutions? Why not make Linux readily available, along with its latest security patches, as well as any other *NIX OSs (BSDs, etc)? If the kids want XP for wasting time playing overpriced, overhyped games, fine. But give them the option, will ya? At least spread the word to those "not-so-geek-ish" students who might not otherwise know that they have a choice beyond the "Seattle Solution."

Re:What, no news of choices?

[Anonymous Coward]

That would be the 'Redmond Solution' - Redmond != Seattle. Never has, never will. Geographically close, yes, but definitely not the same place.

Interesting

[EnglishTim]

It is odd that they've banned 2000. NT4 I can understand, as there will never be any more fixes for it, but with 2000 you've got the automatic update feature, and I've have thought that XP and 2000 would share many of the same vulnerabilities. On a similar note a badly maintained Linux box could also pose a security risk, but with less computers on the campus running it, perhaps it would be less likely to reach the critical mass required to cause a lot of problems.

To be honest, I think their problem is that they've got a lot of people running their own machines on their subnet and most of these people will not be very concerned with security - it's always going to be an accident waiting to happen. I would have thought they'd be better off altering their network topology to ensure that the student's computers were sectioned off from the rest of the Uni, perhaps grouping them so that the damage couldn't spread too far. If they're not doing that already, of course.

Probably lack of patching...

[Kjella]

Is XP more secure than 2000 with SP3 or Windows NT with SP6(or is it higher now, don't use it)? I'll personally ridicule whoever claims that. Is XP more secure than NT/2000 with no service packs whatsoever? Yes.

Will it be any different when XP hits service pack 3 and nobody has it installed (or actually fewer than 2k boxes due to MS anti-piracy measures in their SP updates)? No.

The message is "you're too lazy to patch, so get the latest with the most patches pre-installed"

Kjella

I know an IP block to scan to test new XP viruses

[Anonymous Coward]

I mean really, why not just announce to the world that anything from 128.111.0.1 to 128.111.255.255 is probably now running XP?

They're only talking about W98

[EnglishTim]

Some other options are to downgrade to Windows 98, get a free operating system such as Linux

I think they meant:

Some other options are to:

o downgrade to Windows 98
o get a free operating system such as Linux

Having said that - superiority is in the eye of the beholder. Seeing as many of the W2K users didn't even set an admin password, I suspect W2K is going to be a better OS in their eyes than Linux, just from a usability point of view.

With a little help from Microsoft sales?

[Futurepower(R)]

Sounds like a Microsoft sales person is influencing the University. Here are some reasons why Windows XP is less than perfect: Windows XP Shows the Direction Microsoft is Going.

What is interesting, and unfortunate, is that Windows XP's faults are mostly avoidable. It seems that the problems are sociological, rather than technical. Microsoft seems to have become self-destructive, like Tyco and Enron. (Okay, even more self-destructive.)

By far the best marketing for Linux and BSD is Microsoft. It doesn't have to be that way. The cost to a corporation for someone working at a desk with a computer is so high that the cost of Windows is not a deciding factor. Linux is beginning to win, not because of the price, but because people don't like to be abused, and don't like the ridiculous security risks: (from the article)

"... as of September 9, 2002, there are 19 security vulnerabilities in Microsoft Internet Explorer [pivx.com]. (On August 8, 2002, there were 22, so some progress is being made.) This is a terrible record for a company that has $40 billion in the bank. Obviously, with that kind of money, Microsoft could fix the bugs if it wanted to fix them."

Like I said on the resnet forum

[CurbyKirby]

I'm kinda pissed that slashdot completely neglected my submission of the same story (I submitted it 3 weeks ago), but I'll reprint what I said here here. Please give your comments, but I still stand by what I said.

8/30/2002 2:49:15 AM

I'm writing this to the people in charge of Resnet policy, but also to people using Resnet. An outright ban on Windows 2000 will prove to be a costly and ineffective policy for increasing the security of Resnet.

1. Software and Bugs

Windows 2000, like any operating system, is a complex bundle of computer code. Like Windows XP, GNU/Linux, or MacOS, people find bugs in the software from time to time. Certain malicious people try to exploit the bugs to damage networks, reputations, etc. Other people develop software patches to fix the bugs.

Oftentimes, bugs are found with application software, like web browsers, web servers, e-mail clients, and the like. The operating system is generally not at fault. In this case, it just so happened that problems with some Microsoft application software were found in 2001 and combined creatively to create a series of rather devastating worldwide attacks.

2. Who is to Blame

It is important to realize that Windows 2000 was not the vulnerable software in these cases. Rather, bugs in Internet Information Server and Internet Explorer were exploited; they were the cause of the widespread effectiveness of the worms called "Code Red" and "Nimda." In other words, there are computers running Windows 2000 that are not and never were susceptible to Code Red, and there are devices not running Windows 2000 that were susceptible. Similarly, there are plenty of computers not running Windows 2000 that helped spread the problem through the Nimda worm.

Thus, these problems cannot be blamed on Windows 2000. Where does the blame lie? Programmers are bound to make mistakes, especially in an environment where a for-profit company is trying to produce and sell a modern operating system. Since few pieces of software are ever bug-free, it is ultimately up to system administrators and everyday users to make sure that their systems are as secure as possible (or practical). One of the ways to help increase the security of a computer is to apply security patches once they are released.

3. Patching Problems

A properly maintained computer is like a properly maintained car. Using a two-year-old unpatched computer on the Internet is like driving a car too fast on a twisting mountain road during an ice storm on bald tires. Using such a system or driving such a car is asking for trouble.

The bug in IIS that made it vulnerable to Code Red was announced two months before Code Red. The bug in Internet Explorer used by the Nimda worm was announced a full 5 months before Nimda. Yet even today, nearly a year after these attacks, thousands of machines worldwide are still unpatched. In other words, they are either infected with Code Red, or vulnerable to it. Unfortunately, many of these machines are likely to remain unpatched forever.

With that in mind, we turn now to the proposed ban of Windows 2000.

4. What problems does it solve?

Windows XP is not vulnerable to Code Red and Nimda. So upgrading to Windows XP does protect against certain problems.

5. What problems doesn't it solve?

It does not change the fact that improperly configured or improperly managed systems are vulnerable. It does not protect against attacks that have yet to be developed. It does not help educate users about ways to make their systems more secure. It does not help users of other operating systems running vulnerable versions of Internet Explorer. It does not protect against the thousands of other vulnerabilities that plague other operating systems. It does not stop denial of service attacks and port scans (that for some reason were blamed on Windows 2000 by the Resnet web page).

6. What problems does it cause?

Bugs that were introduced during the development of Windows XP could conceivably outweigh the bugs that were patched during that time. It would be naive to think that every bug in Windows XP is also present in older Windows operating systems.

The Products Use Rights document for Windows XP now includes a clause saying that Microsoft may access and change the operating system and its components without your agreement, and in fact without your knowledge. Suggesting that users of Resnet upgrade to Windows XP puts them in a position where they agree to relinquish control of their computers. Incidentally, versions of Windows 2000 up to service pack 2 do not contain this clause.

The ban of an operating system creates a dangerous precedent. Nowhere in the Resnet Acceptible Use Policy has there been any mention of the ban of a specific software product. The AUP does state that users cannot interfere with others, or with the proper functioning of the network. However, anyone would be hard put to prove that Windows 2000 was the sole cause of any problems by virtue of any fundamental and uncorrectable security flaws.

7. What are the costs of the upgrades?

As always, these costs are generally borne by the end users. They must acquire and install the software and learn to use it. This costs time and money and doesn't appreciably increase the security of the network.

8. What are the alternatives?

Requiring that users patch Windows 2000 systems would take less time and money. Verifying that a system was patched by probing the computer for the Red Alert vulnerability is no more difficult than fingerprinting the OS and checking that it is not Windows 2000. Certainly, installing a patch is a less intensive operation than upgrading an operating system and dealing with any problems and incompatibilities that may arise, so support problems faced by the RCCs are fewer.

In conclusion, the proposed Windows 2000 ban is both costly and ineffective. It seems as if the Resnet staff has already decided on implementing this "solution," which is lamentable. As there has been no discussion of or opposition to the ban on this forum, I felt it was necessary to provide a different opinion.

9. Resources:

Resnet Policy:
http://www.resnet.ucsb.edu/information/win2k.html
http://www.resnet.ucsb.edu/information/use_policy. htm#policy

Code Red:
http://www.cert.org/advisories/CA-2001-19.html (exploit)
http://www.cert.org/advisories/CA-2001-12.html (bug)

Nimda:
http://www.cert.org/advisories/CA-2001-26.html (exploit)
http://www.cert.org/advisories/CA-2001-06.html (bug)

Windows XP PUR:
http://www.microsoft.com/licensing/resources
http://www.infoworld.com/articles/op/xml/02/02/11/ 020211opfoster.xml

Re:Like I said on the resnet forum

[CoffeeBeanBen]

Hear hear. This is a heavy-handed approach that in the long run is probably going to cost more for everyone to implement and enforce than, say, our (UMass') approach which is to simply turn off the network jack associated with the misbehaving computer. Not only does this conveniently remove the problem machine from the network, but it also encourages the user to educate him/herself and be more proactive about computer security. As an added bonus, it also makes it more likely that good security practices will spread to other users within the dorm complex. Students who live in the dorms tend to, you know, talk to each other and stuff. Seriously, it's always been a more efficient enforcement practice in general to dictate what the outcome of a certain situation must be rather than prescribe very specific conditions or methods by which an individual must achieve the desired result. Saying that the user is responsible for creating a secure computing environment implies both responsibility and flexibility, and even allows the user to be creative and innovative in achieving such goals. Saying that the user is responsible for running 95, 98, Me or XP does NOT by any means imply that a secure system will be the result. Any operating system can get hacked. The biggest security risk in any computer network is, and always has been, the system administrator. Don't you forget it.

In their defense...

[OneFix]

They are banning W2k because it is more server-centric...and as such is more vulnerable than say WinXP, which is a desktop variant. Which makes Win2k a great target for virus writers. The reason being, these servers almost always have some sort of broadband and are always high-spec. This means that the virus can spread most effectively/efficiently when it exploits NT/2k...

I am certainly not saying they are right, but that having been said...

Some enterprising Linux vendor should immediately send a team of reps to this school (tomorrow morning if possible) to give away free copies of their newest version with Open Office and free support for everyone (Mandrake anyone?). It will cost them some money, but look at it this way, every student that switches will be a Linux advocate when they reach the corporate level (they already dislike M$'s desktop variant...or they wouldn't be running NT/2k). And they will probably always use that distro when possible.

Re:In their defense...

[Dynedain]

Win2k Pro is no more "server-centric" than WinXP Pro. All the networking and server-like features (i.e. IIS) work in the exact same way, and are in the exact same location of the operating system.

Re:In their defense...

[siskbc]

I'm sure there are scant XP Pro boxes on campus, as the cost and lack of piratability make it unlikely. I'm sure they will ban XP Pro if it makes it in. They are undoubtedly recmmending an upgrade (downgrade?) to XP home.

UCSB sysadmins just being lazy....

[MtViewGuy]

If the UCSB admins were smart they would have conveniently posted information about how to make Windows 2000 Profesional reasonably secure.

Things like installing Service Pack 3, setting accounts correctly, banning the use of personal web servers on a client machine, and mandatory installation of a good antivirus and/or firewall program would have saved the UCSB sysadmins a lot of headaches.

Re:UCSB sysadmins just being lazy....

[Large Green Mallard]

Yes.. I must say, if I were a sysadmin for a university, I would rather support a few walkthrus on setting an admin password.. (Cntrl-alt-del, log out.. login as administrator, c-a-d again, change password) instead of supporting a bunch of students in an upgrade from NT/2k to XP... Oh, and I would have firewalled ports 80/139 inbound long long ago..

Oh wait, I _am_ a sysadmin for a university..

Re:UCSB sysadmins just being lazy....

[smash]

The problem is plugging the machine into the network before it's secured.

I can see it now.. student builds, machine, plugs in to view the security howto and download service packs, and gets owned before they do the first reboot.

If there's viruses floating about on their network as much as they claim, then its quite likely to be owned that quickly...

smash.

Re:UCSB sysadmins just being lazy....

[MtViewGuy]

Again, the UCSB sysadmins are passing the buck on an issue that is easily fixed.

Given the cost of blank CD-R discs, they could have passed out to Windows 2000 users on campus a copy of Service Pack 3 plus a decent antivirus/firewall program on that CD-R disc. Install that before connecting the Win2K machine on the network, set the account permissions correctly, and enforce a ban on personal web servers running on client machines; that will usually be the end of the security problem.

Re:UCSB sysadmins just being lazy....

[madcow_ucsb]

Especially since, at least when I was a freshman there (I'm now a senior @ UCSB but have lived off campus since my 2nd year), they gave out a CD with stuff on it. I don't remember what it was, but they could EASILY have mandated this stuff. The first time you plug into the network (as of last year, anyway) it would put you on a seperate VLAN that always routes you to a webpage that asks for your student ID and name, etc and it registers that port/MAC address to you so they can hunt you down if need be. All they'd have to do is require you to download a few updates or push out a NAV corporate install from right there. It wouldn't be THAT hard...

Windows upgrade..

[hatchet]

Real students(not geeks) don't have money to buy new version of windows.. they rather get drunk and shag fat local chick.
They get new windows from the internet.. and campus should just put up ftp server with winXP availbile to anyone;) (heck put on few divx movies, unreal tournament 2k3, jenna jamerson XXX, ...) most of students would even pay for access:)

Re:Windows upgrade..

[Anonymous Coward]

IF they don't have money... Why don't they use a REAL OS then? (linux, FreeBSD, other *nix OS'es seen as real OS'es) Hell, even if you do have money, it would be better to switch!

Re:Windows upgrade..

[Anonymous Coward]

Hey! It's one of those REAL OS morons! The problem you have made here is that you assume FreeBSD, *nix based OS' etc are the "REAL OS", when infact, the only REAL operating systems are Windows and BeOS. Go to hell if you say otherwise. Run your shit, it's not my loss. I'll just keep running my quality system.

im confused

[tofutti]

http://www.microsoft.com/windowsxp/home/howtobuy/u pgrading/matrix.asp i thought it was interesting how they specifically said to upgrade to xp home. microsoft specifically says xp home has to be upgraded from 98/me, and NT/2k can only go to xp pro. so ucsb consultants are gonna help people FFR or what? am i right? or did someone already say this...

hypocracy U. they use win2k server for that page!

[kraksmoka]

being a die-hard *nix user, seeing stuff like this cracks me up . . . . check out what netcraft says they're serving the page announcing the win2k ban on.

typical

GOOD!

[Anonymous Coward]

Next they should ban the rest of the MS OS'es.. (for security reasons, of course!;) ) and then only allow people to run GNU/Linux and other free *nix OS'es!!! Now there's a good plan

Re:GOOD!

[Anonymous Coward]

that is a good plan.

So What?

[jwbrown77]

They're implementing a policy that I don't see a clear way to enforce. Shut off IIS and how are they going to remotely identify which version of Windows you're running? A queso or nmap scan maybe? Are those accurate enough in determining which Windows is which? Are the Windows police going to come around dorm by dorm and make sure you're running XP? They're telling me I have the choice between running the utterly unstable and insecure 9x or running the utterly insecure and spyware riddled/expensive XP. I run Linux personally almost all the time, but if I need Windows for something I run 2000 Pro. And if I saw someone trying to pull this on a network I was using, I'd likely just ignore it. Worst that can happen is they catch you and you just say "Sorry, didn't see that announcement." Moral: Run what you want, but be a responsible netizen and patch your stuff/use a good password.

Dumb Dumb Dumb

[Anonymous Coward]

If more people used port scanning they wounldn't have so many security problems in the first place.
Are they going to ban firewalls next?

The solution

[Anonymous Coward]

Have security auidits from time to time that include various measures to determine a computer's vulnerabilit using portscans, etc. If one's computer is found to be vulnerable or compromised, remove it's access to the 'net at large, and have all its DNS routed to some security page that contains a library of fixes, patches, instructions, so that even the least computer literate would be able to discover what is needed to restore the system to a state that is safe for the network.

You could call it brunr's shitlist or something like that. since I just thought of it right now :)

At my University...

[dadragon]

I attend the University of Saskatchewan, and our computer store is telling everybody who gets a new computer to upgrade to WinXP Pro from XP Home. See here to see for yourselves at the Campus Computer Store.

I myself use MacOS X which is also supported, as is OS 9. I can even get access to their Mac software library. It's neat.

If you're a CS student, you can get all MS OSs for free with your MSDN access, as well as Visual Studio, and lots of other fun software. Thanks to that access, my PC is using Windows 2000 Advanced Server, for its AppleTalk support :)

Re:At my University...

[Anonymous Coward]

Cool. What university do you go to?

why would you want them to control there own OS

[Anonymous Coward]

the school should set up an 2000 native domain, control all PCs on the network thru group policy, install office XP to block ALL attachments be DEFAULT, us winXP software restriction policy, distribute hotfixs with GP, assign apps with GP, make all students users, ban all legacy applications, apply the hi-secure template, use commons sense, make the network admins do their jobs completly and make all students pass a basic computer competency test(so at least all the people wasting their time learning useless stuff come away with something)and then hope for the best!

or use win98- oh wait that would be just plain silly. of course ME would be the best OS of all!!

It's still a party school.

[Vince]

I partied there last night, and when I woke up, I had no idea how I wound up on that couch...

So..

[Anonymous Coward]

Will UCSB pay for a new windowslicense (xp), a faster cpu(xp) and more ram(xp)?

We've been Slashdotted. Hehe. Thanks

[jasonla]

I'm the Online Editor for the Daily Nexus (the newspaper site that article links to). We've been Slashdotted, LOL. Thanks guys.

The site is still up and running though. Thank god I rewrote the site's PHP code, otherwise, we'd actually be down.

Re:We've been Slashdotted. Hehe. Thanks

[Anonymous Coward]

sigh, weaksauce dude... maybe you guys should hire me to write your php code. i go to ucsb.

and yes, our resnet administration is a bunch of idiotic fucktards.

Fatal error: Failed opening required '/home/wh35537/public_html/std_nav.php' (include_path='') in /wh35537/public_html/search/index.php on line 29

Re:We've been Slashdotted. Hehe. Thanks

[jasonla]

We actually are looking for coders to help me. It would have been nice if you left some contact information....

Re:We've been Slashdotted. Hehe. Thanks

[^MB^]

Boo Jason!

Anoymous Coward don't work for the nexus they pay shit.

"I'm the Online Editor for the Daily Nexus", Online Editor, what's that?

Everyone knows you're the nexus bitch....

-Nick (your neighbor)

Have you read the EULA for both XP and SP3 ?

[Billly Gates]

What if I do not want the spyware of sp3/WinXP or give ms the right to install apps without my permission on my pc?

I strongly advise anyone who has installed w2k on several pc's to not install media player 7 or sp3. Why? I am afraid ms will accuse me of pirating and will have the power to deactive my os or install god knows what on my system. ALso hackers could use this to pretend their virii are microsoft upgrades. I know xp mainly does product activation but the eula'a are getting more and more similiar and are sharing much of the media player updates and code. Media player is key for Microsoft's palladium strategy. I no longer use my older machine which now uses linux but ms can still accuse me and be the judge and jury over any copyrighted dispute between my pc's. This is true even though I have one valid license for win2k pro. Go read the EULA? It states that ms can kill the license of your os at any time for no reason! ....not to mention the sp3 EULA states that ms may install aditional software packages and change the EULA without my knowledge! Change the license without notifying me?

Why should I risk being hacked or bend over to the almighty gates? It really pisses me off that I am held hostage here. Be gald I do not go to your school. I have a very valid case why I should not switch to XP and would certianly bring it up to the deans. Even if ms will noy do any of things mentioned in the euls or deactive my copy of windows, I still will not upgrade out of principal. Security be dammed.

Re:Have you read the EULA for both XP and SP3 ?

[thesadmac]

There's an easy fix to stop MS ownzing your box when you install SP3, as long as you can use RegEdit.

A Good Laugh...?

[TuxGrep]

While this, at first, looks like a good laugh at the expense of Redmond, it is still what it is: Censorship.
I suppose the admins can ban whatever they like since its their network, but still...

Ask yourself this question: What outroar would've happened if you substituted "Debian Linux" where it now says "Windows 2000/NT" ??

I'm not trolling. just trying to view things in a fair manner...

What we need...

[brokenwndw]

...is for someone to implement moderation and karma for real life. So this sort of thing, and the others we always hear about, would be continually buried under a flood of (-1 WTF?), (-1 Hello, civil rights?), (-1 Contradicts laws of physics), and (-1 Just Plain Wrong), and fade, like the first posters, trolls, and goatse.cx links, into -2 obscurity...

Goddammit!

[Anonymous Coward]

I was I had the mod points to drive your post into the gutter.

Re:Goddammit!

[Anonymous Coward]

I do. Let's make a deal. $10 in the paypal ought to do it.

Re:Ugh.-solutions?

[Anonymous Coward]

Remember that article "/." had about a week ago about stealth-monitoring? Nimba on a properly set-up system will stand out like a beacon. Also a mail proxy with attacment-filtering can also help. Back that up with a policy that any machine caught compromising the system will be barred (maybe permanently). Give the student an incentive to care about the condition they keep their OS in. Distribute a disk(s) to all W2K and NT users with a program that makes the changes to defaults, including auto-update.

So to cut down on root exploits

[Rogerborg]

They recommend installing an OS with an EULA that allows Microsoft to root your box?

Why not....

[Dynedain]

We all know that Win2k is a hell of a lot more secure than win98/ME and probably just as secure as XP....that aside...

Why don't they do what my university did.....if your machine was detected trying to propogate nimda or code red, the smart switches disabled your jack. Getting it re-enabled meant calling Information Services Division and proving that you had cleaned up and protected your machine (downloading and installing the free copy of Norton Antivirus they provided).

It really seems to be a good system. Plug in an unregisterd NIC - blam - jack turned off and MAC address added to a blocked hosts list. Plug in a hub with more than one machine behind it...jack turned off. Run an unauthorized web server...jack turned off, mac address added to blocked hosts list. etc. etc. etc.

I'm suprised other large institutions don't do the same thing. It sounds like it would save a lot of headaches.

Re:Why not....

[Anonymous Coward]

"Disable my jack" and tell me to download Norton. Great plan!

Re:Why not....

[Large Green Mallard]

I'm a university department network admin. For the record, we do this too. It's reasonably simple :)

*pets the Ciscos*
*niiiiice cisco*

Also, using some of Cisco's really nifty features like Cisco-Discovery-Protocol (CDP) and ability to query with SNMP, it's quite easy to actually physically locate what switchport a machine is plugged into :)

Re:Why not....

[telstar]

Because it's easier to send out a memo and infringe on students' rights, than it is to configure a network properly.

Re:Why not....

[HardCase]

Because it's easier to send out a memo and infringe on students' rights, than it is to configure a network properly.

Uhhh...and exactly which rights were infringed upon? The right to connect to the Internet? That's a privilege. Regardless of how unfair you think the actions of the university were, the residents are obliged to follow its terms of service.

Still, I'm with you that it's easier to send the memo, but nobody's rights were abridged.

-h-

Re:Why not....

[fire-eyes]

Why don't they do what my university did.....if your machine was detected trying to propogate nimda or code red, the smart switches disabled your jack.

Interesting hardware. Could you tell us what brand and model this equipment is? I've not heard of such a thing. Sounds great.

Re:Why not....

[thunderbird46]

Umm... how are you supposed to download anything when your LAN jack is disabled? :)

Re:Why not....

[Guppy06]

"probably just as secure as XP"

Personally, I'd wager that Win2K is more secure than XP. Even ignoring the way XP SP 1 giving MS (or anybody posing as MS) remote admin rights, there is very little "new" code in Win2K. It's mostly an amalgamation of parts of NT 4 and Win98, code that has already gone through its own series of revisions and re-revisions long before Win2K was published.

XP, on the other hand, has a lot of new bells and whistles over Win2K, new features that have yet to really be tested in the real world. A lot more room for new exploits to be found.

Re:Why not....

[Dynedain]

I believe they are running cisco switches and have some kind of customized network sniffing software that watches for various things they don't like being done and then sends instructions to the switches. Its an entirely automated process.

Re:Why not....

[Dynedain]

you can download it with a friend's machine, go to a user lab, or even use a modem if you are that desperate.

Re:Why not....

[evil_qwerty]

How do you tell if someones behind a hub? Does this work for switches/firewalls/masquerading etc?

Re:Why not....

[Dynedain]

if they can see 2 mac addresses... then they know that there are more than one machine on a hub or switch

I think they also use some kind of traffic or packet analyzer to watch for most routers....although I never had a problem w/ a software router and 2 network cards

This Is Happening All Over

[the_mystic_on_slack]

The University of Notre Dame is doing basically the same thing. Though they do not cite security reasons, they have stopped all support of Win9x. And if anyone thinks the schools and M$ are not in bed, then take a look at the increase in academic pricing. Windows used to be $25 (as well as Vis. Studio, et al) but now they've gone to $45. Funny how that happens as soon as they mandate the upgrade to a new OS. And WinXP is just as vulerable to all the worms that 2k is (for the most part). For example, I accidentally left a share open for no more than one hour and the open folder was filled with Nimda. In other news our LUG is planning an install fest in the near future.

Re:This Is Happening All Over

[Large Green Mallard]

My university pays the equiv of US$90/copy for WinXP Prof... and that's just the upgrade. The original install you have to buy OEM, which is about US$170 (this is in Australia)

So $45 would be great for a license to install it on a blank box.

huh?

[lingqi]

what I don't understand is... how does this make XP a better choice?

there ARE known vulnerabilities of XP pre-SP1 you know... and it's not like people who doen't do updates will just all the sudden start to religiously do updates. and if the users arn't setting a admin password on 2K, what, you think they suddenly get enlightened at the campus bookstore and decide to set a password for XP?

FURTHERMORE -- i am figuing that most people will come home and do a UPGRADE from their 2K / NT machines -- which means that all the settings (blank password) will carry over nice and happy... worse yet -- the old "do not automatically update my machine" setting will probabbly carry over too, making the upgrade even less effective.

i mean, in the end you are forcing these poor students (hey, i was a student, i was poor, and everyone i knew was poor (or had better place to spend money, like strip clubs or beer)) pay for the equivalent of two service packs. wtf? later you will force everybody to buy palladium because they didn't patch XP up _just_like_now_?

for that kind of effort (helping everyone upgrade etc), hold a fscking 1 hour session on how to manage your computer... add in some talk about how to hide your pr0n browsing so your gf / room-mate don't dig up your history files etc to spice things up / get good attendance. and have a copy of SP3 somewhere local where everybody can get it without killing the bandwidth will probabbly help. (burn some CDs and give out for free, maybe?)

Kings College, London

[isorox]

KCL, UK ban linux, stating You may not run any Unix operating system since they can represent a serious risk to network integrity. Any student found running a Unix system (e.g. Linux) connected to the College network will have that system disconnected.

I tried emailing them a corrected version, but their email address was down - so much for network integrity.

"You are encouraged to run a Unix based operating system since they dont
suffer serious risks to network integrity like Nimda, Code Red and Outlook
Worms. Any student found running any insecure system (e.g. most windows
boxes) connected to the College network will have that system disconnected."

Confusingly they do allow the unix based Mac OSX.

Re:Kings College, London

[supafly613]

Perfect example of uneducated IM staff. Hey..I hear they're pushing to make Windows 3.1 the new campus standard. Someone told them it's secure ;)

Re:Kings College, London

[MightyTribble]

Hey! That's my Alma Mater!
No surprise they're banning Linux; net services sucked so much when I was there, I scammed myself a UNIX account up the road at UCL. KCL's computers used to be a bunch of BBC 'B' micros serving as dumb terminals for their VAX system. They had no helpdesk. One of their labs was in an old plague pit. They had one grouchy old lady operator (in the 'old skool' style) and you had to apply for special dispensation to have more than 256K (yes, K) of disk space. Office hours were 2pm - 4pm, Wednesdays.
Ah, memories!
It's no surprise they're *completely* clueless... they have no history of decent computing or having a helpdesk. Now, UCL and Imperial, they have a clue... good helpdesk, too (at least at UCL, didn't get a chance to talk to the Imperial folks).

Wouldn't it be easier (and more enforceable)

[drachen]

to just do what they do at the University of Maryland and block Netbios and SMB? Seems like it would be more difficult (and costly) for them to just force people to upgrade to XP when a number of security vulnerabilities also exist for that. Sure blocking these services isn't a catch-all solution, but neither is forcing people to use a newer yet still buggy version of Windows.

unbelievable

[shd99004]

Windows 9x/Me is permitted but NT/2000 is not? So I guess security reasons can be ruled out.

AMEN!

[Dahan]

Really, we're talking about NT/2000 Workstation/Professional here, not any form of NT Server. I can't believe that post is currently at 3.

P.S. The upcoming Windows .NET server will not install IIS by default--at least the Standard and Enterprise editions won't... I don't know what the Web server edition will do, but it'd be amusing if the web server edition didn't install a web server by default :)

Security...

[John Pfeiffer]

What? The computers with 2k installed were too secure for them to gain access to and search for pirated material and P2P software?

UCSB Bans Sex in the Dorms

[darekana]

Claiming it causes:
Transmission of virus' and makes it hard for other students to sleep with their ears to the wall.

Re:UCSB Bans Sex in the Dorms

[Anonymous Coward]

They cant do that... I mean they dont call it the University of Casual Sex and Beer for nothing. Of course i went to the school for a year and didn't like it at all so I didn't go back. My friend was the roommate of that guy that ran over 5 people in Isla Vista. We called him "crazy dave" before all that happened but you cant get a guy arrested because you think he's gonna kill someone. We werent suprised when it happened.

Poorly trained staff maybe?

[supafly613]

Maybe they should take the money they make on all of these XP sales in the campus bookstore and re-direct the possitive cash flow to IM training. How about a course on inter-campus firewalls? No...that would be too easy...let's just make every student, who already are on a tiny budget, spend more money for something that they don't need or want.

No no YOU read it again

[CurbyKirby]

They also agreed that if you have to run win2k they you can aslong as you secure the system and talk to them about it.

Actually, no. See the resnet page, which says

Exceptions will not be granted for reasons other than academic necessity.

See also the Resnet forum thread where a user says

I am a computer science major and have more than 15 GBs of SDKs, source code, compilers, and Homework that would take weeks to restore to a point where i can use it again. I do want to upgrade to windows XP, but i can not sacrifice the time necessary to do so. And regarding the request for an exception, i did request it, and was denied, desipite my knowledge.

They even went as far as giving all of the students antivirus software ... but the students decided not to use it.

How is this related to Windows 2000 being fundamentally broken? Are you saying that only Windows 2000 users neglected to install their anti-virus software? Is this because they were using Windows 2000 instead of another OS? Otherwise, that statement is not relevant.

I think XP is allowed because it would be hard for them to block XP Profesional without blocking the Home edition.

XP is allowed because there are certain problems in Windows 2000 which do not exist in Windows XP. Nothing more, nothing less. See the above links. Banning one and recommending another hurts the network in general at least as much as it improves certain aspects of security.

I don't know about you...

[Anonymous Coward]

When I see a wildcard ( * or % ) I enumerate it to "all", and I usually say "all" if I am talking to somebody else.

So, um, yeah. net send * / net send all, same thing to me.

And in other news...

[Ektanoor]

The most recent M$ press release shows that XP sales in academical circles skyrocketed for the last weeks with a record 5 times increase. "This shows that XP is getting a higher than expected level of acceptance among the students, soon it will probably take a good segment of the market out of the concurrency". "JustInTime4PR" Corporation, specialized in market analysis added that this boost is particularly significative of the tendencies - "When did Linux had such success? This proves our predictions that the boost this OS had was merely temporary and just a backward effect of some customer dissatisfaction while waiting for the new and improved XP. Now XP took the lead and probably we are not going to hear of Linux for long... The fact that Linux developers were always lenny to add "Start" button on desktop made them loose the moment.Till now Linux ain't desktop ready and barely can achieve it..."

According to other sources, there are chances that this new sales record will be beaten when more and more Universities will attain a bigger level of acceptance for XP...

Re:And in other news...

[interstellar_donkey]

And how many of those sales were from students with brand new computers who quickly discovered how bad ME is?

At my place it is other way round.

[PineGreen]

At my department, it is other way round. There is special document on XP that goes:

Windows XP is beginning to appear on new machines, and is also being
installed on some old systems within the Laboratory. There are some
security issues with Windows XP that are not obvious to inexperienced
users, and there is a Lab policy at present that any Windows XP machine
MUST be installed/configured by someone with a high degree of experience
if it is to be used on the network. For the * Group, we have agreed
with the C* IT-Dept that all Windows XP systems will be installed
or checked by one of us to make sure that the known problems are being
dealt with.

So much about objectivity of various security issues...

two nice XP features:

[spongman]

ClearType.

Remote Desktop.

Re:two nice XP features:

[Com2Kid]

Remote Desktop.


Bull

Fucking

SHIT

I have that on 2K, thank you so very much. Please stop believing MS fud, just because messenger tells you that you have to 'upgrade' to XP to use that feature does not mean that it is true.

I'll grant you that a pretty icon was shoved in front of it, but hey, a pretty icon is not a feature.

ClearType.

Forgot about that one, with font antialiasing and smoothing on 2K and all, that and me not owning an LCD.

I have seen demos of ClearType on 2K though that took up under 100 Kilobytes, hardly a 500MB feature.

Re:two nice XP features:

[spongman]

the remote desktop stuff tht comes with 2k/messenger is NOT the same as that built into xp. the xp stuff uses domain authentication and doesn't require someone sitting at the server to allow you to connect - you can use a regular terminal services client to connect.

some more key features (for me):
TAPI 3.1
wireless networking support
as for cleartype, for me the difference between it and regular antialiasing is night and day, and since my C drive is 210Gb, I'm not concerned with the space...

Re:two nice XP features:

[Com2Kid]

• User #182339 Info | http://www.friskit.com/)
• 
  the remote desktop stuff tht comes with 2k/messenger is NOT the same as that built into xp. the xp stuff uses domain authentication and doesn't require someone sitting at the server to allow you to connect - you can use a regular terminal services client to connect.
  
  
  *sigh*
  
  2K has that.
  
  *sigh*
  
  
  • as for cleartype, for me the difference between it and regular antialiasing is night and day,
  
  
  As I said, only good on LCDs.
  
  
  • and since my C drive is 210Gb, I'm not concerned with the space...
  
  
  Yah nice idea there bub, support code bloat cuz hey, who needs to worry about space?
  
  Its the principle of the thing.
  
  Remember those huge cars that used to get only 6 or 7 miles to the gallon? Who gave a care, Gas was so cheap!!!
  
  It ain't about the price of gas or how much space you have on your HD, it is sheer irritation that the system is put together so craptacularly.
  

Re:two nice XP features:

[spongman]

*sigh*

2K has that.

it does? please tell...

Re:two nice XP features:

[Com2Kid]

Start up netmeeting, there is an option for a remote desktop server thingy to be enabled in the background when you start up your computer. (be careful not to set it up running and not select "automatically give control when requested", heh) you can set a password and secure session and everything. The other user has to call you up or look you up in the domain and they can, after entering proper authentication information, work everything just like normal.

Terminal Services can also be used to have complete control over any desktop in a building, as it was I saw a setup on the Microsoft campus where there was a complete list of Windows 2000 machines in the domain listed with all of their icons, and the dude just selected one to login to, entered his information, and pop, had control.

iterative vrs. recursive

[Anonymous Coward]

Yes. It's iterative, not recursive.

The formmer applies to repitition, the later aplies to an expression in which the result is reapplied to the expression.

Think of it like this:

You're a dirty old eternal man. And you boink a girl. The next day, you boink her again. Next day you do it again. And again, and again. etc.

That's iterative.

Now say you boink her once. She has 7 puppies. They grow up and you boink each one of them once too. Two of them each have a litter of 4. They grow up and you boink all 8 once. etc.

That's recursive.

It's doing the same act. But doing it to the result of the previous act.

Re:iterative vrs. recursive

[thesadmac]

Dude, WTF was your Computer Science teacher on?

Re:iterative vrs. recursive

[ethereal]

More importantly, if you think you can get puppies from doing a girl, WTF was your biology teacher on?

I guess the jokes about paper MCSEs are true

[alizard]

But who would be stupid enough to put them in charge of a campus network?

Well, I guess the answer is obvious.

Good news for anyone whose handle is in some form of l33t sP34k and has been looking for a good place to try all the exploits described in BugTraq.

However, if I were a CS student there and got that notice, I'd be looking hard into transferring as of the next semester.

Getting an education in the area of computing is hard enough without having to use a network where the admins have admitted in writing that they are clueless.

I suspect they're going to live to regret this. Unless they really enjoy cleaning up messes.

I'm really sorry....

[oldBullBalloon]

but I'm trying to be polite...how can (apparently otherwise) intelligent uni students fall for this?..corporate exploitation at it's unappealing extreme..notice there's no actual denigration of the product, it's just those "dumb users" (and where, slashdotters, have we heard this before?) who can't make it work... all to get the "upgrade to XP Home" message from your friendly campus bookstore...\ cranky bull.

the other way around

[Ruliz Galaxor]

Hmmz... I wouldn't be surprised if MS would forbid any linux machines on it's campus, but this is quite the other way around! Now users are actually forced to buy a new OS (or download a free one of course), because they cannot run the most stable Windows OS (2k).

What's next: no, you cannot use Nokia cellphones, because they cause to much interference in comparison to others? or you cannot buy cookies because they crumble to much in comparison to bread and they give clean-up problems?

So much about free choices :S
They should actually rename this topic to a YRO-topic.

sig(h)

Sigh

[dazdaz]

Can they really do this? What grounds is there for an objection? The end user operating system should not be their determination when it's used in dorms, even if used in their network.

What I really dislike is that they've dictated terms, this is something that has been coming for a long time, now await this madness or political correctness to grow.

How much did MS pay UCSB?

[f00zbll]

some one must be getting a bribe or kick back for this one. why play fair when you can buy the people in charge with a little bit of money.

Proof posititbe that our Education System Sucks

[linuxislandsucks]

Imagine that a colege it person stating that becuase MS IIS is insecure they will not allow win2kpro without MS IIS on their networks..

Like how many win2kpro users install MS IIS? Try zero..

Yet they allwo win95 and win98 two of the most insecure windows version on theplanet on their networks..

Did he or she get padi off by MS?

Re:Proof posititbe that our Education System Sucks

[Anonymous Coward]

You would be suprised how many people run IIS on their 2k pro machines. I'd wager that 80% of the people in my A.P. Computer Programming class have done just that.

howabout this?

[r00tarded]

you change your school mascot to the Blowfish and you can run OpenBSD for free.

It makes sense to me...

[tgrimley]

After all, how are you going to exploit a win9x machine when it is only up for 5 minutes at a time before it crashes?

Voodoo Administration

[erroneus]

That's all this amounts to. They run around scared with half or less of the knowledge and understanding required to make such decisions. And even in light of the information, they go with their knee-jerk reactions rather than a scientific approach.

All of this taking place in an institution of higher learning? It's just amazing. I can imagine this happening very easily in some corporate setting, but not in schools. I guess the number of the enlightened isn't as large as I once suspected.

FUD rules the day once again.

Personally, in addition to my Linux boxen, I like my Windows2000 machine. After service pack 3, I can now use my video camcorder again to do video editing... (now if I can just bring myself to erasing all this useless porn to clear spact to do so...) Before I get blasted with "why not use Linux?!" first I'll just say I'm a lazy bastard and I just don't have the urge to read the thousands of HOWTOs associated with whatever is required to do the same with Linux. I think I'll switch to Mac OSX before I try it with Linux. ...anyway... off the subject...

It's scary and creepy the way some people think. It reminds me of the last time I was ruled out from having a job at my last interview. In this case, I listed Linux, HP/UX and AS/400 as other operating systems I am capable of administering to. They proudly touted "we're a Microsoft only shop here" as if that were some great accomplishment -- a badge of honor. All I could think was "oh, so you only know how to do your job with a mouse running 'wizards' to accomplishing the things MS thinks you want to do."

I heard there is black magic on the WindowsNT and Windows2000 and so I do not allow such magic on my network. Get thee back Devil2000!! Get thee back!!!

Isla Vista, gag.

[machinegestalt]

Isla Vista (I.V) is one of the most notorious college towns out there. Between the 3 or 4 deaths in a suburb of 10 thousand in the last 2 years due to inebriated stupidity, drugged kids driving cars over people, the complete lack of sidewalks, and the near ubiquity of venereal diseases (It's nicknamed H.I.V), then you have to contend with the outrageous rents in Santa Barbara (be prepared to share a room or live in a slum if you want to pay less than $550 a month). Every weekend people wheel kegs out on to the lawns of Del Playa Road and you end up with a bunch of hazed students passed lying passed out all over the place while some white trash guy is either trying to molest, rape or ghb his way into some stupid girl's pants. UCSB isn't too bad but I'd like to see IV burn to the ground.

Machinegestalt

Re:Isla Vista, gag.

[roe1352]

You obviously have no idea what you are talking about. Yes, there are people that get drunk and fall off cliffs or things like that, but they are usually out-of-towners. Attias was a psycho, not just some "drugged kid". About living arangments, all of Isla Vista is a slum, and yes you have to share a room, but its not a big deal. About STDs, get some statistics or studies on the subject or stop repeating an old joke. In Isla Vista you can party a lot, and study a lot, you just have to find a balance. IV rocks, I loved it during my time there.

Sue, you idiots!

[Anonymous Coward]

Start a class action lawsuit!

Your rights are being violated!

It's the American way!

Switch to Linux

[SabberFlapper]

What you need is some student protests to get Linux on the campus!!

What about other OSes ?

[tmark]

While MS OSes are notably insecure, I wonder what the University's policy is towards OTHER insecure OSes - like a Linux box that isn't secured properly. Do they run audits and checks against every Linux machine on their network to verify against known hacks ? It seems to me like they should, if only to be consistent.

Re:Not a scam BUT how is that possible

[Anonymous Coward]

I thought Microsoft Operating Systems were so easy to use that anybody could administer their own machine. If not then why bother with windows?

So...University bans OS choice on campus

[Anonymous Coward]

and Slashdot isn't screaming????

If they banned Linux wouldn't the community be up in arms?

If the issue noted here is not a fatal flaw in W2K/NT but rather lack of administration of those boxes then how far behind this ban is a ban of Linux?

Re:Ugh.-solutions?

[PainKilleR-CE]

Distribute a disk(s) to all W2K and NT users with a program that makes the changes to defaults, including auto-update.

ns, most schools that I've been to which offer network access will supply a disk to simplify setting up the computer for their network. It's fairly simple to put together some scripts that check the version being run and set it to update the computer from the internal network or windows update, as well as change (or prompt the user to change) any non-secure settings.

My school tried this...

[DaHat]

They tried to be even more extreme and ban any Operating System that could run server software.

Lets think about this one.

.

.

.
Can anyone think of an OS that wouldn't be ban?

This policy lasted for about a week.

No mac server ever exploited in history !

[Anonymous Coward]

On securityFocus (bugTraq) database are listings of thousands of remote exploits and hacks.

None exist for MacOS 8.x and 9.x. including latest 9.2

I am not talking about unix based Mac OS X (which has had over 30 exploits so far).

The Mac OS is the BEST way to run a web server on the internet. There are some high performance (though 400 dollar) web servers that make it even better.

Hurray for the unkrackable unhackable macOS!!!!!

shame on linux and even OpenBSD

Re:No mac server ever exploited in history !

[Anonymous Coward]

The reason for no exploits is of course because it has been far too difficult for hackers and exploiters to find those two webservers on the internet that us Mac OS.

Re:No mac server ever exploited in history !

[Anonymous Coward]

The Mac OS is the BEST way to run a web server on the internet

Yes best if you don't mind the lack of stability.

Ask yourself this, if it was the best how come Apple never used it for their webservers? Before OSX they used AIX.

Re:No mac server ever exploited in history !

[Anonymous Coward]

Well, I'll tell you, a server running Mac OS is unhackable. But, it's not that stable and not that powerful. If you serve lots of static pages, it's a pretty good thing.

It's not very good for general use though.

Mac OS X is another story....

Vmware

[Anonymous Coward]

If you need to run Win2k for some reason, just use VMware with vmnat. Just be sure to have konqueror or mozilla on your linux/vmware box in case they check the user_agent string. Of course, vmware doesn't support directx, so if necessary, run a heavily stripped down 98se/win2k (is there a win2k lite?) system. With all the hacks to strip it down into a lean gaming OS, it would be hard to call it windows anymore.

Re:I know an IP block to scan to test new XP virus

[Anonymous Coward]

thats all UCSB, not just resnet. whatever, just wait until a good XP virus/worm gets out and screws everyone all at once.

why change, this semas like a money grab

[VEGETA_GT]

Well the other day I was talking to a friend who just did a compleate study for a large companey here in canada he works for. The study, should tye move from 2000 to XP. things taken into account are advantages and disavantages for the change, security, and ease of movement. Probaly more but hey I was not taking notes. And gess what, the resport says that there realy is no advanatage to move to 2000 and XP only has some more things built into it (which can be more issues then they want to deal with). Security, 2000 has proven itself some what secure, and no real security advanatage could be found. and cost, well M$ would have basicaly screwedthem out of a LOT of cash for basicaly nothign big.

Personaly I have tryed XP, and reality is, its 2000 with a new look and more crap built into it. And I have had issues with som much software bult and integrated right into windows before. So adding more is seen as a bad thing unless m$ can put out beter quality code.

So in all honesity, I have seen no reason personaly of by study for anyone to waste there hard earned cash on XP if they are alreasy running win2000.

now my next thought is, how can the collage justify forcing people to either buy a copy of XP or pirate it (and we know the free thing well be more popular). I would not be suprised the university has grants or somthing from M$. But hey what do i know right.

Also one last note, if the school is wanting security why are they not forcing fire walls instead, or better yet making students use linux. Just a thought here

my 2 cents plus 2 more

lala

[Vodak]

The people in charge must be rerading grc.com too much about the evils or WindowsNT..

*nix SSL vulnerabilities???

[zerofoo]

What about the various flavors of unix with SSL vulnerabilites? If these these kids can't run "windows update" successfully and keep their windows systems patched, what makes the IT morons at UCSB think they can keep their unix systems patched?

-ted

Kickbacks, anyone?

[fudgefactor7]

What do you bet that they have an agreement with Microsoft to do this and each sale of XP (at normal retail price, naturally) is a major markup from an agreed upon bulk purchase amount. Buy low, sell high, eliminate the competition. That's the American way!

All hail lord Migor

[Anonymous Coward]

Migor knows what you are doing in your dorm room.

Migor Sees all.

Migor cares not what you run, for Migor is your new king!!!.

Security Toolkit anyone??

[Anonymous Coward]

Um, here is something they could try, how aout providing a link to MS Windows Security toolkit. It performs a pretty strict lockdown. I am not saying it is 100%, but it takes care of the majority of the problems the were discussing. Also jsut have them run the default of the IIS lockdown tool. There problem solved, easily and freely. Who are they to say what OS a student can and can't run, so much for freedom of choice or preference.

Back in my day... :)

[cjsnell]

Here is a fun little prank that I did back when I was in school (1993-1997):

When I was a freshman at Vanderbilt University, we used the campus VAX to register for classes. It worked like this: you would go to one of several large computer labs on campus and log onto the VAX as user REGISTER (or something). Once you logged in, the registration program would fire up automatically (via the VMS equivalent of .login). Anyway, one day at the beginning of the semester, I was feeling a bit mischevious. I was in one of the larger labs and it was packed to the gills with students trying to register. I logged on to the REGISTER account and did something that was similar to ctrl-z suspending and suspended the registration app. Now I had a command prompt. Next, I used the VMZ equivalent of write(1) (...gosh, what was it?) and sent a message out to everybody else using the REGISTER account--literally hundreds of students...

ALERT: THE REGISTRATION SYSTEM WILL BE CLOSING IN 30 SECONDS. PLEASE MAKE YOUR FINAL CLASS SELECTIONS AT THIS TIME.

The first thing that happened when I sent the message was several hundred PCs beeping loudly all at the same time. And immediately after that...you should have seen the looks of panic on all those sorority girls' faces! :)

Re:Back in my day... :)

[operagost]

The system manager made a big boo-boo by not setting the register user as captive, which means breaking out of the login script logs out the user. Would have been nice to at least remove the NETMBX priv, so you couldn't send your REPLY (that's the equivalent of write on VMS). I have a public account set up with triple coverage: the user is CAPTIVE, without NETMBX, and NOCONTROL = Y in the login.com.

Re:Back in my day... :)

[hearingaid]

OMG, you are so correct!

The sysadmin was really lucky nobody was clued-in enough to login with /NOCOM.

However, how much do you want to bet the DECnet account had SYSPRV? Far too many systems where dumb sysadmins exist have that set up. I'm not sure if it's a default VMS hole, but it's a really big one. Anybody with a copy of tell.com can login /NOCOM to a NETMBX-enabled account, upload tell.com, and run AUTHORIZE over DECnet. Authorize the non-captive passwordless user for SETPRV, and everything goes nuts in a hurry. :)

Sweet Sweet Irony

[vorgriff]

Slashdot hates Microsoft
Slashdot hates Censorship

What does Slashdot hate more?

Censorship against Windows.

Shit, I think those are pigs in the window.

Only NT4

[0x0d0a]

Only NT4.

NT4's policies are pretty bad. It defaults to a blank administrative password, an administrator username of "Administrator" (and there are ways to obtain the administrator username if this is changed, anyway), sharing all the drives as hidden "administrative shares", *resharing* them at the next boot if you disable sharing...

The best thing to do is just axe the Server service. I've seen so many remotely exploitable boxes (probably ~70% of home NT4 users had this open) that it would blow your mind.

Then if you upgraded from NT4 to 2k, it would keep the same configuration...

Re:Only NT4

[Wudbaer]

Even NT4 prompts you for an Administrator password on install. Ok, you can use a blank one, but the same should be possible on any operating system I know including most Linux distros. And even on all common Unices there is a well known default for the admin username. That can certainly be changed, but the same applies to NT.

You are certainly right that a lot of people use questionable system setups out of sheer lazyness or ignorance, but this is more a problem of the average of people using common customer OSses vs. more technically inclined users using Linux or a BSD.

AFAIK there is currently no OS that protects you against being an idiot. ;-)

Re:Only NT4

[Anonymous Coward]

Any Linux distro I've seen would at least give the user a big fat warning if they tried to enter a blank root password, some wouldn't even let you do it since it's such a bad idea.

comment

[Anonymous Coward]

its funny how sales of xp are up but arent most windows software at universities like 5-10 bucks anyways?

Upgrade to a Mac

[Frobozz0]

Better yet, why don't the recommend an upgrade to a Mac? :-)

Not a Bad Return on Investment

[DaytonCIM]

Microsoft is listed as a Cumulative Donor of $100,000 to $499,999. Really not a bad investment on Microsoft's part:
1) donate $300,000 and "advise" school that NT and 2000 are not secure.
2) offer new OS at reduced price to school book store.
3) report increase in new OS sales to invest ment community.

Hmmmm... I wonder how many other schools will follow suit?

Odd division

[fire-eyes]

I don't quite understand why it's just NT and 2000.

I think all of us know here the security history of all MS operating systems, and XP is ramping up to be the worst of them, and they reccommend that?

Interesting, UCSB. You're half way there, go all the way!

Uh huh......

[Wedge1212]

back in the day. Our resnet admins used to scan for Administrator accounts with out a password. I goto Baylor. They also did not approve of anyone running a web site, but they left port 80 open to servers. But just to becareful and aviod some trouble I just ran my site off of old gopher ports.

what?? yes they have said it's illegal

[klparrot]

The univeristy doesn't declare certain types of machines illegal, they just refuse to support them.

Read the link; they don't just refuse to give tech support to users of Win2k, they block Internet access to Win2k machines. So, in other words, Win2k is illegal on ResNet.

School is offering to help with cost and support!

[Ashurbanipal]

If you actually read the linked story, you will find that the college is willing to pay the bill to give students a better OS.

Unfortunately, the increased hardware requirements of XP over earlier windows versions may become a problem for some students. Hopefully, the college has recognized this and will provide win98 assistance also (not that win98 is better than XP Pro, but it's not much worse than XP Home (NEVER NEVER buy XP Home, regardless of what the school says).

Re:School is offering to help with cost and suppor

[kmellis]

Huh, I did read the story, but I must have rad too quickly. Um, well, I read their statement. Was that the same as the story? It's been so long ago. Hours, even.

We recomend 2000 or XP Professional

[BoFiS]

I work for ResNet at the University of Rochester and we recomend that all incomming students with PC's buy them with either Windows 2000 or Windows XP Professional. We specifically would not like them to have XP Home as then they will not be able to VPN into the wireless network as well as other things. While we don't like Windows ME, we still allow users who already have it to continue to use it and will support it if any problems arise. In fact, if you have Linux and can't get the internet to work, we will help you out to the best of that consultants abilities. It's silly to limmit what operating systems users can use, especially for security reasons. When we had an outbreak of Klez and Nimda last year, we licensed Trend Micro for the entire campus and setup an online install for all students and then had the RA's do a hall program telling everyone who didn't already have an up-to-date antivirus to load Trend which updates itself automatically.

Instead of telling people they can't use an OS cuz it's insecure (even if it's not), they should educate their users on how to make it secure and then deal with those who are still at risk.

Sounds Like A Scam

[fire-eyes]

Residential Computer Consultants will be available to assist with these upgrades, and Windows XP Home is available in the UCSB Bookstore at student rates. Students on financial aid can receive an augmentation of their award to cover the cost of the upgrade.

Perhaps I'm being paranoid here, but this sounds like a scam... I can't think of any other reasons to only ban a few versions, yet push for the latest version of windows, in the book store of course...

Actually XP is more secure than 2k in some ways...

[sheldon]

"Is XP more secure than 2000 with SP3 or Windows NT with SP6(or is it higher now, don't use it)? I'll personally ridicule whoever claims that."

Try this...

Set your local administrator to a blank password on both your Win2k and XP desktops.

Now try to connect to the administrative shares(C$, etc) across a network from another machine.

On XP a blank password on a local account is more secure than a weak password, as it blocks all network access for such accounts.

As for the patches... It's easier for the UCSB staff to suggest people upgrade than to explain to them how to apply patches. Although Win2k/XP is pretty easy to patch if you use the automated update service.

Easier Solution: Install Windows XP Professional

[sheldon]

This will at least solve your blank Admin password problem...

"To protect users who do not password-protect their accounts, Windows XP Professional accounts without passwords can only be used to log on at the physical computer console."

I don't know if this also applies to Home. I can't find anything suggesting it does, and do not have an installation I am able to test on.

Go Gauchos!

[Anonymous Coward]

IS there really anything else that needs saying?

All about the benjamins!

[Maul]

Come on, this is obviously all about selling new software to freshmen from the campus bookstore. UC schools (and probably other schools) pull stuff like this. They feed off the ignorance of most computer users to make a quick buck.

When I was an incoming freshman at UCSD (in 1998), many students did not have network cards. The campus resnet handout they gave us said that students needed a network card to use the net connection in the reshalls. Fair enough. But then it STRONGLY SUGGESTED that students buy the network cards that they sold in the bookstore, "just to be safe so that they could connect to the network."

Not surprisingly, the they sold ethernet cards at a staggering markup in the bookstore (I think it was about $80 for a card that you could buy for $40 at Fry's). They also apparently were marking up the patch cables quite a bit!

I was very shocked when my suitemates came in first week complaining about how much they had to spend to get onto the network at the bookstore!

laughable at best

[Nephroth]

In all reality, windows 2000 is probably the only windows OS that doesn't have some glaring irreparable security fault. XP is certainly more vulnerable to attack than 2K, I think they just want to sell copies of XP to line their pockets a bit thicker. Frankly, I can't blame anyone for not wanting to run XP... microsoft fixed their big, ugly GUI with a bigger, uglier GUI... whatever happened to your friendly command prompt.. oh yeah, that's right it's still used in linux ;)

System admin's might just be bored

[girish]

I wonder if the system admins just got bored and started to think.. "Hrm, wonder what would happen if we banned win2k?"
I can picture the other one going.. "I dare ya!"

Pathetic Attempts

[Anonymous Coward]

I am a student on UCSB's resnet.

You know the silly thing? The way they check to see if you have Win2k is thru a "registration" process by which you are not given a valid IP address (DHCP) until your MAC is registered the system. This involves accepting an agreement, etc, etc. Guess how they find out you're using 2k? Your HTTP request. It was rather simple for my friends using 2k to validate their MAC's on other peoples' computers, or on their own computers (if they dual boot) and then return to 2k, easy as pie.

What kind of bs is that?

Tony

Re:Pathetic Attempts

[Mike A.]

Anyone clever enough to understand how that works is much more likely to be able to secure their box. If you are successful in keeping your box from getting infected, they'll never know. And although that doesn't respect the letter of the restriction, it does respect the spirit of it.

Re:Pathetic Attempts

[Anonymous Coward]

Heh, well that's an issue I don't have to deal with.

I run Debian, as a server and a router, with windoze on a private lan.

Another word: They may say "exceptions will be granted" but they do not grant them. I had a friend (CS Major) argue with them all summer about it. No progress.. as to be expected, though.

Tony

This is just insulting

[Eeeeegon]

If I went there, I'd be insulted that the network admins say 'we KNOW everyone with a win2k system is a moron and wont patch it'. Wouldn't it make more sense to (at the very least) demonstrate your knowledge of basic system security before being allowed on the network (like disabling or uninstalling IIS, which i'm fairly confident is the primary reason they're doing this), so competent admins (like myself) wouldn't be forced to 'upgrade'? An all-inclusive 'No Windows 2000 Allowed' policy is completely befuddling.

There's no chance I'd buy a copy of XP just to use their network. I'd talk to the guys in charge; im Sure there can be a compromise.

Re:This is just insulting

[smash]

This is just called minimizing administrative overhead.

80% of halfwits who can install Windows believe they're "advanced" users who know what they're doing - the admin can either sort through them all, or just ban the operating system. Guess what's easier and most effective? :P

Personally, I'd just put all student machines on their own segment behind a firewall and they can run whatever they like at their own risk (so the outbreak is contained to student systems), but the network admin can make whatever policy he likes.

I think forcing XP on everyone is a bit stupid though - I'm willing to bet its security record is going to be just as bad, if not worse than Win2ks (universal plug and pray? :P). :)

smash

Re:This is just insulting

[Mike A.]

smash has the right idea, although I would state it slightly differently. What they're saying is, 'we don't have time to find out if you know how to secure a Win2K box'. Presumably they could use an automated probe, say something that simulates a Code Red attack and an attempt to log on with a blank admin password - but even developing such a probe would require someone to spend time on it, and thus cost money.

Why not try this solution?

[Rev.LoveJoy]

I am surprised I have not read this suggestion before: rather than try to micro-manage this problem on a on-off basis (handle each red flag that comes up), why not force the soulution?

Want to run Win2k on the campus LAN, fine, you gotta become a member of the Dorm_1234_Whatever domain.

By taking this step and using win2k Active Directory, there are a number of steps the dorm administration can take to fix all of these issues.

1). Do not dole out (DHCP) an address unless the Win2K box is a domain member.

2). Drop Software Update Services (SUS) on a server and *FORCE* domain members to update those critical patches from MS.

3). Using the group policy, force complex passwords on the domain (yes, this will generate support calls, but then again, so will owned boxes).

4). Again with the group policy, force a local admin password (I'm 90% sure you can do this, but I cannot seem to find colaborating evidence -- anyhow, if it turns out I'm hallucinating on this one, there are a number of apps you can have the user run at login that force the entry of an admin password).

5). Use HFNetChk or it's GUI upgrade, MBSA to check those dorm boxes periodically (like, daily) for things like IIS.

6). For God's sake, bandwidth throttle the p2p stuff.

There's a lot more you can do with this scenario. Sure, it's more management, but the payoff is just that You Can Manage It -- rather than just react to broken box scenarios. All things considered, I think the arguement that says, "let's just band XYZ operating system" is very short-sighted. Essentially, we are saying let's ban a popular tool in favor of an unpopular one because not as many people spend time cracking the unpopular one. Sounds like a slippery slope towards a riveting game of Musical OS. And where will we all be when the record stops? Probably right back where we started.

Cheers,
-- RLJ

Attack the fortress!

[name_already_in_use]

Anybody fancy working some XP exploits on their new 'secure' setup? Disclaimer: only joking (honest (-;)

They have *MUCH* worse problems than 2k.

[Exantrius]

I've known the guy that posted this for years, and I remember our freshman year in college, he ran an ftp server all year-- Anonymous login sharing basically you name it, and apparently people from all over the resnet were doing the same.. It's a problem of them not wanting to do crap, so they don't, then they find a scape goat-- FTP server installed on 2k, and they say "none of that"...

They should really pull their heads out of their asses-- Start *LOGGING* High usage IPs, and start banning those cards from accessing the network-- They do it at UCSC, and the effect was/is whenever I or anyone else needed bandwidth, I or anyone else got it. /ex

Server OS's????

[dmayle]

Has anyone noticed that the only Microsoft operating systems they've outlawed are the ones that there are server versions of? (Instead of XP Server, there is .NET server, which isn't out yet).

Kill two birds with one stone, eh?

Also, while I've seen people mention the default installs of W98, and not sharing the HD, no one seems to mention that the moment you install networking in 98, Client for Microsoft Networks is installed by default, and any machine with it running on 98 is easily breakable...

I'm glad....

[mao che minh]

...that I don't even have to bother with all of this mess. I use Linux and I keep an eye on the latest security updates. I don't have to worry about all of these inane and pointless virus problems and security settings. I don't need three or four applications running to defend me from viruses and operate firewalls. Poor Windows users.

For chrissakes, UPDATE, people!

[Faust7]

Not to get off on a tangent about resnet and Windows 2000 but I simply must state once again: UPDATE YOUR FUCKING SOFTWARE ASSHOLES! If you visited Windows Update weekly or even fucking monthly for that matter, none of this would be an issue! They act as if Windows XP doesn't carry any of the components of 2000 and is less prone to security vulnerabilities. While it is in certain areas, it is the same core anyway! The only difference is that Windows XP had the ability to automatically find updates for you.

2000 has also had that capability as of almost a year ago and as of about 3 months ago, both 2000 and XP have the built in capability to download, install, and reboot your system for you in the middle of the night if you wish (or at what time you specify). Boy, that's really so fucking hard ain't it!

When you update your software it affects more than just your machine. It also affects the health of the entire network. While you might not give a shit, just making my point because here is obvious evidence that lack of updated software caused some shitty IT admins huge problems.

Funny how other universities don't seem to be banning 2000, sounds like 2 things to me...

1) Terrible IT admin. staff.
2) Lack of software updates because morons don't listen to the bubbles that come up and say "New CRITICAL updates are aviailable for your computer.
Click this balloon to download them for the most secure and reliable Windows experience."

Morons. Period.

Re:For chrissakes, UPDATE, people!

[Manuka]

Or Microsoft offered the school massive discounts on the wholesale cost of the software for the bookstore. And/Or kickbacks.

Correct

[John Miles]

You can (and should) run the Baseline Security Analyzer tool to find stuff like that. All the UCSB campus IT people need to do is get all their users to run the BSA assessment, and they should be OK as far as the glaringly-obvious vulnerabilities are concerned.

Speaking of blank administrator accounts...

[Simulant]

.. Is anyone here aware of a script that will attempt to search a network for windows boxen set or reset all local admin accounts (or any other account for that matter) on NT/2k/XP machines?

THE LAMENESS FILTER IS WEAK!

[Anonymous Coward]

DRM is the key, plus Brown Macs

[RabidChipmunk]

Probably the fish we are missing is DRM. If they all have WinXP installed, they all have some DRM and have signed a license saying more can be installed without consent. This mean that the U can cut down bandwidth usage by cutting the main bandwidth consumer, content. Getting the EULA and the basic libraries in place is key to effective institution wide content management. Service Pack 3 and media player, would also give them this, but other posters have discussed the difficulty of getting the patches out. WinXP guarantees that they can "manage" their network.

Okay, I have to ask what years you were at old Miskatonic. During the 90's the Macs seemed to get slower and move into smaller clusters [upstairs in the back corner]. By the year 2000 there was a Win2k cluster belonging to the previously Sun "closed shop" CS department. [Broke my heart.]

It seems that most of the universities and secondaries I've dealt with have largely moved away from the Mac. It is only with the new powerbooks I see them coming back.

As much as I like the "drive them to the Mac" theory. The simple fact that a WinXP license is cheaper than a whole new computer, and the cheaper replacement computers come with WinXP installed (or Mandrake but...)

Oh, I started in 1991 and took the slow route to graduating. Currently a state bureacrat in the department of Secondary Ed [all win2k.]

Re:DRM is the key, plus Brown Macs

[PythonOrRuby]

A Windows license is cheaper... until you realize that unless students are bringing brand new computers to school, they're probably using hand-me-downs that are incapable of running Windows XP well enough to be useful. Yes, they could stick with Win98SE, but...

Professors tend to do really stupid things, like distributing course material online in Office documents that have a nasty habit of only opening in the latest greatest version of Office.

Re:DRM is the key, plus Brown Macs

[RabidChipmunk]

Clarification:
A Windows license is cheaper than a new Mac. A new Windows PC is cheaper than a new Mac. (Which I think was the next statement.) You get stuck shelling out for (or stealing) a copy of the latest office anyway.

I wasn't suggesting that students weren't getting ripped. They would often be better off with what they have. However, given that they have been forced to spend extra money, they're not going to choose to replace their Win98 boxen with Macs. If they already had a Mac it's a different game, unless they need office...

I often suggest an ibook. But they'd still have to buy office.

Your best bet is to request non-office dependent materials, and have all of your friends do it, until the proffessors provide portable formats. I would stage a sit in on the presidents office.

Complain. Most of the Profs don't realize you can't read their stuff.

Re:DRM is the key, plus Brown Macs

[PythonOrRuby]

The response from every single person working for the college is "if you don't have Office then you can't do anything worthwhile anyway."

It's always nice to have these people inform me that AppleWorks doesn't work. Now I just have to go around and get back all of the papers I wrote in it before my old teachers realize that I obviously didn't do the work, since only Office allows a student to get any work done.

Re:DRM is the key, plus Brown Macs

[RabidChipmunk]

It could be worse. It's always fun when My wife gets papers she can't read, because they're in a later version of word. I usually just tell her to flunk them. (She hasn't as of yet.)

This is

[Anonymous Coward]

the funniest thing I have ever heard! It also has a dark side though. Back when I went to college at Los Rios Community College and Sacramento City College, they never even HEARD of NT. I was ostracised and looked at as a joke for even suggesting someone use something other than DOS / WIN311 or win 95 /98. Instructors were clueless, they never heard of it. Fast forward to today and now everyone that breath's air and can fart has NT and they are still as clueless. It was better back then because LESS IDIOTS were out there, now the ENTIRE NATION is an IDIOT.

So, when are they going to get a clue? I have long since dumped windows for linux. And there is a learning curve. GOOD luck teaching the new breed of idiots how to use linux.

Security - bagh. These half-wit crap ass hormone driven idiots will NEVER grasp it.

NEVER!

DRM _IS_ a security/bandwidth solution

[RabidChipmunk]

Well, you can't force them to install something (unless they've already installed SP3 or XP) but you can force them to meet certain requirements in order to use certain services.

That said: I reiterate my previous coment that the purposde of XP is to get DRM onto all the machines. Thus allowing bandwith management by content restriction. Once you've installed XP they can do anything they want as long as MS signs off on it.

sounds like a simple case of lack of education...

[zonker]

sadly, and a little humorously, this sounds like a simple case of a lack of education of their users. it's sad/funny because it is happening at a learning institution. if they throw all of their first year students (or anyone that transfers in) to a basic computer class and instruct them on simple things like updating their system and pass out a guide, i think many students wouldn't have this kind of problem...

From the horses mouth...

[weave]

From a mailing list I'm on....

At the suggestion of Brad Judy from Boulder I joined this list today. I'm the technical staff member primarily responsible for the Windows 2000 'ban' (not my word) on UCSB's residential network.

If you read the Nexus article a bit more carefully you will realize that it is not UCSB that requires students to log in as Administrator. That's Berkeley.

As for the suddenly-controversial Windows 2000 prohibition, yes there were a number of incidents that UCSB and most other schools in this country (and others) experienced in 2001-2. The unisog list was absolutely full of them, and continues to be to this day. Most issues were the result of people running IIS or operating their system without an administrator password.

Given the extremely small number of users running Win2k and the fact that nearly every single exploit last year was on that platform, we decided that it would be best to just do away with Windows 2000. As a pilot program, it has been extremely successful. Only a tiny number of students (around 10) have asked for an exemption, and only a few have been granted. The only people terribly upset by the decision appear to be the mudslingers on Slashdot who would rather we make everyone switch to xNix anyway. :)

With this policy we are not calling into question the securability of Windows 2000. I know as well as anyone else that it can be secure (our resnet website runs on 2000). I just don't think that securing it is within the capabilities or interest of the vast majority of our student population. It remains to be seen how Windows XP will fare with respect to security on campus.

______________________________________
Curtis Kline
Residential Network Coordinator
University of California Santa Barbara

Re:From the horses mouth...

[Anonymous Coward]

Ha ha! That guy is such an idiot. He obviously hasn't tried out XP home yet and has forgotten 98.

Win2k SP3 is a damn fine operating system for desktop (not server) use. The best Micro$oft has ever put out (not saying much).

When I must use Windows, it's 2k. XP and 98 are downright scary. Who hired this idiot?

Re:From the horses mouth...

[Anonymous Coward]

Calling him an idiot is pretty misguided. He obviously has the support of his University's administration if this became policy, and I'm sure to get that would require a lot of justification and convincing. I should know, I tried to ban IIS in my college and got NO WHERE. My administrators would not support it whatsoever, despite the overhwhelming evidence of the harm it was causing our networks (and still does to this day...)

Being an admin in that kind of environment is a thankless job. You need to try to safeguard the integrity of the network for those that need it to like, uh, study and learn.

Win2k Unsecure, or UCSB IS Admins *insecure*..?

[Phil_at_Slackers_Uni]

This has to be one of the most blatant abuses of administrative ignorance that I have ever seen. I'm the global UNIX administrator for one of the largest lawfirms in the U.S. and although I dislike the whole Windows platform, it's staffing impotence like this that gives Windows 2000 a bad rap. Windows 2000 can be secured just as easily as XP, and is by far more secure than Win98 or ME. The decision to use XP over Windows 2000 displays the lack of research and outright lack of thought that went into the decision to make students replatform their machines.

Simple restriction of services on Windows 2000 (like mandating "No IIS servers permitted") could remove most of the current exploits. This is a network administration issue that has obviously been solved by using a crutch instead of educating students and enforcing policies.

Weak, and pathetic.

UCSB should take some time to establish proper guidelines for use of Windows 2000 on the networks and create acceptable use policies that permit them to take action if there is negligence involved. How do the administration plan on handling FreeBSD, Linux, QNX, PocketPC, and MAC OS-X users...? Back of the Bus?

Wow, NT banned, who cares?

[Anonymous Coward]

I am a sophmore @ UCSB and i think this whole thing has been made way too big a deal. 95% of us who go to UCSB dont give a shit about NT, and the other 5% will probably still use NT anyway. Why? because all of us here are binge drinking Bio majors who are too busy trying to maintain a 3.5 GPA and still get some play on the side. On another note, id like to remind you that the majority of people who are effected by this are FRESHMAN, since only freshman are guaranteed housing on campus, while most people just get off campus internet service through COX cable when they move to Isla Vista (where the majority of UCSB students live). Now that thats all cleared up, someone run to SOS and gimme a case of Nattie Ice and a pack of Parlies.

What about older Machines?

[CatPieMan]

I know the listing said something about if you are on financial aid they will help you with the purchase of the OS "upgrade", but, what about if your machine isn't fast enough to handle XP? As far as I could see, they aren't offering to help anyone upgrade the hardware, nor is the "My computer is too old for XP, but, I like 2K/NT" a valid reason for keeping 2K, etc.

-CPM

Good Idea! And I know why...

[dmontauk]

I work for the University of California, at Berkeley, as a System Administrator for Residential Computing. We're the department responsible for the residential network - not the physical portion, but basically everything else. Last year, I was responsible for the security mailing list, meaning I took care of security, abuse, and copyright case for the 6,000+ students living in the dorms here.

Now, the following is in any way, shape, or form, official University Policy, or even opinion. Just my own thoughts & experiences on this subject. Now that that's out of the way...

The majority of the security problems on our network come from Windows 2000. At the beginning of this semester, and last semester, we were flooded with compromised computers - Code Red last year (hundreds of cases), and variations of DarkIRC (which exploits the "no Administrator password" problem) this year. We've spent thousands of dollars (on employee hours only) at least. When we hear about a compromised system, we it's Win2K (twice it's turned out to be Linux though =).

After the first six weeks (meaning, for us, right about now), we've gone through almost every Win2k machine & set an Administrator password, installed Norton, etc - BECAUSE THEY'VE ALL BEEN COMPROMISED. At least all the vulnerable ones. This keeps our Residential Computing Consultants (RCC's) pretty busy, but our network even busier. We lose a lot of bandwidth because of these people as well, which slows down the net for everyone else (we're capped at 60Mbps), and hurts their dorm experiences.

I would vastly prefer Win98 than Win2k on our systems. It's much harder to compromise, since to turn it into a server. Win2k already has all the tools a hacker needs to log in, and attack others - and without the Administrator password, it's all set up for this already! I don't know if WinXP is any better (since I'm not working as Security anymore), but hopefully it is.

It makes sense to get rid of Win2k. People have unpatched versions usually, and frequently no passwords, so they get hacked all the time. I wouldn't mind doing the same thing in Berkeley, but our primary philosophy is Open Network - we don't block anything, we don't tell you what to use, etc. We let you run servers if you want. We have a bandwidth limit now (5GB a week), but that's fairly new too, since we've only recently been capped (thanks to P2P - the dorms were using more bandwidth than the rest of the University combined!!). Other than that, however, Residential Computing is and strives to be the model ISP. We are mostly students ourselves, and so we know what our peers want. And in my opinion, they would all be better of without Win2k.

For more info about Berkeley's Residential Computing, check out http://www.rescomp.berkeley.edu =)

I'll tell you why XP sales are up on campus...

[lpret]

because here at Baylor, as with many other schools across the country, XP Pro costs 5 bucks or something in that neighbourhood. I have used Linux dualbooted with a pirated version of Win2k for years, and it's nice to be legal for once...And Office XP Pro was only 10 bucks. Please, if they give these away, can you really complain?

Beware of women who pay their rent in one dollar bills...

Make Your Voice Heard! Call In Your Comments

[Veovis]

Call UCSB Yourself and talk to the manager of the network systems: Craig Welsh 805-893-5363

Re:Make Your Voice Heard! Call In Your Comments

[ckline_ucsb]

I'd suggest that if you want to comment to the people who made the decision, talk to me, not Craig. It is my network.

You can reach me (and the rest of our team) directly at resnet@housing.ucsb.edu. I'd rather keep it to email, if possible. If anyone really wants to talk about it on the phone I'm sure you can dig up my phone number somewhere.

:: Curtis Kline
:: Residential Network Coordinator
:: University of California, Santa Barbara

IF IT AIN'T BROKE, FIX IT 'TIL IT IS

[Anonymous Coward]

upgrade to XP Home??

[geekindustries]

Forgetting about all the other insane stuff about banning NT/2000, why on earth are they recommending an upgrade to XP Home?? They arn't running a domain... or what...do they have one big workgroup? Insane really. All I can say is, if they arn't running a domain it doesn't matter what OS they ban...that network must be a total nightmare. I feel sorry for them....the students that is. heh

Re:upgrade to XP Home??

[Veovis]

Remember, we are talking about a university here, all anti-piracy/SpyWare programs are pilot'd though them first before going public, XP is SpyWare, and RipOffWare, so why not try it here?

Something you don't realize

[Anonymous Coward]

I didn't see anyone pick up on this. A HUGE problem at our University isn't just a hack here or a crack there... We have people installing 'pro' versions of Windows software like Win2K and XP Pro, and for whatever reason they turn the DHCP server on.

We run behind a PIX. You turn on a DHCP server and you screw EVERYTHING up. No one gets out because they don't go through our authentication system properly.

One misconfigure 'pro' OS and you bring down the entire dorm network.

I don't know if this is a reason for their decision, but it is a real issue and it really happens in dorms.

ffakr.

MBSA

[Anonymous Coward]

Seriously I think a lot of people are a little too "Microsoft they must be un-secure and "they're the devil". There is a very nice tool easily downloadable from Microsoft's Security website that's called Microsoft Baseline Security Analyzer. I'm sorry but even a trained monkey could download the patches and check their computer for vulnerabilities. I know everybody likes to "stick it to the man" but honestly, the reason Microsoft is in the position they are is because they have a good business strategy, make a good product, and have good management team. I'm not a Microsoft leg-humper or anything like that, and I'm not saying that they don't have vulnerabilities at all but 95% of attacks on Windows computers are on ones that aren't up to date as far as vulnerability patches go. You want to know the best way to secure your computer if it's connected on the internet? Unplug it, dig a big hole in your backyard, rent a cement mixer, throw your computer in the hole, and fill in the hole. I don't care what OS or what type of computer you are on if somebody wants to get control or access to it and you're connected externally it's possible. Not likely considering the consequences (FBI or otherwise) and the level of skill of the majority of computer "hackers" --- not very good terminology by the way. Anyhow, just my two cents for whoever cares to read.

The school should buy a campus-wide edition

[Questioning]

Our school has an edition that any student can install for free. XP Pro, at no cost to us. I think it only cost the school some 10K. A lot for a school of our size, but for the larger universities? Then again, one of our professors sold his soul to microsoft in order to get good deals.

Re:The school should buy a campus-wide edition

[Veovis]

The word "XP" and Free should not be used in the same sentance. Micro$oft wouldn't allow anything "free", oh wait, I suppose you CAN buy a campus wide version, BUT, Service Pack (whatever) would be $89.99 to download

Re:School is offering to help with cost and suppor

[Anonymous Coward]

the college is willing to pay the bill to give students a better OS

Ok dopey.. for you, and the rest of the world that doesn't quite get it yet, the word FREE in FREEBSD does actually mean that you don't actually have to pay for it.

The same goes for Linux.

Out of interest.. I don't see how a school can force people not to use a particular OS. I'd really like to hear the real reasons. Specifically, I'd like to see their plan on making XP more secure than NT or Win2K or 98, and no "SP1" (otherwise known as the 'let Microsoft rape/invade your computer for free' patch) is not an answer. Are they suggesting firewalls be set up? No? What a monolithic idea! Let's change the OS instead!

Firewall your PC

UCSB and NT

[vanillaspice]

I've known many people who have worked for the computing services on the UCSB campus.

A few quick sound-bytes:

Most dorm computer users did not purchase NT-based systems of their own volition: they got them as part of a bundle or because mom and dad gave it to them. Therefore, they have had no real incentive to learn how to properly configurate their OS.

Thus, when someone leaves the admin password blank, they may not be more of a "security issue," as some have said, but they certainly become more of a pain in the ass: a logistical nightmare for the computing services people.

Hell, I've even had to teach people how to click "enable" on their network connections. And you expect them to set up an admin password?

My college is the opposite...

[puck71]

Well, I'm in college, and my college almost exclusively uses Windows 2000. It's on all the lab computers (except for a couple Mac labs).

In fact, they actually RECOMMEND Windows 2000 in the dorms, and DISCOURAGE XP Home (scroll down about halfway), mostly because of the inability of XP Home to join Windows domains, which basically renders those machines unable to get on the campus network.

This worked great for me because I love 2000 Pro and am not a big fan of XP. I don't know what I would do if they banned 2000 like that. I wonder if there's any way to fake them out? I'm not sure how they check your Windows version like that...do you broadcast it when you try to connect? If so can you spoof as XP or something? One thing for sure, I wouldn't be running out to buy XP.

Re:My college is the opposite...

[Veovis]

Remember, Micro$oft probably paid to have XP promoted there, it's all just an attempt to lock down control over software piracy issues.

"Hey dear, check out this new hard drive I bought at the local computer store, but, before we can use it we need to let Microsoft "Activate" it, much like our cable box, do you remember both our social security numbers? They might ask for that too"

Last Post!

[alpg]

"One basic notion underlying Usenet is that it is a cooperative."

Having been on USENET for going on ten years, I disagree with this.
The basic notion underlying USENET is the flame.
-- Chuq Von Rospach

- this post brought to you by the Automated Last Post Generator...