Microsoft Refuses To Fix NT 4.0 Exploit

shmigget writes "The Register is reporting that Microsoft is throwing in the towel as far as NT 4 is concerned on the latest security flaw to affect Windows 2000, XP, and NT 4. They quote Microsoft as saying 'The architectural limitations of Windows NT 4.0 do not support the changes that would be required to remove this vulnerability.'" There still is a workaround for NT 4.0. Instead of patching the problem, it's advised to firewall off port 135 on an affected machine.

Comments

ZoneAlarm

[yycs]

So in effect, ZoneAlarm could be considered as a patch for this problem??

Re:ZoneAlarm

[RayOfLight]

No. Why?

By firewalling, you merely hide the problem, you don't fix it.

Re:ZoneAlarm

[deadsaijinx*]

well, if zomealarm is your bag? ^^ That was kinda a joke, kinda not. After all, the personal firewall edition is very limited (I haven't found a way to block off individual ports, though it may be possible). The Pro edition (or whatever they call it) should adequetly handle it, but I'm sure there are better choices that are OS. Can anyone recommend a good OSS firewall that works under WindersXP?

Moving on: I really don't see what the big deal is, so what if MS doesn't patch NT? The only people using NT are businesses that are reluctant or unable to upgrade. And since a firewall is a must for any business that has a link to the outside world (or even on a closed network for that matter, after all, if the workstations hooked up to the network, it's no longer secure). That being said, any good admin can patch this bugs with their trusty firewall and a few clicks.

Anyway, I'm really looking for a good OSS firewall. So any recommendations would be nice. Thanx!

Re:ZoneAlarm

[MultisSanguinisFluit]

Well... yes and no... From MS' security bulletin: The RPC endpoint mapper allows RPC clients to determine the port number currently assigned to a particular RPC service. So if you block it, RPC clients will likely stop working. But, really, who cares? How many RPC services are running exposed to untrusted environments? If you have such a box connected to the Internet NOT behind a firewall, you've been begging to be DOS-ed all along.

Re:ZoneAlarm

[essdodson]

Yes, this is why it's called a work around and not a fix.

Re:ZoneAlarm

[Erris]

That or IP chains on a 486 could help protect your wimpy little M$ box from the big bad internet. Need help with those pesky chain rules? Try plonk. The best patch I've seen so far is the M$ Offswitch. What was the wonderful New Technology, NT, good for again?

Re:ZoneAlarm

[gmack]

"Anyway, I'm really looking for a good OSS firewall. So any recommendations would be nice. Thanx!"

Linux: iptables
*bsd: ipfw

Having said that I have a growing dislike of firewalls for the simple reason that they tend to be overused and improperly implemented.

Traffic control is good. Thinking blocked ports or auto firewalling portscanners is going to make your network any more secure is not smart. I've also seen people block potentially insecure ports instead of closing them on the machines. Too often I find firewalls as the justification for the use of insecure crap like Exchange or Lotus Notes.

On the other side firewalls also tend to be set so strictly that they block legitimate traffic. It's getting comon to Block all ICMP messages even though they are needed for things like packet size negotiation and error reporting.

ZoneAlarm is a horrid example of an overzelous firewall blocking legitemate traffic and scaring users on the risks of harmless things like ident checks. Leads to fun things like ISPS shutting off servers over complaints from cluless users armed with Zone Alarm logs.

Re:ZoneAlarm

[foistboinder]

Moving on: I really don't see what the big deal is, so what if MS doesn't patch NT? The only people using NT are businesses that are reluctant or unable to upgrade.

Some businesses are reluctant to upgrade because they are running mission critical apps (even on Windows) where changing the OS may force them to go through some sort of lengthy and expensive tests.

I once worked on software running on an archaic version of Unix. The OS was never upraged because doing so would force them to get the entire system recertified by the FDA (it was a system used in medical diagnostics). As it was, it was a pain to recertify individual programs on this system.

Re:ZoneAlarm

[freeweed]

After all, the personal firewall edition is very limited (I haven't found a way to block off individual ports, though it may be possible).

Zonealarm (personal) gives you as much or as little individual port control as you desire. If you want port 80 open, fire up your webserver - it'll try to open the port, zonealarm will ask if that's ok, and you click 'ok'. Bang, port 80 is open.

As for blocking off individual ports, Zonealarm blocks ALL ports by default, unless an application requests them. Blocking only certain ports would almost certainly cause problems with an application that thinks it can use them. And really, if you're using an application that wants certain ports open, that you can't control, maybe it's time to find a better app :)

Re:ZoneAlarm

[fshalor]

Unfortunatly, most of the reasons why people are still using NT4.0 and unwilling to upgrade that I'm aware of locally also happen to involve something in or near port 135. :)

Re:ZoneAlarm

[Anonymous Coward]

auto firewalling portscanners is going to make your network any more secure is not smart

It's not all about security. Lots of it is for suppressing the crap factor in the syslog.

Imagine for a moment that you have a /19, and some pinhead decides to scan all of those to see who's alive on port 445. You either block it after a few connection attempts, or you suffer with 8192 log entries - one for each host.

It used to happen to me all the time before I added a few measures to dampen the reporting. What's really sick is when one host would manage to hit both of my netblocks, which are quite some distance apart.

Once in awhile, you'll see one manage to do a linear scan all the way from the land of cable modems and DSL (24, 64, 65) up to where my networks live (the old class C range). It only proves that the ISPs involved don't have any idea what's leaving their networks.

Re:ZoneAlarm

[caluml]

Imagine for a moment that you have a /19, and some pinhead decides to scan all of those to see who's alive on port 445. You either block it after a few connection attempts, or you suffer with 8192 log entries - one for each host.

That's why you use rate limiting for logging, like this:
$fw -A FORWARD -p icmp -m limit --limit 10/min -j LOG --log-prefix="NEW RAPID ICMP "
will only log 10 outbound ICMPs per minute. Adjust to suit your personal preferences/requirements.

Re:ZoneAlarm

[$rtbl_this]

And some businesses don't want to upgrade because of the cost. Not only would you be looking at licenses, but also hardware upgrades, retraining of IT staff, taking time out to plan an Active Directory implementation and all the testing involved in seeing if your apps run properly in the new environment. For a medium to large sized company that can represent a huge investment in time and money just to stay supported.

Re:ZoneAlarm

[Britt Wanabe]

I prefer ipf over ipfw... seems simpler adn more elegent...

Re:ZoneAlarm

[gmack]

That falls under traffic control.. nailing them so they don't waste your resources is fine. Blocking them in an attempt to make your systems more secure only leads to a false sense of security.

Re:ZoneAlarm

[BigBadBri]

Nope - we still use NT4 (and IIS!) for our internet application, simply because we're tight.

We've got everything tightly firewalled, the OS locked down as tightly as possible, all the NetBIOS crap disabled, etc. etc.

This problem won't affect us, but we won't upgrade for the simple reason that the only non-hardware downtime we've had in the last three years was when a M$ patch buttfucked the server, requiring a reinstall.

Put simply, if you're just using NT4 as an application server, it's stable and fairly robust, and I can't be bothered with the disruption that an upgrade would entail.

It's only if you're using NT for file and print, or being dumb and using DCOM rather than building a roll-your-own server, that this vulnerability will affect you.

I could port everything to Linux, but what's the point? 3 years with only 2 hrs unplanned downtime is good enough for me...

Re:ZoneAlarm

[Oliver Defacszio]

You are correct, the costs of upgrading are often a factor; anyone who has done any consulting work has heard it a million times. However, there is no such thing as a worthwhile product that never, ever requires maintenance at a cost. This is particularly true when the product in question is what an operation hinges upon. Costs like these should be factored into the budget of any intelligent operation to avoid the "holy crap, we can't afford this" problem when things simply get old, which everything does.

HVAC systems get old and become unsupportable, phone systems get old and become unsupportable, OSs get old and become unsupportable. Businesses understand that infrastructure doesn't last forever. Why all the shock here?

Not referring to you personally, but this just sounds like another excuse to fire up the uninformed anti-Microsoft circlejerk.

Re:ZoneAlarm

[technos]

Can always replace the NT 4.0 box with Samba, if it's in a fileserver or network authentication role. Most of the time, it's pretty painless to replace one with the other.

Re:ZoneAlarm

[ansible]

In my opinion, a transparent firewall is an even better choice:

I've never gotten a chance to implement one of these (my firewalls have to do other things too), but the thought of a stealthy firewall (which is nearly invisible) is so cool.

I think that OpenBSD's pf is more featureful and easier to use than anything on Linux.

Re:ZoneAlarm

[joedavis123]

The best firewall I have found so far for Windows is Kerio Personal Firewall.

http://www.kerio.com

It is not open source, but it is free for personal use, and as far as I can tell has no restrictions. I have used it on Win2k and WinXP and it works perfectly. You can even limit IP/ports to a specific application. Check it out if you need a good firewall.

Re:ZoneAlarm

[nihilogos]

thanks for that. I swear some people were given a book with those things in at at birth.

Re:ZoneAlarm

[Tyreth]

I don't understand, if a firewall blocks a port how can you access it?

Re:ZoneAlarm

[afidel]

No it provides a hell of a lot more security then a box without it. I wish all broadband users were forced to use a NAT'ing firewall with some decent default rules, the net would be a much better place for it.

Re:ZoneAlarm

[Grishnakh]

Maybe, but HVAC and phone systems don't become "old and unsupportable" after only three years. Any system which has such a ridiculously short lifetime should be replaced with something that lasts longer (i.e. a better OS).

MS OSes are unsupportable after three years simply because MS wants you to upgrade fast so they make more money. There are lots of IBM customers running computer systems 10 or 20 years old, and IBM has no problem giving them support. Sun is the same way.

Re:ZoneAlarm

[canadian_right]

Yeah, but I'd guess that 90% of our NT boxes are application servers running big apps that only run on NT. If the app is running OK you don't want to touch anything.

Re:ZoneAlarm

[kleinux]

Not to post in favor of MS here, but I have to ask: if this application needs to be recertified to run on a different OS, wouldn't it need to be recertified to run on a different service pack? I have been through many SP upgrades on my hom pc that have tanked the system. Sometimes the upgrade in the service pack is more troublesome than a new OS. At least with the new OS you are forced to perform a clean installation of the software.

Re:ZoneAlarm

[gmack]

Either by finding a way to bounce off one of the inside machines or waiting for the firewall to come down during a maintinance cycle.

And yes I've seen both happen..

Re:ZoneAlarm

[gmack]

"Can anyone recommend a good OSS firewall that works under WindersXP?"

XP comes with one built in .. even has a nifty GUI. Just look under control pannel it's in there somewhere.

Re:ZoneAlarm

[Oliver Defacszio]

I have but two points.

1) Windows NT is now approximately seven years old, which is probably an adjusted thirty outside the "dog years" of IT.
2) Sun and IBM were both engaged in the big-iron game ten years ago, which is completely different than what Windows has ever claimed to be.

Hate Microsoft all you want, but they're not doing anything differently from countless other companies that most of the Slash-herd will happily embrace in any other industry. Everything gets old and dies, including computers and software.

Re:ZoneAlarm

[technos]

Oh.. Oww.. No, you don't want to even break wind in the same room as those. It's hard enough to get them up running stable in the first place

Re:ZoneAlarm

[afidel]

umm, I can use all of the above through a properly configured NAT'ing firewall. FTP may need to be configured in a seperate way, or you can just use passive mode which works through basically all configurations.

Re:ZoneAlarm

[Grishnakh]

I seem to remember Windows NT being touted as the replacement for Unix when it came out. Well, there's still lots of Unix systems from that time still in use, and still well supported by their vendors.

What did you think Windows ever claimed to be? A cheap, poorly-written OS that aspired to replace Unix but failed miserably? That may be the reality, but MS has been claiming all along that Windows NT and its successors are supposed to replace Unix, VMS, AS/400, and mainframes, so your argument seems to fall flat on its face givent that it sure isn't living up to those claims.

Re:ZoneAlarm

[Alex Belits]

First rule of DoS-resistant network security: system must not change any of its behavior when attacks are present.

Including logging.

What means, never try to log the intrusion attempts, leave alone portscans, every connection, etc. unless for the purpose of studying them.

Re:ZoneAlarm

[Tony-A]

Right. And now that Microsoft has determined that New Technology is unsupportable, any bets that .NET, Palladium, etc will be any more supportable.

Re:ZoneAlarm

[profplump]

The only people using NT are businesses that are reluctant or unable to upgrade.

This is true, but it's also a lot more people than you might think. NT was the first MS OS that could even pretend to work as a server. In fact, once you get it working right (which is no small job) it's actually pretty stable. Considering the cost, the downtime, and the hassle of moving to 2000, it's hard to justify in a lot of small and mid-sized businesses.

Re:ZoneAlarm

[kir]

It's getting comon to Block all ICMP messages even though they are needed for things like packet size negotiation and error reporting.

I hate firewall admins that block all ICMP. I hate them. It should be legal to kill them... well... at least hurt them.

I work with the DoD. They use encryption devices quite a bit. These devices always request fragmentation (they need some room too you know). I don't know how many times I've pleaded with a firewall admin to let ICMP type 3 (code 4) through.

I'm starting to go bald and it's all ICMP's fault.

Re:ZoneAlarm

[Alex]

I work with the DoD. They use encryption devices quite a bit. These devices always request fragmentation (they need some room too you know). I don't know how many times I've pleaded with a firewall admin to let ICMP type 3 (code 4) through.

I'm RIGHT with you on this one brother - networks that don't allow this don't meet RFC spec so are not networks.

Alex

Re:ZoneAlarm

[ATMAvatar]

ZoneAlarm is a horrid example of an overzelous firewall blocking legitemate traffic and scaring users on the risks of harmless things like ident checks. Leads to fun things like ISPS shutting off servers over complaints from cluless users armed with Zone Alarm logs.

I had a roommate one semester that came to me with a Zone Alarm log with hundreds of blocked packets from the same IP. He was freaked-out that it might be a hacker trying to get into his system.

The source of the packets: our school's DNS server

Re:ZoneAlarm

[eskayp]

In addition to businesses, goverment agencies use NT4 as network server/client software for SCADA applications that monitor and control infrastructure facilities: e.g. drinking water & wastewater in our community. These systems use NT4 to network a number of (fortunately) standalone capable PLC's which interface with a variety of sensors and devices. When NT4 locks up, operational personnel lose active update and control capability. They must reboot the system every few days. So much for 24/7/365 reliability from MS. Problem is, they are locked into a proprietary system that is rapidly becoming extinct. Changing to a reliable, cost effective networking solution will entail major system downtime plus overtime for inhouse and outside techs. Public utilities that strive to minimize expenses to their customers (ratepayers) are not getting any help from MS.

Re:ZoneAlarm

[unborn]

But they recall your car for its lifetime if something was wrong in the assembly line. Why should this be different?

Re:ZoneAlarm

[jstott]

Can always replace the NT 4.0 box with Samba, if it's in a fileserver or network authentication role. Most of the time, it's pretty painless to replace one with the other.

<SARCASM>
Really? Does Samba come with a device driver for our XY open frame scan head?
</SARCASM>

When the vendor does not supply drivers for Win2K to go with your mission critical hardware (and no, the WinNT driver does not work under Win2K--that was the first thing I tried), then you stick with WinNT.

-JS

Re:ZoneAlarm

[Cloud 9]

And really, if you're using an application that wants certain ports open, that you can't control, maybe it's time to find a better app :)

Wasn't that exactly what he was asking for?

Re:ZoneAlarm

[mwood]

"HVAC systems get old and become unsupportable, phone systems get old and become unsupportable, OSs get old and become unsupportable. Businesses understand that infrastructure doesn't last forever. Why all the shock here?"

Because HVAC systems, for example, get old and become unsupportable by wearing out. Through daily operation they become no longer able to do what they once did. This does not happen to OSes; the IBM 1620 monitor still does everything it did on the day it was released, if you can find a 1620 in running condition. 1,000,000 years from today, MS Windows v1 would still function as it always did if someone would provide hardware it can run on.

OSes "become unsupportable" because the vendors get tired of servicing the stuff they sold and would rather play with shiny new stuff (which earns bigger margins). "Unsupportable" actually means "we don't feel like meeting the needs of our customers anymore, unless they pay for our latest innovations whether they want them or not."

I'm always wary of saying, "we *cannot* do soandso". In software that's usually malarkey; we *can* do that but you won't like the cost. So, be honest and say that, instead of pretending that something is impossible when it clearly is not. "We can fix NT4 for you, but it will cost you $1 million" is honest and at the same time will deter just about anyone pressing for a fix. And if some customer is really ready to pony up $1 million to fix an 8-year-old system, take the $1 million and deliver the fix. Congratulations: you just found a million bucks in unanticipated revenue!

Re:ZoneAlarm

[kk5wa]

WindersXP firewall only blocks incoming traffic, not outgoing. While ZoneAlarm might be the "Firewall For Dummies", it let's me know what apps are trying to contact the mother ship.

Example: Win2k has the infamous Services and Controller app that I do not allow out. Upgrade to Win2k SP2 and you'll find that you better let the Sevices and Controller app talk to the mother ship or your access to the 'net will be disabled.

Re:ZoneAlarm

[The Welcome Rain]

Impossible, adj.:

1. I wouldn't like it and when it happens I won't approve;
2. I can't be bothered;
3. God can't be bothered.

Meaning (3) may perhaps be valid but the others are 101% whaledreck.
-- Chad Mulligan, The Hipcrime Vocab
from John Brunner's Stand on Zanzibar

Re:ZoneAlarm

[thx2001r]

Lest we forget as well that some departments need to do testing for weeks or months before they apply patches.

At least they've made some sort of workaround that lets you test the patch out first before applying it to production servers. Granted they just provide the workaround for NT4 servers but hey, it's marginally better than them saying to NT4 server owners "too bad, upgrade now or be vulnerable" (though that is undoubtedly the plan).

Re:ZoneAlarm

[Gaardenzwerch]

Gibraltar is a really good free firewall IMHO. Boots from CD, reads config from floppy, and you're not trapped in some limitative gui like with 'SuSE fw on CD' and similar stuff. Just fiddle until it feels right, then issue 'save-config' and the entire /etc (plus ~root) gets saved to the floppy. You could even write protect the floppy if you can afford to travel to the fw each time you want to save the config.

Re:ZoneAlarm

[djmcmath]

But what if you _need_ that port open, for whatever reason? What about the poor bastard that runs their exchange server on port 135, and can't change it due to security restrictions placed on them by USSTRATCOM? (Yes, this is a real-life scenario, or I would be laughing this off too... Oh, and yes, WinNT is required by STRATCOM as well, until they eventually decide to welcome the 21st century to the IT-21 program...).

Re:ZoneAlarm

[Segfault666]

Probally said a million times alraedy;
BSD 3.3 w. pf. pf.conf is infinitly configurable; I have my office network [~150 ppl] running on a PII-266/96MB. It just sits there and humms along; heh. I bet that this could easily handle hunderds of connections - they are only packets :)

Borg icon

[KingRamsis]

I like the Bill "Borg" icon better than this icon

Re:Borg icon

[MattCohn.com]

I think they are both childish. How are we to expect objective news from a site that has these types of things? There ARE real Microsoft and Windows icons you can use, you know.

Now watch me called a troll for not following everyone else by putting dollar signs in 'M$'

Re:Borg icon

[sulli]

Borg icon is funny. This one doesn't make sense (sorry Kathleen)

Re:Borg icon

[boinger]

It's broken windows. How hard is it to "get"?

That said, I like the Borg more, too. maybe just revamp it to a cleaner graphic or something (it was looking old - bit rot, I guess).

Re:Borg icon

[arban]

I find it interesting that the "Windows" topic has finally been used. This is the first time I can remember seeing it, and when I do a search, this article is the only one that comes up.

At first I thought they had changed the "Microsoft", but I am glad that is not the case, the borg icon is still pretty cool after all these years.

Re:Borg icon

[istartedi]

I never cared for the Borg icon--I think the GPL is just as Borg-like as MS. The new icon is too dark. It looks like a box with some features on it that are difficult to make out. I had to read the alt in the image tag to figure out it was "Windows". I don't see anything wrong with using a window as the icon for Windows, just find one that's lighter. I'm not sure what restrictions MS places on use of the Windows logo, but if they can use it than that's what they should use--just like they do for Apple. That would seem fair enough to me.

Re:Borg icon

[JonTurner]

I find it interesting that the "Windows" topic has finally been used. This is the first time I can remember seeing it

Me too. However, since we're discussing a Windows security hole, shouldn't one of the glass panes be broken?

Re:Borg icon

[phillymjs]

However, since we're discussing a Windows security hole, shouldn't one of the glass panes be broken?

Take a closer look at that icon. It looks to me like a rock has been thrown through all four panes in that window.

~Philly

Re:Borg icon

[operagost]

Yes, but they're registered trademarks of Microsoft. Fill in the rest of the story yourself.

Re:Borg icon

[boinger]

Uh. they all are.

Or were you asking to have three of the panes fixed?

Re:Borg icon

[Randolpho]

It's hard to see that it's broken windows. In fact, until I read your post, I didn't see the cracks in the windows at all.

Re:Borg icon

[cymen]

How are we to expect objective news from a site that has these types of things?

Why in the world are you expecting objective news here on /.? Seriously, you are out of your flaming gord to even imagine that /. has any thoughts on the objectivity forefront.

Re:Borg icon

[etcpasswd]

As opposed to the unregistered trademarks of Apple, Sun, Intel, AOL, AMD ... as topic icons?

Re:Borg icon

[nomadic]

Borg icon is funny.

Actually, it's not. As a matter of fact, everytime I see it I wince then roll my eyes. It's about as subtle as an iron pipe to the head; hell, I can't remember ever finding it even slightly amusing.

Re:Borg icon

[hndrcks]

No, the Microsoft solution is to install some other company's Plexiglas in front!

Re:Borg icon

[phillymjs]

Close, but here's what they'd really do:

-Announce a 'strategic partnership' with the Plexiglas people
-Send their own team of glaziers to study Plexiglas
-Suddenly announce that they are changing strategic direction and dissolve the partnership
-Six months later, Microsoft ClearPane, which looks remarkably like Plexiglas, is shipped. :-)

~Philly

Re:Borg icon

[WindBourne]

Actually, all the panes are broken. Only crackers/SKs can see them.

Re:Borg icon

[ptaff]

If you look at the new 'windows icon' _VERY CLOSELY_, in the upper-left part (the red tile), you can see an 'echo' from the old bill-borg-icon.

In the lower-right window, I see the side of a man looking left.

Is it just my fertile imagination? Should I stop coffee?

what are the other two tiles?

Re:Borg icon

[IXI]

Randolpho's Slashdot Moderation Plan:

sorry but that doesn't work, but I fixed it for you:

1) Make karma sig
2) ???
3) Moderate

Re:Borg icon

[MWelchUK]

Ahhh, but generally we don't constantly chide every single move they make.

Re:Borg icon

[KingRamsis]

yeah... maybe u should take a break, get some rest, i had my nose stuck on the monitor couldnt see anything

Re:Borg icon

[istartedi]

Sir, I was bashing the GPL before Bill Gates even heard of Linux. I first read Stallman's manifesto over gopher from a Sun workstation in 1992. I was pleased to see that the GNU project had no kernel, and felt a sense of foreboding about Linux because I forsaw it as heralding the day when independant "garage" developers would be eliminated by the integrated hardware/service companies who are the only ones that can afford to vend software as a loss-leader. I'm sick and tired of people like you accusing the rest of us of not having any original thoughts, and of not being able to analyze arguments and arrive at our own conclusions... In other words: Oooo looks like somebody bought the FSF FUD, and doesn't want to part with it.

Re:Borg icon

[Grishnakh]

The GPL is like a Borg collective that comes to you and asks "would you like to be assimilated?" and leaves you alone if you don't. No one can force you to use a GPL license, unless you're using someone else's product which is under the GPL license.

Of course, there's lots of people that are mad as hell that people use the GPL license, and they can't steal their work. But I'm not real happy with Microsoft's choice of licenses either, but it's their product, so they can choose their license terms, just as the authors of GPL programs can do with theirs.

Re:Borg icon

[hndrcks]

Ah, I was making an allusion to the 'use a firewall' solution for the problem listed in the article. But as a general rule, your outline is 100% correct.

.

No surprise

[jawtheshark]

I mean, NT4 is close to it's end of life .

No, I don't like it... but support for NT4 is dropped at 30 june 2003 and that's not really far away.

Re:No surprise

[MyPantsAreOnFire!]

Very true. I agree that all products have their lifecycles, and NT 4 is most definitely near the end of its cycle.

However, support for NT4 is dropped on June 30th, NOT March 26th. They should still support their products with something better than a half-assed work around.

How can we trust that Win 2003 support will end 4 years after its release, and not when they come across a "really difficult" problem that may require some thought and work?

Re:No surprise

[questionlp]

That maybe the case for NT 4.0 Workstation, but NT 4.0 Server has a different EOL/End of Support timeline (according to Microsoft):
http://www.microsoft.com/ntserver/ProductInfo/Avai lability/Retiring.asp

The key part of that page is:

January 1, 2005 Beginning on this date, Pay-per-incident and Premier support will no longer be available. This includes security hotfixes.

On the page that you linked to, the end date for System Builder (ie: OEM) availability for NT 4.0 Workstation is 30 June 2003 whereas the end date for online support is 30 June 2004.

Re:No surprise

[questionlp]

Whoops... forgot to paste another part of that page:

January 1, 2004 Beginning on this date, non-security hotfixes are no longer available.

Considering that this is a security vulnerability that they are talking about, Microsoft needs to look at what they committed to their customers in that timeline and better get a fix out ASAP!

Re:No surprise

[boinger]

"Close to end-of-life" is not "end-of-life". I'm sure some of their enterprise-level customers (banks, for instance) where "just upgrade the server" isn't an option will have some very favorable (meaning bad for Microsoft) spending decisions next time around.

Who wants to buy an operating system from a company that lets their OSes die before their EOL? I sure wouldn't. The point of an EOL announcement is telling the world that 'as of xx/xx/xx, this product is dead as far as support goes'. Not 'when date xx/xx/xx is nearish, you're SOL'.

But, then, I'm just an admin, what do I know?

Re:No surprise

[EZmagz]

No, I don't like it... but support for NT4 is dropped at 30 june 2003 and that's not really far away.

This is true. However, as a company, you'd think that MS would feel obligated to support its products until the minute they drop support...which in this case isn't for another couple months. This would be like buying a new TV with a 1 year warrantee and bring it back 11 months into its life for service only to be told, "Sorry, it's just too close to expiration for us to care."

As I type this on my NT box at work (note to self: big HMO's won't spend money on OS upgrades despite making a shitload of money), I wonder how long it'll be until we get slammed by this. It can't be too hard to write up an exploit for this...it is just a jacked RPC anyway, right?

Re:No surprise

[TopShelf]

besides, what a great way to promote upgrades!

Re:No surprise

[mrtroy]

Free/opensource OS's provide more support and fixes than M$ does!

Who/what/when/where/why/how the hell does that happen?
Sir William Gatesors must be wanting to buy Iraq once the US is through with it...

Re:No surprise

[ryanr]

Right, which is why they just made the SOL announcement.

Re:No surprise

[shadow303]

Well, if the problem is difficult enough that they cannot implement a fix before they hit the end of its cycle, what is the point of even trying to do it. I am not necessarily saying the problem is that difficult (I don't have the information to say either way), I'm just playing devil's advocate.

Re:No surprise

[herwin]

NT4 may be EOL in June 2003, but that doesn't mean the problems needn't be fixed. NT4 is used by both the US military and the FAA in some mission-essential systems, and I'm sure they have concerns about a Cat 2 problem remaining unfixed. The recommended workaround (block port 135 with a firewall) is only acceptable for Cat 3+ problems. I suspect this issue will bubble up through management once the Government expresses its concern.

Re:No surprise

[banzai51]

Actually, they for all intents and purposes brought NT4 to end of life on Dec 31, 2002. They only extened the deadline for support.

Re:No surprise

[zbuffered]

Who wants to buy an operating system from a company that lets their OSes die before their EOL?

For that matter, who wants to buy an operating system whose security fixes can only be released(or not released, as seen here) by a single company, due to it's closed-source nature?

The only fix is to firewall off the server? WTH kind of a fix is that? That's one step away from keeping the network cable unplugged!

Re:No surprise

[dsplat]

Considering that this is a security vulnerability that they are talking about, Microsoft needs to look at what they committed to their customers in that timeline and better get a fix out ASAP!

Didn't you read the EULA? It specifically said, "This product is supplied without any warrantee for any use whatsoever. Even as a high tech coaster in an oversized box. If the media is damaged, we will replace it with undamaged media, which we also don't guarantee has any usable software on it, within 90 days of the purchase date. Do not use in the presence of electric current. If cough persists, discontinue use."

Re:No surprise

[deadgoon42]

I wondered why my company was furiously upgrading all of its NT4 workstations. And I thought it was because they wanted to increase productivity by not having our systems crash every 5 minutes. Of course getting new systems with more than 64MB of memory has helped as well.

Re:No surprise

[jaavaaguru]

They should still support their products with something better than a half-assed work around.

Haha, I found that sentence funny.

If you're looking for something better than a "half-assed" work around, why are you using NT4? After the Win9x series, I'd say it's Microsoft's worst product. Windows 2000 replaced it, and is much better.

Re:No surprise

[YetAnotherAnonymousC]

After the Win9x series, I'd say it's Microsoft's worst product.

You're giving Microsoft far too much credit. =)

Re:No surprise

[rutledjw]

Yeah, an upgrade to Linux!

Re:No surprise

[jaavaaguru]

Access isn't really a product - it's a toy that you get free with Office to teach your children about databases before they get to use a real one.

I can't comment on Word as I rarely use word processors anynway. Developer studio isn't a bad product - despite lacking a few features (including an ANSI C compiler). Windows NT is really not a good product compared to some things they offer.

Re:No surprise

[DavidBrown]

You are forgetting that there's a work around, and that the number of systems that cannot function with port 135 blocked is probably small. Most administrators will simply block port 135 and go about their business with no difficulties whatsoever. Why on earth would they be annoyed about this if they are not affected?

If there was no fix (and for some there won't be if they need port 135 open), then there's due cause to be upset with Microsoft.

Re:No surprise

[ghum]

"The long time maintainance of an "old" kernel is a very important argument in favour of linux for serious industrial applications."

Using personal computers or technologie similiar to personal computers to control machines is interesting because of the cheep components. I can rememeber machine controlling applications based on os/2, windows 3.x, informix ...

bad luck.

I was responsible to maintain an application written in Foxpro 2.6 for Windows.

bad luck.

I know WHY I switched to postgres, python and stuff like that.

Depending on a closed source vendors maintenance can be a pain in the ass.

Re:No surprise

[slacker775]

The thing I find disturbing from MS' KB article is that if it was Win2K or XP that had the architectural problems that would take a lot to fix and would likely break compatibility, what would they do? On the one side, they leave you vulnerable but on the other, they break many/all of your applications. They are 'fortunate' in that the problem is in a legacy OS that is on it's way out the door so people don't get too up-in-arms about it. Of course, I find it difficult to believe that it would be a massive archtectural redesign to patch this problem. I think they just don't want to go through the effort on an old platform.

Re:No surprise

[Frymaster]

After the Win9x series, I'd say it's Microsoft's worst product.

oh, you are so forgetting microsoft bob.

Re:No surprise

[jaavaaguru]

Oops - yeah I forogt about that. Talking of Bob, do you know of anywhere you can download it from? We were talking about it at work earlier this week and thought it would be funny to get it on a PC.

Re:No surprise

[milkman_matt]

This is true. However, as a company, you'd think that MS would feel obligated to support its products until the minute they drop support...which in this case isn't for another couple months.

These days, it doesn't surprise me that even as a company I don't think Microsoft feels 'obligated' to anyone or anything.

-matt

Re:No surprise

[theblackdeer]

You used to be able to get it (and some other stuff, OS/2, Win3.1, etc) from oldos.org. If you go there now and check the forums, there's a bunch of kids posting ftp logins for downloading old os versions. pretty fun.

Re:No surprise

[YetAnotherAnonymousC]

Well, how far back do you want to go?
IE 4 was a pretty shoddy product, IMHO.
Windows ME (unless you consider that part of the 9x series) was their all-time worst excuse for an OS. DOS 4.0 was pretty bad, too, compared with DOS 3.22 (but part of that was IBM's fault).

My point is just that Microsoft has done way worse than NT 4. But, as you point out, their developer products have generally been pretty good, all the way back to Bill Gates and GW-BASIC.

Oh, and re. Access, I agree. But try telling that to thousands of IT departments. =)

Re:No surprise

[Rary]

According to Microsoft's site: "Microsoft tested Windows NT 4.0 and Windows NT 4.0 Terminal Server Edition. These platforms are vulnerable to the denial of service attack however due to architectural limitations it is infeasible to rebuild the software for Windows NT 4.0 to eliminate the vulnerability."

Perhaps they had an analyst estimate the time/effort involved in fixing this issue, and found that it's based on such a fundamental flaw in the very foundation of NT 4.0 that it would take until well past June 30th to code a fix. If that's the case, then they're not actually cutting off the support early.

I dunno. Just a thought.

Re:No surprise

[spruce]

My old boss told me a story about a big bank that was using SQL server, and they were having a problem and couldn't figure it out. Apparently it got so bad that one of the head people of the bank called Microsoft and actually got Bill Gates on the phone. Shortly after, the main guy from the SQL server group and a team of engineers was on a plane to help solve the problem.

Maybe it's not a true story, but I think that in order to get to the place Microsoft is at, you have to do a little listening to your customers.

If enough big clients complain about this, I'm sure Microsoft will react.

Re:No surprise

[Frymaster]

advogato has a project page for it... which is odd since, obviously, the dog ain't no open-source puppy. there is no apparent attached project.

may i suggest the antique roadshow? that's where i got my copy of apple unix for the workgroup server 9150

Re:No surprise

[cornice]

enterprise-level customers (banks, for instance) have vast resources and talent at their disposal. They can simply edit the source and fix the problem themselves. Oh wait..

Re:No surprise

[jenssoderberg]

"what is the point of even trying to do it"
How about "Respect for the customers" as an argument? Yes it's a good probability that there are only a few thousand customers who are still using NT4. But if you respect the customers you will extend the deadline in their favour.

Just my 2 euro cents

Re:No surprise

[WNight]

Why should a working computer be retired and replace with a new machine and new OS, just to serve its old purpose?

Maybe it sucked to use, and sucked to setup, but once it was running it was fairly good. And if the web site, or file shares, it serves are still in use, what benefit is there from Win2k?

(Don't get me wrong, I completely agree that 2k kicks NT4 (and maybe XP) but I don't think you should need to run out and upgrade a machine that's happily plugging along.)

Re:No surprise

[ModsOnCrack]

Troll?

Re:No surprise

[Vellmont]

But a firewall generally only solves the problem for external attacks. Anyone inside the firewall can still attack the machine. If you're a bank, that's a big problem. You could put a firewall directly in front of the NT4 machine, or on the NT4 machine itself, but that presents its own set of additional support, and/or potential software conflicts.

I can easily see why people would be upset with MS for not fixing a vulnerability for an important product like NT4 while it's still well within the support lifetime. It's stuff like this that make open source software far more attractive. Redhat may not offer patches for old products, but you can always go in and patch the products yourself.

Re:No surprise

[dillon_rinker]

only a few thousand customers

I suspect you're off by a couple orders of magnitude. I support a few thousand NT users at a plant that manufactures parts for nuclear weapons. Draw your own conclusions.

Re:No surprise

[cbreaker]

Actually, NT4 wasn't a bad Windows. It was very simple. There's not much to it. Any versions SP3 and above were as stable as NT can get.

Windows 2000 is much more complicated then NT4. The Active Directory stuff is ridiculous for anything besides a large many site organization. There's a lot more to go wrong with Windows 2000, and it does.

Besides, Windows 2000 IS NT4. It's just got a lot more junk added, and the LanManager server partially disabled (can't be an old LM server without AD.)

As for a Desktop/Workstation, sure, Windows 2000 is better. Supports D3D and stuff. Easier hardware management. More plug'n'play support, better for notebook computers. It's NOT more stable.

Re:No surprise

[EngMedic]

heh. to the Business Calculus mind, lim(EOL,EOL,datex)==EOL.

Re:No surprise

[cbreaker]

Yea, I agree. Until I can run new games on Linux, I can't swith on my main desktop. I used to run Windows 2000, but it had problems with some of the new games, when I switched to XP those problems went away, but added some other problems.

XP is basically Windows 2000 with an updated explorer.exe, but there's little anomalies. One of them being, in Windows 2000, when you END TASK something, it's gone. With Windows XP, if you END TASK something, it usually doesn't, or if it does terminate the task, it does so at it's own leisure.

Re:No surprise

[cscx]

Yeah, I love NT 4 for a few reasons. 1) You can install a full working system in less-than 200 MB. 2) It runs on old hardware, and is still damn fast (I know a guy that runs a couple of NT4 web servers on 486s). 3) The interface is nice, complete, usable, and fast. 4) It's stable (with all service packs, etc).

Can't do that with any Linux distribution and still get the same great graphical interface and speed (NT4's Explorer is the speediest of all the Windows' IMHO). Plus it uses little RAM when running, too.

Re:No surprise

[t0ny]

where "just upgrade the server" isn't an option

"just upgrade the server" is ALWAYS an option, especially if you already have Disaster Recovery plans in place. The only thing stopping someone is either complacency, laziness, or lack of knowledge.

Im not saying its easy, but if you know what you are doing, it just takes a lot of planning, and understanding both the OS and how applications work. I support tons of apps I cant use; because at my level they are pretty much all the same. Some are front-ends to a database, or a legacy database, or whatever.

And as someone who has worked in Banking IT, they are hardly what you would call 'cutting edge', they are more like 'ragged fringe'. Most of the work is over-politicized by people who dont know what they are doing. Lack of understanding breeds fear. Fear breeds stagnation, and stagnation, well, it doesnt get you moving forward.

Having so-called 'project managers' outnumber the actual workers is quite common in banks. About the only thing they do is keep the store and restaurant people employed by taking 'breaks and lunches' for 7 out of 8 hours every day.

Who wants to buy an operating system from a company that lets their OSes die before their EOL? Personally, this doesnt surprise me one bit. Windows 2000 is a million times better than NT4, in every possible way. Plus, NT4 Server has been around since 1996. If MS wants to truly make their supported products secure, they eventually need to drop the dead weight; you can only patch that old coat so many times before somebody tells you "hey man, you need to go buy a new coat". I dont even think its that they dont want to fix it; its probably just such a major problem that they would need to re-engineer the OS; but they already did that in their new products!

Personally, I think they did the responsible thing; they came clean and said "you know what, we have fixed things in the past, but this one cant be fixed. Now that you know, you need to use that info and plan around it."

Re:No surprise

[cbreaker]

Well, you're right about one thing, you can't get the SAME interface on a Linux dist with a very small footprint. But you can easily get a nice graphical desktop, complete with lots of nifty packages with plenty of different types of serving software (samba, apache, etc) for well under 200MB.

The reason lots of linux distributions are so big by default is that they install lots of stuff you don't need and they usually install development packages (gcc, etc.) You can get a nice working Linux desktop for a suprisingly small amount of space. You could try installing Gentoo sometime, and see that it's possible!

But, that's not the point. This don't always have to be a compaison between NT and Linux!

The explorer in '95 and NT4 were quick since they didn't have any of the IE stuff integrated. There's a few tools out there you can get for the newer windows versions to use the old fashoned (NT4/'95) explorer back and even remove IE alltogether. Kinda neat.

NT4 can run on old hardware because it is itself pretty damned old. It's 8 years old now. It had a very long life if you ask me, but this is also due in part of the fact that PC's haven't changed too much in the last decade; they are basically just faster.

Re:No surprise

[jaavaaguru]

In XP Pro it handles End Task the same way as Windows 2000 does. I use it when I log out and forget to close a Cygwin window for example - works fine there.

Re:No surprise

[cbreaker]

It doesn't handle it the same way, because when a program becomes defunct, unresponsive, whatever, XP doesn't kill it straight away like Windows 2000 does. Sometimes they are never killed and I need to reboot.

The other day, I had a hung explorer Window. I tried to End Task it, and of course it didn't end. I logged out, and then logged back on - and it was STILL there.

I never had a problem with Windows 2000's end task, and it's the same machine.

Sure, if a program is running fine, you can end task and it'll close down. That's a given. I mean when a program is hung. Otherwise I don't use End Task for much.

Re:No surprise

[ceejayoz]

Click the "Processes" tab and close the process there. That works no matter what.

Re:No surprise

[cbreaker]

You think I'm lying about this?

I've ended tasks like the best of them from Windows NT 3.1 all the way up to XP. And I'm TELLING you, on Windows XP, using the End Task function in Task Manager, by clicking a process in the list, and then clicking the button, does NOT function the same as Windows 2000.

It does not work "no matter what." Maybe you don't do as much stuff with your machine as I do with mine, but I have lots of stuff hang on me for this reason or that, and End Task on XP is flakey. It doesn't always end the task right away, sometimes it takes minutes, and in some rare cases it doesn't end the task at all.

Re:No surprise

[bergeron76]

Waitaminute - Couldn't it be proved that NT4 can be patched and that the architecture isn't that different by showing how "integral" applications can run on both NT4 _and_ Win2k equally (with regard to this bug)? As such, doesn't this contradict Microsoft's arguement?

This move is nothing short of irresponsible on their part. They have vested interest in proving that their software is "Trustworthy". If they can't live up to past promises, how can consumers/businesses be expected to trust them on their "future promises"?

Re:No surprise

[afidel]

Just upgrade the server(s) is not an option if there is not enough money in the budget to do so. If you have a support contract which states critical issues will be dealt with until 2004 or beyond and the support contract is already paid then why should you have to blow your budget because Microsoft is lazy? I might have just upgraded some other part of the network and had the upgrade of the legacy servers set aside in my budget for 3 quarters from now, what do I do now that MS has told me my support contract is worthless and that I am SOL? As to MS dropping NT4, fine but they have made a commitment and taken in revenue based on an EOL timeline of several years from now, should they have given that extended EOL, who knows, but they did and any reputable vendor would stick to that. This is just another reason why enterprise customers will never move business critical apps to NT, if you want to see what a good company does look at HP and their EOL of the 3000 line.

Re:No surprise

[afidel]

the difference between the two is the defualt kill signal the OS sends the application. If you want proper kill back us pskill from sysinternals, it uses the equivilant of kill -9.

Re:No surprise

[cbreaker]

See, I knew there was a difference.

Does pskill change the behavior of Task Manager, or is it a command line thing like the good old kill.exe I used to use to kill store.exe in Exhange? =)

The funny thing is, as an (ex)MS tech support person, I used to e-mail (obviously by hotmail or something) kill.exe to stop a hung store. Probably not the best thing to do but boy, it sure saved me a lot of time.

Re:No surprise

[almightyjustin]

We were one of the few families that actually bought it. I made disk images of my original floppies...email me if you want them (11MB or so). It's actually quite a fun program that does what it's designed to do very well; I'm not sure why everyone bashes it so much.

Re:No surprise

[Reziac]

Absolutely. If something is doing its job efficiently as is, and isn't falling over every 10 minutes, why screw with it, let alone upgrade it? While I'll be first in line howling about how Win2K is miles better than NT4... well, I'm not upgrading my old Win95 box either. It gets its expected work done just fine the way it is.

Re:No surprise

[Reziac]

FWIW, I've had the same experience with XP -- something was hung, I tried to End Task, End Process, wait, wait, wait.. and sometimes it just never happens and I've had to shut down and restart to get rid of whatever. I don't even use XP that much, and I've still noticed it.

Come to think of it.. IIRC, this happened at least once after I'd had Help up for a while. I wonder if the "no I won't shut down dammit!" thing inherits from the pasted-on half-baked WinME Help system -- in WinME, just using the new help causes the system to go unstable, and one result can be that it takes for blinkin' EVER to shut everything down (like, 20 minutes, no kidding). I did actually get it pinned down to WinME's New Help as *THE* culprit. (If I never use it, my thoroughly-cowed WinME box NEVER crashes. If I use New Help, it *always* crashes within 15 minutes after Help is closed. Guess what I avoid like the plague.)

Re:No surprise

[afidel]

command line, it has an accompanying utility called pslist that is like ps and top =)

Re:No surprise

[zbuffered]

No, but I am mighty put off by this. Security fix too hard to implement? Tough shit! You implement that bitch anyway! Do what it goddamn takes.

Re:No surprise

[cbreaker]

Not to mention the help isn't generally very helpful. I've tried REALLY hard to use help in various MS softwares.

Just today, I was in Outlook XP and I wanted to show the "From:" field to specify a different address. It wasn't in the drop down that it was in in Outlook 2000.

I popped open help. "Show From Field" is the query. It's all help for MS Word! I couldn't find a single help for Outlook no matter how hard I tried, and forget finding anything useful even in the word help. I ended up bringing up AD Users and Computers and changing my default e-mail address on the exchange server.

Re:No surprise

[t0ny]

why should you have to blow your budget because Microsoft is lazy

Again, its not a case of them being lazy. They are basically saying its not technically possible to fix the problem without essentially giving you a new operating system. And if they are 'essentially' going to give you a new OS, then why shouldnt you just buy one?

That would be like GM dropping a new engine in your car because there is a fuel injector flaw. Too much work, too much money, not gonna happen.

I *assume* that your company has a firewall, or hopefully a full-blown dmz. Either way, youve lived with the flaw for this long, so I think you'll get by ok.

what do I do now that MS has told me my support contract is worthless and that I am SOL?

They didnt say they arent supporting NT4 anymore. They just said they cant fix this problem, and may stop supporting it earlier than expected. My prediction is they stick with it for the full term; they generally throw out feeler statements like this, and judge how much resistance people put toward it (like the retirement of the NT4 MCSE cert).

This is just another reason why enterprise customers will never move business critical apps to NT, if you want to see what a good company does look at HP and their EOL of the 3000 line.

Ummm... unix is how old? also, it seems kind of silly of you to act like the whole world is crashing down. This is just one limited risk flaw. Its not even an exploit, because the worse it can do is crash the server. On a risk-assessment scale, I would rate this as a 3 out of 10.

At any rate, its kind of unrealistic to not plan for the unexpected. As I said before, disaster recover should easily account for this; if there was a fire in your server room, would it be possible to recover from it? or is your company so strapped for cash that it would break them? If its the latter, I think you have more serious problems than your NT4 servers.

Re:No surprise

[Tony-A]

Amen brother. The one useful innovation in Windows95 was the ability to kill useless help windows with a single click.

Re:No surprise

[boinger]

It is quite apparent that you have no idea what you're talking about.

MANY banks (as we are focusing on them) still have to run HPUX 9, NeXT cubes and even Windows NT 3.51. It is absolutely not because of laziness, it's because of SLAs demanded by customers. There's little point in trying to renegotiate because your heavy-hitters won't stand for adjustments. Remember, it's not just your backend that's being updated. You have to convince all of your customers who pay for those services to upgrade, too. And some don't like any changes, even for the better. Those tend to be the larger companies (bigger, thus, harder to change) who, should you alienate, can completely obliviate a project at least, an entire branch at worst.

I speak from experience, here. I was on Y2K watch and had to reboot all the WinNT 3.51 boxes at 00:01 because we had to just suck it up and let the proprietary software roll to year "19100". There was no option to upgrade because we were using a very specific build of some very specific software to do some very specific processing of several billion dollars a month. No way could we just tell all those customers "do things differently now - sorry it's a pain in the ass for you"

So, little troll, I bit. There you go.

Re:No surprise

[kyletinsley]

The only fix is to firewall off the server? WTH kind of a fix is that? That's one step away from keeping the network cable unplugged!

Anyone who doesn't firewall off SMB packets to keep them from escaping out to/from the internet SHOULD have their network cables unplugged... :)

However, for medium to large sized companies/networks, the threat of a hostile attacker being inside the firewall is just as great or greater than outside, and you're absolutely right, they're saying "fuck off, you're on your own on this one."

Re:No surprise

[kyletinsley]

ehhh, it's late.... shoulda read more carefully. (135, not 139/etc)

RPC (135) has always been running on any NT box I've ever seen, even on systems where you try to eliminate every unnecessary processes. I think there are some services that require it for some god-awful reason, so disabling it would probably cause crazy unforseen problems. A fun time is to be expected!

Re:No surprise

[hany]

After the Win9x series, I'd say it's Microsoft's worst product. Windows 2000 replaced it, and is much better.

Coincidence is, that Windows 2000 (or why not just straight XP?) is also very good for Microsoft's income. And this income originates in wallets of its customers.

So that's why there are reasons to use what you pay for even if it is getting old.

Re:No surprise

[surprise_audit]

Or it may be that the bits and pieces that make up M$'s "extended" RPC are scattered through a bunch of DLLs and nobody now knows where they are... Just as bits of I.E. are scattered through unrelated DLLs to make it next to impossible to remove safely.

Re:No surprise

[dotgain]

I think that point is, since they say it's "architectural limitations" make fixing it impossible:

• NT4 was always vulnerable
• NT4 is currently vulnerable
• MS, in seven years, never made NT4 secure. And they can't.

It didn't just get this vulnerability, it was only just discovered. It always had it, and from this track record you should expect the same from future releases.

In the not too distant future, win2k will be deemed insecure and unpatchable due to "architectural limitations".

Re:No surprise

[ax_42]

Uhhhhh. Firestone regrets to inform you that we see no problems in our tires, thanks. Have a rolling good time out there.

MS has a product out. The product has a flaw. The product is within the timeframe of their so-called support. Fix the fscking problem, guys.

OTOH, this is great stuff for any "let's switch to an OSS architecture presentation". The suits are always ragging on OSS for lack of support --- this news just shows that you can't count on safe-as-houses MS *cough* either.

Re:No surprise

[herwin]

Would you prefer a mission-essential system that had to be updated every time MS released a new operating system, or one that had a long history of working correctly? Imagine hosting the shuttle flight control software on Windows XP. Sometimes it is not a good idea to be an early adopter.

Re:No surprise

[PetiePooo]

I support a few thousand NT users at a plant...

The sad thing is, in Microsoft's eye, I'd be willing to bet that YOU are the customer, not your users. Therefore, your "few thousand NT users" count as a single customer in their eyes..

Re:No surprise

[Reziac]

Yeah, that's a problem with M$'s help, and more so with newer stuff. I don't use Outlook so can't say for sure, but my guess is that since it's now considered "part of" Office, and you're sorta expected to use Word for your mail editor, it's just kinda got lumped together (or more to M$'s methods, likely the old Outlook Help got *removed* but was never replaced, so now it points at what's left instead).

For real fun, check out Help in XP. I'd really, REALLY like to have words in a dark alley with whoever thought changing Find and Help to webized format was a great idea.. not to mention that in XP, many Help items link not to local Help but rather to M$'s online knowledge base (oh, that's real useful when DUN isn't working!), which they rearrange every year or two ... and since they just changed it all around again, much of XP's Help is now quite thoroughly borkend.

I generally like Windows itself (tho I don't run any other M$ software at all), but there are times when I'd like to keelhaul the people who make the design decisions!!

Re:No surprise

[cbreaker]

Yea, I agree, about the web stuff. I guess it's their idea that since most people do the "web" so often, putting familiar looking "webified" components all over the place is the way to go.

I don't agree. There's no reason to webify something that doesn't need to be webified. Unless you change the ENTIRE system to run from a web browser (which seems to be the way MS is going anyways..) then keep that stuff for when you're surfing web pages.

I think the overall idea behind all of this is that they think "people are stupid." You need to be spoon fed everything. This seems to be the mentality that *MANY* technical or seasoned computer has. It's not right.

You can't underestimate people. A computer is a complicated thing, sure, but there's no reason to always put a big red button that says "PUSH ME TO USE XYZ!!"

Re:No surprise

[Reziac]

While I think it *started* as "the web is so easy, all the morons can use things easier if it looks like the web", I'm pretty sure once the idea entered M$'s heads, it occurred to them in a hurry that this was also THE way to channel everyone toward *expecting* their applications to be accessable only via web.. and M$ has stated in so many words (at their seminars which I attend regularly) that subscription applications via internet is where they want to go.

As you say, making something simple to use and making it condescending to the user are two different things. Simple and straightforward are good. Making it easy for newbies to use and learn is good. Telling them how stupid they are for needing it "made easy" is bad, whether you do so to their face or via that big red button.

And contrary to what some folk think, just because something is easy for newbies to use and learn (being computers are almost purely learn-by-doing) doesn't mean it can't also be powerful and configurable for advanced users. Corel is one of the few software companies that gets this.

Re:No surprise

[cbreaker]

Yea =)

I haven't used much Corel software since like.. Corel Draw! about 6 years ago. I couldn't vouch for you there hehe.

So many times I see people on boards like Slashdot say "but, the NEWBIES!!! THE NEWBIES!!" in defense of all non-computer litterate people around the world. Most of the time, these people don't give the computer layperson enough credit. Just because you don't use a computer for a living does NOT mean you can't figure it out!

I think the word "condescending" you used is perfect.

Re:No surprise

[Reziac]

My fave example is Corel PhotoPaint (I'm in love with v8, but will use whatever is handy). Anyone can figure it out, and you can ignore all the higher functions, or play with them, as you like -- learn the program thoroughly and create marvels, or just do quickie stuff, whichever turns you on.

A lot of people just want the computer to do its job and not annoy them with having to learn new stuff they're not interested in and that has no bearing on their intended task. That's fine -- after all, I shouldn't have to learn how to forge a hammer every time I want to drive a nail. Just pick up the basic hammer and do the obvious. After a while I'll learn to keep my thumb out of the way, you don't need to put rubber thumb guards on every nail in the world. :)

Re:No surprise

[hawkes]

Actually, I'm somewhat surprised (well, not really, this IS /.) that nobody has pointed out this quote from the security bulletin. "The product of such a rearchitecture effort would be sufficiently incompatible with Windows NT 4.0 that there would be no assurance that applications designed to run on Windows NT 4.0 would continue to operate on the patched system. " It appears any "fix" for the problem on NT4 might actually be worse than the problem itself. Would you rather have a possibility open for a DoS attack on an NT4 box, or most RPC apps "broken" by a security hotfix?

Re:No surprise

[Rary]

Precisely.

Re:No surprise

[jaavaaguru]

Windows 2000 (or why not just straight XP?)

The majority of MS's income is from corporate/business customers. For these customers, is there anything that XP does better than Win2K? And Win2K's got tha advantage of having been around for longer, and having more of the bugs ironed out.

How much

[Gortbusters.org]

is NT really used these days? I remember some of our management applications (browser based) had to be NT tested a year or two ago.

These days it's all Windows 2000 and XP, and people are considering dropping the 2000 support sometime in the near future.

Re:How much

[intermodal]

my wife used to work as a web developer (until six months ago) for a logistics company and they were too cheap to upgrade anything...NT4 everywhere, including the servers.

Re:How much

[G Money]

You're kidding, right? The clients I work with are predominantly NT based because the of the license/security issues surrounding Microsoft and they don't want to be lead deeper into the licensing pit that is Microsoft. Granted, NT is very old, but if you have to pay that much for an NT server license, you're going to want to get your moneys worth for it (if that's at all possible).

Re:How much

[narrowhouse]

Dropping 2000 for XP server? Oh wait there is no XP server... Maybe the people you are talking about don't use severs? Don't get me wrong I would like to see more people consider dropping Windows 2000 servers, they would be switching to UNIX, or LINUX 90% of the time if they did.

Re:How much

[Muerto]

a lot of people still use NT... it's tested and works... People spend a lot of money developing for a platform to keep up with microsoft constantly changing the os.. they get with something that works... and leave it.

Re:How much

[jawtheshark]

I work currently at a large bank part of the Fortis Group that is entirely based on NT4. As a developper I have a kick-ass new machine, complete with XP sticker on it but it runs NT4.
Mission before that was a local insurance company, also completely NT4 based though left and right Win2000Pro is popping up.

Re:How much

[tuck_williamson]

For the MS stuff I work on we don't have much choice (other than re-developing some 3rd party stuff on our own (which we are)). Regardless NT4 has other problems... hardware is getting difficult. The last several stock systems we ordered wouldn't run NT because of incompatibilities with new hardware that has no support in NT. We now have to be ever more careful about the systems we build (since we can't really use stock) to make sure the MB + periphals won't give NT a heart failure!

Re:How much

[Atzanteol]

It costs a lot more than the price of the OS to upgrade a production system. Custom code must be ported to the new OS, tested, and fought with...

I've got a client who's just now *considering* an upgrade to 2000 (not XP or '03 mind you), and that's after we suggested it to them as a matter of security.

Re:How much

[Gortbusters.org]

Great googily moogily, were they running IIS on NT4?

Re:How much

[intermodal]

yes, internally. but she got them to start procedures for switching to Linux and Apache for at least serverside...hopefully it worked, but i know the incompetents running the servers were fighting it tooth and nail.

Re:How much

[(H)elix1]

Dropping 2000 for XP server? Oh wait there is no XP server...

Ask again on April 24th... god help us all.

Re:How much

[kruczkowski]

Army and Air Force domain controllers all run NT

Re:How much

[FeloniousPunk]

I work as a sysad at a Naval Air Station. We'll be switching to Win2k in another two months from NT 4.0.
You'd be surprised how much NT there still is out there, and in which places.

Re:How much

[surprise_audit]

Ahhhh, now there's something that makes sense - M$ is trying to stampede folks like your clients into upgrading, rather than hanging on to their old (but still working) NT4.0. I wouldn't be at all surprised if M$ has a folder full of deliberately introduced security problems, to be "discovered" whenever they want to either encourage upgrades or to get other stuff out into the marketplace.

And if you don't think that's likely, just consider how many folks would voluntarily download DRM-enabling patches. But if those DRM (or whatever else) patches are a hidden payload in a security patch, who's to know? The sheeple that automatically click on "Windows Update" will install a patch to "stop Chinese hackers stealing your bank account", but maybe not a patch to "stop you playing MP3s"...

Re:How much

[johnnyb]

There's a lot of companies using NT on Alpha. They can't upgrade without shelling out a whole bunch of cash for an equivalently-powered Intel machine.

Microsoft security

[deanj]

Kinda makes you wonder what other fundamental flaws are there in NT4.0 that will prevent fixes from happening. ...And Microsoft wants to be known as a company you can trust with security. This should throw them back a couple of eons.

Re:Microsoft security

[rastachops]

How many open source companies openly support older products? Dont' they just say upgrade to the latest major revision? I think its unfair picking on Microsoft because they decide to drop an OS that was in development over 10 years ago.

Re:Microsoft security

[G Money]

The difference with open source software/distributions is that upgrades to the latest version are free. While upgrading does take time it does not cost anything in terms of licensing fees.

Re:Microsoft security

[rastachops]

Just becuase the software for open source is free, this doesnt mean people will upgrade. Well in the business world... when new hardware may be needed, custom software may not be compatible with the new setup and so forth.

Re:Microsoft security

[tomhudson]

The other diff. is that you can still find/pay someone to backport any patches to earlier versions of open-source software, if you really want to.

Re:Microsoft security

[jaavaaguru]

They give you the latest product (as opposed to selling it to you). That's what support contracts should be for. Microsoft should do this.

What about Microsoft's SLA's?

[leerpm]

Don't they promise to support products for a given amount of years for some enterprise customers? What will happen in these cases?

Re:What about Microsoft's SLA's?

[Winterblink]

If there's an enterprise level customer out there that doesn't have a firewall blocking unnecessary ports anyway, then let them rot.

Re:What about Microsoft's SLA's?

[SquadBoy]

Three words: Defense in Depth. MS is wrong and this is not a workaround it is telling you that you don't need defense in depth and they are morons.

Re:What about Microsoft's SLA's?

[Winterblink]

I don't see that at all. I'm seeing them owning up to a shoddy product being shoddy, and suggesting people utilize one of the other layers of defense they should be utilizing. And in reality, if they were utilizing them effectively they wouldn't need to worry about this particular problem anyway.

Re:What about Microsoft's SLA's?

[banzai51]

...And that time expired about a year ago. MS has pushed back the final support date for NT4 in deference to these customers.

Re:What about Microsoft's SLA's?

[zootread]

If there's an enterprise level customer out there that doesn't have a firewall blocking unnecessary ports anyway, then let them rot.

Ok, well, then what about attacks from behind the firewall? A firewall only prevents so much. If one person executes or gets infected by a trojan/worm exploiting the hole, there goes every NT 4.0 machine behind the firewall.

A firewall is not a solution. Sure, you can have an individual firewall for every NT 4.0 machine on your network, but that is going to cost you.

Re:What about Microsoft's SLA's?

[Florian Weimer]

Don't they promise to support products for a given amount of years for some enterprise customers? What will happen in these cases?

If I were Microsoft, I'd simply offer free licenses for Windows 2000 to please these customers. Most of them will be thankful for this noble generosity, and won't notice that they have to buy Windows 2003 licences (or what's its name?) when they finally switch from NT.

Seems strange but...

[mlknowle]

It seems strange on the surface for them to admit that their product is 'unfixable,' but really, doesn't it make sense as an upgrade-inducer? Granted that in a more competitive market people would be put off by this, but some people don't regard the other choices with which we are so familiar as acceptable options, leaving them sending their checks to Redmond no matter.

Then again, people still buy new models of cars which have had huge saftey problems in the past, even though other choices are availble; perhaps the real phenomenon is that marketing is sometimes more powerful than good judgement.

Re:Seems strange but...

[luzrek]

What about Redhat Enterprise Edition? Sure, it cannot play windows games, but for running servers it is certainly a viable alternative to Windows OSs. It sure costs less than 4000$ a license. Perhaps the companies that were too strapped for cash to upgrade their NT servers are still to poor to buy new lisenses for MS server software.

Re:Seems strange but...

[rmohr02]

Then again, people still buy new models of cars which have had huge saftey problems in the past...

So you're saying I shouldn't be driving a pinto?

Re:Seems strange but...

[esanbock]

Oh really? And what about the cost of retraining all their Windows people? Maybe they should just fire all their IT people and hire some l33t linux people? Start seeing the forest for the trees.

Re:Seems strange but...

[luzrek]

Maybe they should just fire all their IT people and hire some l33t linux people?

Luddite alert! Just because you do something one way now doesn't mean that is the best way to do it.

They wouldn't have to retrain all their data entry and secretarial workers since they would be replacing the operating system on the servers. Since everything is GUI now anyway, I doubt that there would be much re-training required for anyone but the programmers and system administrators even if they did replace all the MS products with OSS alternatives. Besides the Windows NT desktop has about as much in common with the Gnome and KDE desktops as the XP desktop.

For people who are scared of both getting locked into MS's licensing schemes and jumping headlong into another operating system, consider replacing your applications but not your operating system. OpenOffice and most of the OSS databases run on both GNU/Linux and Windows so you can keep your data out of propriatary formats without the dreaded "retraining" costs.

Re:Seems strange but...

[rowanxmas]

Because all of their people have a big, what, 4 years max using NT? And didn't have to learn it when it came out?

Re:Seems strange but...

[slagdogg]

Then again, people still buy new models of cars which have had huge saftey problems in the past, even though other choices are availble; perhaps the real phenomenon is that marketing is sometimes more powerful than good judgement. Some people, myself included, buy cars based on more than just the safety numbers. And some people can't afford a safe car, quite frankly ... it's hard find a car with an airbag for a couple grand, as I found out in high school.

Wow.

[Hanji]

All Microsoft-bashing aside, does anyone else see something majorly wrong when it's impossible to fix a fairly serious exploit due to architecture limitations in the OS??
They're basically saying that they can't fix it because the OS makes it impossible to do so. Not because it's inherent in some protocol, or because it is a natural effect of some kind of desired behavior or something, but because the OS DOESN'T SUPPORT IT?????
That's just wrong.

Re:Wow.

[Steeltoe]

All Microsoft-bashing aside, does anyone else see something majorly wrong when it's impossible to fix a fairly serious exploit due to architecture limitations in the OS??
They're basically saying that they can't fix it because the OS makes it impossible to do so. Not because it's inherent in some protocol, or because it is a natural effect of some kind of desired behavior or something, but because the OS DOESN'T SUPPORT IT?????
That's just wrong.

You're working yourself up here... Consider this like Red Hat refusing to patch up Red Hat 3.0 with the latest security fixes.

It's bad news here at work though, we still use NT. No need for an upgrade with all the hassle it brings, we get the development work done just fine. It makes excellent economic sense to skip a few Windows-versions for big businesses. It's just a huge hassle and economic drain to switch to newer versions when what you've got is working.

What should upset us is that Microsoft is refusing to support NT, when they've still committed to supporting the platform..

However, if a work-around is good enough, then it's good enough. This ain't rocket science, it's IT. IT is quite stupid and non-academic unfortunately.

Re:Wow.

[Hayzeus]

I doubt it's impossible. It's just that it may involve more than a trivial number of changes and all the attendant risks and costs that come with making those changes. They're obviously not willing to do this with a product nearing the end of its life cycle.

They should have probably used the word "infeasible" rather than "impossible". But then I'm no marketing weasel. Perhaps they had their reasons.

Re:Wow.

[John Sullivan]

If I put a perl virus here, I wonder how many people would run it, just to see what it did...

su nobody -c 'perl -e stuff'?

Re:Wow.

[dhovis]

You're working yourself up here... Consider this like Red Hat refusing to patch up Red Hat 3.0 with the latest security fixes.

Except that the source code to Red Hat 3.0 is publicly available, so a fix could be made by anybody. The problem here is that the only people who could fix NT4 is Microsoft and they are refusing to do so. Worse, we can only take their word for it that a fix would be nearly impossible.

I'm not a big proponent of open source, but this is a case where there are clear advantages.

Re:Wow.

[tomhudson]

Also, you can just upgrade the part that needs patching, for example, the kernel, and keep pretty much everything else the same. Besides, nobody's telling you that you have to pay $XX.YY to upgrade, and that you have to toss all your old hardware out, and most of your apps, too, with open source.

Also, if the previous version works fine for you, there's no licensing restriction stopping you from continuing to deploy it on as many machines as you want. Don't forget, there are still a lot of places that run (gasp!) DOS apps, and Win31 apps, and old PICK machines, etc.

Re:Wow.

[molarmass192]

You beat me to it, exactly right. When MS releases the source code to NT 4.0, then the comparison to RH will be valid. I wouldn't hold my breath waiting for that code though, even though the product is being obsoleted. If I had mod points today, you'd get a +1 informative!

Re:Wow.

[ninewands]

Consider this like Red Hat refusing to patch up Red Hat 3.0 with the latest security fixes.

Actually, I consider it more analogous (but of opposite polarity) to RedHat continuing to patch 6.2, which goes EOS in four days.

Like an earlier poster said, "It appears you get BETTER support from OSS vendors ... "

Re:Wow.

[BornInASmallTown]

I'm not a big proponent of open source

Can somebody get this guy outta here? :-)

Re:Wow.

[dhovis]

Sorry, I realized after I submitted the comment that I didn't phrase that right. I appreciate open source, but I don't think it should be manditory or anything.

Anyway, my comment could have been modded (-1:Redundant), just on account of the fact that I posted one of the obvious advantages of open source on Slashdot. :-)

Re:Wow.

[Steeltoe]

I'll reply to you, since you have the highest score. But this goes to everyone who replied to my post:

It's clear you have an agenda. The article didn't mention Linux or Open Source at all, neither did the post I replied to. So where does all this come from? As far as this thread, this discussion is Off Topic.

Of course you can patch it up yourself, or pay someone to do it with Open Source. If you go for closed source commercial products, you have yourself to thank for being forced to upgrade when the vendor drops support for old products.

For the record, given the choice, I would go for Open Source products. I'm even using and advocating them at work. However, that doesn't mean the current OSS products are usable for all tasks. Even I wouldn't recommend it for everything we do. My experienced with OSS / Free Software is varied, but overall positive.

End of Life

[rf0]

You have to wonder how long a company can support an operating system. You have to remember that NT was released in the the mid-90s so its 7+ years old. Microsoft is beginning to put NT4 to end of life and that the people who will really know the code may of left Microsoft or moved on.

I'm mean we all go on about how bad MS is but you can expect them to support everything forever can you?

Rus

Re:End of Life

[digitalhermit]

I'm mean we all go on about how bad MS is but you can expect them to support everything forever can you?

No, you're right. But wouldn't it be great if you could had the source code available so that you could backport a fix? Granted NT is ancient in computer years, but lots of shops still use it extensively.

Re:End of Life

[fobbman]

Not forever. Just until June 30, 2003 like they said that they would.

Re:End of Life

[!Freeky2BGeeky]

The problem with that, is Win2k is supposedly built on "NT technology" so you'll never see that source.

Re:End of Life

[ottffssent]

There's a big difference between "support everything forever" and "support products until the promised EOL". The former is unreasonable; the latter quite possibly legally enforceable. Anyone who gets nailed through this flaw prior to their EOL (whether it's June 30 of this year or Jan 1 '05) should consult with a lawyer.

Re:End of Life

[Alex]

You have to wonder how long a company can support an operating system. You have to remember that NT was released in the the mid-90s so its 7+ years old. Microsoft is beginning to put NT4 to end of life and that the people who will really know the code may of left Microsoft or moved on.

Forever is the answer to your question - if they had a decent sustaining organisation they wouldn't run into problems like this - they'd have people who's job it was to know the source.

Alex

Re:End of Life

[Dregnus]

I thought NT stood for new technology, so Win2k comes out and says "built on NT technology" - built on new technology technology? It's like saying your going to put a NIC card in your computer :)

Architecture

[RayOfLight]

An architecture that doesn't allow a bug/vulnerability to be fixed??? Come on, that clearly shows that its flawed by design. ;-)

Re:Architecture

[jayayeem]

Maybe not by design, but definately a flawed design.

Just goes to show you should look up your facts

[Neophytus]

I was going to say they had stopped supporting NT4 anyway so were within their rights, but I looked it up and it appears they are providing NT4 hotfixes until the end of 2004. Either way, a service pack or something equally dramatic for one flaw I think is overkill and blocking port 135 on a firewall is a better option.

Re:Just goes to show you should look up your facts

[finkployd]

Except that port 135 is the endpoint mapper for DCE's RPC portmapper (which microsoft took, stripped all the kerberos security out of, and called DCOM). Granted this does not affect most people, but those of us running DCE are fearing that people will block this port then wonder why their applications broke.

Finkployd

Re:Just goes to show you should look up your facts

[indiigo]

90% of companies block this port, along with the other ubiquitous 130's. Windows or not. blocks this port.

Irregardless (love saying that word,) Not making a patch makes all internal networks with NT$ vulnerable.

Re:Just goes to show you should look up your facts

[pyrrho]

why stop with blocking port 135, why not stop all the security problems by just turning off power to the machine... all fixed!

It's ok

[ultrabot]

It's their right to do so. I don't see a reason how they are doing something "wrong". It's their product, and they have said they have discontinued it. It's up to the users to find a suitable fix for the system.

Kinda makes one think of benefits of open source; if something like this happens, you can always hire some hacker to fix the hole, wherever it is, for the right amount of money.

Re:It's ok

[GweeDo]

It is their right to do this? So what you are saying is if a company says "we will supply you with fixes until blah blah date and you will pay us blah blah amount of money for this" they have the right to say "well...never mind...by blah blah we meant blah blah - 4 months...you don't get any of your money back...suxors to be youzors!" Yeah. That sounds like their right...my left nut

M$ says

[Rooked_One]

M$ Exec's - "Ficksing it is two hurd for us. Lets jest stop seportang it."

M$ Programmers - "But its a product that is still in use, we have a responsibility to our customers."

M$ Exec's - "Wats this respongeability you say?"

Re:M$ says

[essdodson]

I sure hope that English isn't your first language.

Re:M$ says

[alienmole]

Did you miss the point? Notice how the programmers' statement is almost grammatically correct, while the execs are illiterate. This is a demonstration of the Dilbert principle, in which the prize idiots get promoted into management, where they can only do harm indirectly.

Re:M$ says

[tomphaedrus]

What is up with the use of M$, replacing the S with the dollar sign? I've seen tons of people use it as an insult, while being thoroughly amused at themselves for it. Can anyone explain to me WHY this is either 1) funny or 2) an insult in the first place? Microsoft is A COMPANY they exist TO MAKE MONEY. Yes, their primary concern is TO MAKE MONEY. Replacing the S in their name with a dollar sign is a completely inane gesture. There is nothing wrong with existing to make money, not heedlessly sacrificing one's earnings and productivity because someone stands on a pedastal screaming its a sin not to. That's what is great about the United States - if you don't like windows DON'T BUY IT and shut up about it.

Re:M$ says

[essdodson]

I see now. Subtle.

Re:M$ says

[Narchie Troll]

"That's what is great about the United States - if you don't like windows DON'T BUY IT and shut up about it."

Hey, you know what else is great about the United States? Freedom of speech.

Re:M$ says

[gearheadsmp]

I read the parent post, and for a moment I thought the MS exec was saying, "Fisting is too hard for us. Let's just stop reporting it"

Re:M$ says

[div_2n]

The premise of a company is to offer a product or service for the benefit of customers in a manner that affords a profit. This is not to be confused with profiting from customers with a product or service.

The distinction is whether your focus is profit or service. I and many others feel that Microsoft's agenda is profit over service. The reason I reached that conclusion was when I saw Microsoft employ a licensing scheme that is seemingly for one purpose and one purpose only--profit.

When the time comes that profit seems to be the sole motive for a company over service, customers tend to shy away. It is happening now with Microsoft. Companies that never before considered alternatives are now looking hard at them.

Profit over service. That is why the $ is used to replace the S. At least that is why I do it. I can't really speak for others.

Re:M$ says

[Noah Adler]

Tom you are a DUMBASS. Poland sucks HAHAHA.

nt

[sirinek]

If you are still running NT4, you probably are too busy (or lazy) to update security patches anyway.

NT4 needs to DIE. If you prefer the Windows platform, you've had ample time to move to 2K, or else another platform.

Re:nt

[Lxy]

NT4 and Windows 2000 have compatibility issues. For instance, running a PDC controller on NT4 makes it more compatible with NT, Win9x, 2k, and XP. Running a Win2K PDC cuts off functionality from NT and Win9x clients. So why am I running 9x and NT workstations? Some stuff just won't work on new OS's. We've got servers(!!) running on Windows 3.11 because the software is too b0rked to run on anything newer. And besides, there's nothing more fun than showing off our 486 servers :-).

UPGRADING ISN'T ALWAYS THE RIGHT ANSWER.

Re:nt

[operagost]

You have incorrect information on Windows 2000 servers. For one, a new Windows 2000 server starts out in mixed mode, which allows downlevel clients to authenticate, as well as NT 4 BDCs. You may even use Windows 98 and NT clients on a native mode installation with the directory services client installed. Second, there is no such thing as a PDC anymore, as all Windows 2000 servers are either member servers or simply domain controllers. However, some operations do not work as well on multiple servers, so there are Flexible Single Master Operations, aka Roles. These roles are assigned to individual DCs, or just one DC. One of these roles is a PDC emulator, which is the mechanism by which downlevel clients may authenticate. I also think that having windows 3.11 "servers" is more of a expense or political issue than anything. I really doubt that you have any useful network applications that won't run on Windows NT, or could simply be replaced. Windows 3.x wasn't designed as a server solution, and I imagine you're rebooting those weak PCs continually.

Re:nt

[Billly Gates]

Why are our jobs being shipped off to India and why is corporate America is laying off people left and right?

Oh ya, its called money and stock price.

Upgrading is expensive and IT budgets have been cut by %60 in most fortune 500 companies. CIO's are just trying to keep peoples jobs and are penny pinching any way possible to do this.

What benefit does upgrading to w2k bring? Active directory is cool but requires significant upgrades to your lan. What else does it provide? Besides increased uptime for some apps absolutely nothing! If nds or no directoy services are used at all and its working then don't fix it.

Windows2k is expensive for desktops and old servers are fine without it.

Want to know what will happen if CIO's are forced to upgrade? Well update your resume and apply at Wallmart because the pay is coming from all of our paychecks.

Until the economy and budgets improves bussinesses have to conserve. If something does not bring more money to the corp then it should not be done.

Upgrading corporate systems is different then our own personal systems. They care about ROI and not what looks cool. Before the late 1990's most corporations used ancient 286 and 386 based systems with word perfect even though pentiums and 486's running Windows were around. The old systems worked. Windows95 and the .com hype reversed this but what ever goes around comes around. This is the return to the late 1980's where computers are viewed as just simple commidities and costs.

Re:nt

[simp]

If you are still running NT4, you probably are too busy (or lazy) to update security patches anyway.
NT4 needs to DIE. If you prefer the Windows platform, you've had ample time to move to 2K, or else another platform.

Actually some systems still run NT4 because they have a job to do. These might be important jobs and upgrading is a pain in the ass because of all the customized software on the machine.
MS marketing promised a solid OS, that's why the end-user choose NT4 to do the jobs. It is easy to laugh now in hindsight, but some customers will remind MS of its promises and draw conclusions from the answers that MS gives.

There are still alot of NT4 machines out there. And they are in places where you'll never expect them.

Please advise me:

[rainer_d]

What other operating systems from back then are still "supported" now ?
Solaris 2.6 maybe ? (Rapidly approaching EOL/EOS)
What else ?
Point is: NT4 is so old (and so BS), I can see why they want it to die (apart from the reason that they want to sell the new OSs)

Re:Please advise me:

[bedouin]

Redhat 6.2 isn't nearly as old, but it seems that Redhat has been supporting any release that's been up2date capable, across a few different architectures. I'm guessing a company's motivation to support an OS might change when they make their money from providing support, not selling software. Sun, though they sell software, seems to be a company that's been a little more focused on providing support.

Think about this too: Solaris 9 will still run on my 70mhz Sparcstation, a machine released around the same time as NT 4. Redhat 8.0 will still run on any old Pentium from seven years ago; same deal with the BSDs. Windows, on the other hand, can't be upgraded to the latest version usually without buying entirely new hardware, since every release has some new bloated GUI (that, you ironically can't disable).

When a software company is in bed with hardware companies (like Intel) the incentives to pump out bloated code increases, to warrant new hardware sells.

Re:Please advise me:

[bedouin]

Your point is? I can run a recent version of Linux or BSD on a 386 or 486, strip it down, and have it perform relatively decently. My Macintosh Quadra 700 is a 25mhz CPU running OpenBSD, and handling a lot of little network tasks quite nicely. Solaris can be stripped down in similar ways (in fact, I don't even use the GUI on that Sparc).

When's the last time you booted your NT box without a GUI, or could recompile the kernel for performance boosts, or tweak nearly every aspect of it to make it run decently on old hardware? You haven't, so shut up and remain an anonymous coward.

Re:Please advise me:

[Billly Gates]

Because corporate customers have specific contracts with Microsoft to suppport their products.

Microsoft should either a.) fix it or b.) Should of canceled continuing support until June on its contract.

Re:Please advise me:

[timeOday]

We first ran Windows NT 4.0 on 100 and 133MHz Pentiums in 1996 -- you can still run Windows XP on these machines (yes, I've installed it) and it runs about as well as Solaris 9 runs on a 70Mhz SS. Stop talking out of your ass.

I don't know about Solaris, but this is my experience. I have recently run Linux on a 486 laptop (with X and fvwm2) and the newer kernels work BETTER on this hardware than the older kernels. Response time is quicker. That makes a big difference on a slow cpu. This machine has 24 megs of RAM.

I just junked a 64 meg 233 Mhz laptop with Windows 2000 because it was too unbearably painful to use. Every time I clicked an icon it would sit there and spin the disk. Opening a simple folder took many seconds. It was awful.

Sure, I could bog down the linux box just as much by installing KDE or Gnome (if it had the disk space, that is), but the point is *I don't have to.* And since I like a clean desktop anyways, and can get old hardware for free, for me it's a great benefit.

Re:Please advise me:

[Alex]

Solaris 2.6 is EoSL June 2003, this means that no NEW bugs will be fixed from this date under standard support contracts.

Alex

Re:Please advise me:

[WindBourne]

MVS, HP-3000, HpUX, AIX, etc, etc, etc....

The actual building of an OS is a money loser for all companies except MS. All other companies make their profits on services for old OSs. You pay for it, but companies currently pay (and have paid for) for NT-4 services.
The only real reason for stopping this is to get ppl to upgrade and hope that they will go to the new MS licensing (where MS figuratively rapes you) rather than to Linux. In some ways, they may be right. Linux will be in much better shape for server and desktop in 1 year from now.

Re:Please advise me:

[Oliver Defacszio]

Hey fanboy,

When's the last time you booted your NT box without a GUI, or could recompile the kernel for performance boosts, or tweak nearly every aspect of it to make it run decently on old hardware?

Don't need to. WinNT ran better on my P100/64MB than Mandrake 7.something did on my C433/128MB. NT was actually usable while Mandrake/KDE just sat there and swapped to disk all day. Now, Win2K runs on the 433 and does so better than any alternatives.

But please, enjoy compiling that kernel while the rest of us do things with computers.

Re:Please advise me:

[SN74S181]

You won't find good support for older video cards in the latest versions of Linux. Don't try running X out-of-the-box on an S3 card that's older than a Virge. XFree86 has 'dropped support' for the older cards. I challange your notion that you can run Red Hat 8.0 in any meaningful task on an old 486 box. Maybe if you throw out a lot of the latest bloated crap, but you're gonna be stuck with non-accelerated X on the Tab Window Manager.

Re:Please advise me:

[bedouin]

You won't find good support for older video cards in the latest versions of Linux. Don't try running X out-of-the-box on an S3 card that's older than a Virge.

I wouldn't expect to run X on any of these older machines. In fact, the whole point of my posts have been that the major downfall of using Windows as a server is that you CAN'T get rid of the GUI or all of the bloat; even OS X can be booted without a GUI and run in console mode.

However, let's say I have a very old version of X, as well as a simplistic Window manager that works really well on my p100 -- in that situation, a security flaw in the OS doesn't mean I need to update to KDE 3 or Gnome 2.0 to keep safely using my computer; I can just patch up Samba, SSH, or Apache. Essentially, Microsoft is saying I need to drop NT4 and upgrade to a bloated XP GUI, just to get support for a security flaw that's in the OS level, and could be patched in any UNIX flavor.

Yet, with Microsoft ceasing to support NT 4 (that might run really great on my older machine), the only way I can update this box is to update to Windows 2000 (which will also cease to be supported at some point) or XP, and probably buying more hardware to get similar performance. If there's a mail server on my network that's been running wonderfully for 10 years on its hardware, why should a patchable flaw force me to upgrade it to a newer OS, or even buy new hardware? That's essentially what Microsoft is doing here.

As for my feeling about usability on the desktop, which seems to be where at least one of you were going with this, I've dropped Linux and Windows a long time ago and adopted OS X.

Re:Please advise me:

[SN74S181]

So you're going to claim it's easy to productively administrate a Red Hat box without using the GUI?

Mercy me.

Re:Please advise me:

[SN74S181]

So you're going to complain that Microsoft doesn't produce a feasible Operating System to run on a machine from the era of NT 4.0 and you're going to at the same time advocate OS X, which won't run on many of the Apple machines that were current three or four years after NT 4.0???

Look again. You had to upgrade your hardware to run OS X. Dirty rotten Apple didn't even attempt to provide an upgrade path for your NuBus PPC boxes. You're stuck buying new hardware, or running pathetic 'cooperative multitasking' MacOS 9 or earlier.

Re:Please advise me:

[bedouin]

No, I'm advocating not choosing a server OS that can't be patched because of a closed nature after only 5 or so years of use.

Though, since you bring up OS X, since all of the services are based on open source pieces of software anyway (like Apache, OpenSSH, SMB) if it ever is marked as unsupported by Apple, I can compile and install patched versions myself. Oh, and it will continue to run on whatever hardware I had it on after patching just as before.

Re:Please advise me:

[SN74S181]

You didn't list a single service that can't be run on NT 4.0 as well. I've never heard of anybody running Samba on NT, though. :)

I have several licenses for the (formerly third-party) Interix POSIX subsystem, and if I choose to, my version will install on an NT 4.0 system. Then I can just plain uninstall or disable all of the Microsoft services and port in Apache, OpenSSH, (probably) Samba. A roll it yourself method isn't impossible under Microsoft's OS, it's just not the easiest method, and most people haven't even heard of Interix (which Microsoft now owns and has crippled somewhat- so it's not something for the future).

I remember the stink that Microsoft made when O'Reilly started selling their Web Server Box set (I think it was called 'WebSite' or something) which bypassed Microsoft's built in limits. MS was of course horrified because someone had plugged in third party services that turned their 'Workstation' product into a server, without the 'per-connection' licensing that they like to maintain on their server products.

Re:Please advise me:

[rainer_d]

Your point is ?

My point is that the whole debate is about an OS from 1996 or so. If I compare, I must compare it with something that was available then and is still available now - and supported.

FYI: I run BSD & Linux @ home on low-end hardware and no Windoze. But I don't run a BSD from 1996. Do you ?

cheers,
Rainer

Re:Please advise me:

[gimpboy]

sure.

i admin about 15 computers (redhat 7.2, 7.3, and 8.0) without running graphical applications. this is easily accomplished with a few perl scripts and an understanding of the files in /etc. to update all of our workstations i simplyt type:

update.pl -t workstations -v

and then i wait while my scripts update the eratta on the workstations. it took me a day or so to write the scripts which is easily scalable to a hundred or so machines. the benifit of not needing a gui is being able to update things when you're out of town over a 14.4 modem.

Re:Please advise me:

[bedouin]

FYI: I run BSD & Linux @ home on low-end hardware and no Windoze. But I don't run a BSD from 1996. Do you ?

Well, no -- but I think that's primarily because I didn't bother getting interested in open source alternatives until around '98 or so, otherwise I probably would have some older installs around. One mission critical box on my network is running a version of Redhat Linux that's been upgraded from 6.2 to 7.1, and heavily patched anytime a security vulnerability was announced. The installs of Apache 2.0 and OpenSSH were built from source -- not to be super l33t or anything, but because you can oftentimes rebuild a program faster than a vendor can release a patch. So this box running 7.1 is sufficient for everything I need, and it handles a lot of important tasks, tasks that shouldn't require a 2 hour downtime to upgrade the whole OS.

But the main point is, since UNIX is much more modular, if I am happy running an older OS, for the most part I can keep that box going without any serious downtimes. Theoretically I could be running a UNIX OS from 1995 and keep it patched and secure, just as long as I can compile new versions of services on it. On the other hand, with a M$ OS, I'm either A) not running a new enough OS to be supported, requiring me to buy another Windows license, and most likely new hardware as well, or B) If I am supported by M$, waiting for them to release a patch for vulnerability announced the day before, that with a UNIX OS I could've fixed up with a simple build from source . .

Anyway, dinner time :)

Re:Please advise me:

[rainer_d]

I could be running a UNIX OS from 1995 and keep it patched and secure, just as long as I can compile new versions of services on it.

In business-critical systems, it's important not to introduce any new code to a stable system.
When you get a patch from SUN for Solaris 2.7, it patches the bug, but keeps the external interface of the program or library identical.
Thus, old programs that rely on it don't break, mustn't break.
If I'd want to run a FreeBSD from 1996, I'd have to backport some/most of the patches to 2.2.x ...

After all, you could upgrade NT4 to 2000, with your point of view.

Rainer

Easy solution for Microsoft...

[ktorn]

... open source it.

Well you also have to consider Life-Cycles

[LynchMan]

I was (unfortunatly) doing some research yesterday on the support lifecycle of some OS's, and NT4 was one of the ones that I investigated. This page at MS shows that they will stop supporting NT4 this Summer.

So maybe they just figure why bother when the end is near for NT4 anyway. Not that that is a good excuse, but it makes sense in the big business world.

And no, I am not sticking up for M$.

Re:Well you also have to consider Life-Cycles

[Artifex]

This page at MS shows that they will stop supporting NT4 this Summer.

The page you were reading only mentions that NT 4.0 Workstation will go non-supported this summer (and EOL next year).

Check here for NT 4.0 Server, support for which ends later.

Just an effort to expand..

[PyrotekNX]

MicroSoft uses every dirty trick in the book to escalate their sales. This new exploit now gives NT4 shops an urgent need to upgrade.

Because of the closed source, there is no way to patch a MicroSoft product without MicroSoft. If someone figures out a way to fix it; MS will undoubtably sue the shirt off their backs.

This seems to be an underlying plan for the MS scheme to make money. Two - three years from now they will be pulling the same thing with windows 2000 just to keep a purpetual upgrade going on even though the older systems work perfectly fine.

There are still systems that are 20+ years old that still work and do their purpose, yet the lifespan for anything running MS is only 3-5 years.

Imagine if the stock market was running windows NT!

Re:Just an effort to expand..

[spectral]

they are. Ok, a newer version. But we'll ignore that.

Whats a Bxploit?

[rf0]

"Microsoft Refuses To Fix NT 4.0 Bxploit". I think you mean exploit :)

Rus

Re:Whats a Bxploit?

[Pxtl]

I'm confused at that - those keys aren't even next to each other - how could that typo have existed? Maybe a Dvorak?

Or is it a bizarre acronym? Back-Exploit, 'cause its an old software version?

Re:Whats a Bxploit?

[SuDZ]

I was thinking the same deal. Like how far off can they beat that point?

SuDZ

Re:Whats a Bxploit?

[SillySlashdotName]

Not Dvorak.

Dvorak 'B' = Qwerty 'N'
Qwerty 'B' = Dvorak 'X'

I am puzzled, too!

Re:Whats a Bxploit?

[BigAl_nz]

I'm confused at that - those keys aren't even next to each other - how could that typo have existed? Maybe a Dvorak?

Nope. Dvorak's "B" is qwerty's "N", and dvorak's "E" is qwerty's "D".

What's up with the topic and image?

[GusherJizmac]

Why are we not seeing the Bill Gates Borg? Do we need another topic just for windows? If so, it should be a window through which we see the Gates-Borg.

Re:What's up with the topic and image?

[Anonymous Freak]

The previous story (about blue laser DVD) also has a new icon and topic. I dunno, maybe they're on a 'new topic' kick today.

What I like is that the 'Data Storage' topic of the previous story is topic 198, and 'Windows' is topic 201... As the first stories in each of those two topics are one right after the other, you have to wonder...

Topic 199 is 'Lord of the Rings', with the one ring as it's icon, and Topic 200 is 'The Matrix', with a blue pill and a red pill. Neither one has any stories. 'Be' is the lowest-numbered topic, at number 87. (No, the topics are not in alphabetical order.)

So if it had been found earlier....

[MeanE]

say in 97/98/whatever they would of just looked at it and said "well darn...an NT4 bug that just can not be fixed"?

What's sad is that there is a 2k/XP fix...and I bet an NT fix would not be that hard considering they are quite similar OS's.

Re:So if it had been found earlier....

[essdodson]

Given that a large number of customers are still using NT4, and given that this is their product. I'd say MS has looked at the problem that it would indeed be "that hard" to fix.

"Can't" isn't the same as "won't"

[Artifex]

They're not saying (publicly, anyway), "hah, we're not supporting this ancient operating system any more, go away."

The article quotes them saying they can't fix it, there's too much stuff to do.

Using your firewall to block port 135 is fine, unless you actually need RPC for something useful. In that case, I'd say that a firewall that discards all malformed packets (more complicated) is in order. Or an upgrade to Win2K. After all, it's been out for, what, 4 years now?

Re:"Can't" isn't the same as "won't"

[i_need_no_nick]

OK, i haven't read the linked article and I don't really understand all of what's talked about on /., but the actual /. posting said the vuln. was also to be found in the 2k and XP versions of windows.

Re:"Can't" isn't the same as "won't"

[Artifex]

OK, i haven't read the linked article and I don't really understand all of what's talked about on /., but the actual /. posting said the vuln. was also to be found in the 2k and XP versions of windows.

Bad sysadmin! Making unsupported assumptions without checking! :)

Yes, the vulnerability affects those OSes, but they have patches for that. Now, one thing that hasn't been said yet is whether Linux and BSD are protected from the malformed-packet issue by default, either. A better sysadmin than I would check his operating system for the same vulnerability that is reported in others' OSes. I'm going to settle for asking on /. and waiting for more press releases, because I keep my firewall strict.

Re:"Can't" isn't the same as "won't"

[questionlp]

The only problem is that a firewall will only help to block exploits from the outside, but in an academic or in a corporate environment, you are also at risk from being attacked from within the internal network. Think if there was a worm available on the Internet that sits idle on an infected machine and sporadically attacks servers within the same subnet as the machine is configured for... say that an employee's laptop got infected while connected (without protection) to the Internet from home, brought it in, connected it to the corporate network and the worm starts to do it's evil job. Unpatched servers would then be at a high risk if they are not protected in same way...

One option is to extend what you said and place the server between two sets of firewalls, or at least on the internal side, use port blockers or packet filters if a full-blown firewall is overkill.

Even that could cause problems because port 135 is quite critical for Windows servers providing file/WINS services.

Re:"Can't" isn't the same as "won't"

[Elwood P Dowd]

Using your firewall to block port 135 is fine, unless you actually need RPC for something useful. In that case, I'd say that a firewall that discards all malformed packets (more complicated) is in order.

If you're doing something useful with RPC, and you are not doing it behind a firewall (that discards all RPC packets), then you are dumb like bricks. RPC isn't something you want to be doing via the internet, afaik.

All their enterprise customers might be annoyed, but this should never affect them. If some bank has NT4 machines outside of a firewall or even many NT4 servers and clients with no firewall between them, their IT department needs to be lined up and shot.

Re:"Can't" isn't the same as "won't"

[Badmovies]

You mean to say that it is totally impossible for Microsoft to fix this problem? Actually, I think your position is the following: "Microsoft says that it is too difficult for them to fix and I believe them, because they are an upstanding company that only tells the truth."

Wow. Just plain wow.

Re:"Can't" isn't the same as "won't"

[tomRakewell]

Or an upgrade to Win2K. After all, it's been out for, what, 4 years now?

So if NT4 is being EOLed 7 years from its release, that means that your new Win2K license is probably only going to last you a measly 3 years! Not everybody purchases Microsoft operating systems at the beginning of their life cycle, and for them, the per-annum cost of a license is pretty high indeed.

Re:"Can't" isn't the same as "won't"

[Artifex]

Not everybody purchases Microsoft operating systems at the beginning of their life cycle, and for them, the per-annum cost of a license is pretty high indeed.

If that's the case, then they won't be buying the next operating system that comes out, for a while anyway, will they? So you point is moot.

Re:"Can't" isn't the same as "won't"

[tomRakewell]

Well, my business runs off a legacy point of sale application that has never been tested under Win2K. That's why I've never upgraded.

I am quite happy with the 6 or 7 years that NT has provided.

But moving to Windows2K is likely to only give me another 3 or 4 years of use. Then again, our old MS DOS application might not even run under Win2k, and the upgrade investment will be completely useless.

That's why my company is designing a new system based on Java, Python and CORBA that will run on any platform.

To be honest with you, we will probably not choose to deploy anything on Win2k or XP.

I suppose Microsoft doesn't care. They aren't getting any money from NT users anyway. They might as well all switch to Linux, which is what we'll end up doing.

You'd kind of think that Microsoft would prefer to at least keep us NT users happy and out of the Linux camp by supplying the critical security patches. But I suppose my company is not typical, in that we do see Linux as a viable desktop alternative to Windows, and we will make the switch wherever possible.

Re:"Can't" isn't the same as "won't"

[Weirsbaski]

They're not saying (publicly, anyway), "hah, we're not supporting this ancient operating system any more, go away."

The article quotes them saying they can't fix it, there's too much stuff to do.

Well, according to Dogbert's Big Book Of Business, "It is technically impossible" actually means "I don't feel like doing it".

Good book.

Bxploit??

[CrazyJ020]

not sure what a Bxploit is, but it sounds a lot like an exploit.

The security flaw mentioned is a Denial of Service vulnerability. This flaw does NOT allow exploit of the system.

Re:Bxploit??

[Nick of NSTime]

Bxploit is a movement in 1970s filmmaking featuring the acting talents of Afro-Americans, giving us such characters as Foxy Brown, Dolemite, and Shaft.

Honesty Filter

[waldoj]

After running this through the honesty filter, we come out with:

"Windows is fundamentally insecure. Suck it up."

Gotta love the honesty.

-Waldo Jaquith

Re:Honesty Filter

[lsoth]

Nice... Another MS basher. I am really sure that was what they *really* meant to say. When you don't know much about business it is easier to just slag it huh?

NT 4.0 is over 7 years old... Let's try putting there statement through a more realistic filter shall we?

"Windows NT 4.0 is an outdated product and the resources and effort require to correct this problem are better used on newer initatives the company is working on."

Wouldn't you rather they secure and tighten Windows 2000/2003 server? I know I do since that is what 99%+ of most new medium to Enterprise MS servers are going to be running. I think it is smart decision to start turning away from NT 4. Change in our industry is very drastic and requires that we upgrade everything eventually. Welcome to working in IT.

Re:Honesty Filter

[Ooblek]

You are correct. If someone found a security flaw in an old version of the Linux kernel, would it be fixed? No, the machine would have to be upgraded to get the fix in the later release. It just so happens to be a lot cheaper to upgrade a Linux machine, so there probably aren't that many machines running 7+ year old kernels.

Re:Honesty Filter

[vandan]

This argument might fly for a company that didn't have unlimited resources as Microsoft does. But for a monopoly hell-bent on proving their worth through their 'trustworthy computing' marketing campaign, simply turning their backs on the problem is not good enough. It is true that Microsoft may believe that their resources are better spent on tightening their current products, but that is no consolation for people with older products that expect some kind of service guarantee. I am sure that Microsoft would believe that their resources are actually better spent in the bank than working on their current software, which is probably why we have the problem to begin with.
However for all my condemnation of them I think this is actually a good thing as it will remind people of the alternatives such as Linux and break up MS's stanglehold on their market.

Re:Honesty Filter

[lsoth]

It is unrealistic for anybody or any company to support things forever. There has to be a line in the sand SOMEWHERE. Microsoft picks here. I think 7 years is quite reasonable in this industry. So when you help someone *fix* their computer, would you still come back to them 3 or 4 years later when they have another problem and fix it for free? Didn't think so...

Re:Honesty Filter

[statusbar]

The problem is that Microsoft had already committed to supplying security patches until next year. They are violating that, and it seems like they are violating their own contracts just so they could push more people to buy and use XP Server.

There are MANY companies that have MANY NT installations with no intent to upgrade them until compatible hardware is no longer available. Why spend money if you don't need to? That would be plain bad business sense.

--jeff++

Re:Honesty Filter

[lux55]

I do believe the Linux 2.2 kernel is still being maintained, although I'm not sure about 2.0.

Bxploit ?

[Nix0n]

Is that like some sort of exploit of the x86 processor's BX register?

If so, pretty creative name, I must say.

Re:Bxploit ?

[RobotRunAmok]

Cut the Cowboy some slack. He ain't used to the dayshift.

... ways

[Rock]

Ve haf ways of making you upgrade, ya!?!

Coming Soon! New Microsoft tagline

[JoeShmoe]

"Windows XP Professional is built upon the rock-solid reliability of Windows NT technology, the architechture that is so fundamentally limited that it does not support the changes required to remove significant vulnerabilities."

Doesn't have quite the same ring to it.

- JoeShmoe
.

Bxploit?

[SpaceLifeForm]

Is this shorthand for Bad exploit?

Re:Bxploit?

[Photon Ghoul]

i bowned joo with my bxploit?

oh wait, that sounds bad.

#1 argument for MS or against non-MS software

[Anonymous Coward]

is support. Of course I mean #1 by popularity, not merit. In fact just the other day I listened to someone talk about "how everyone says MS is so bad about support but look at Linux, you can't ever get any answers." He was referring to what it was like about 5-7 years ago and yes it was very difficult to get quick and easy answers. The concept of the FAQ as in "I'm tired of being so _F_requently _A_sked the same _Q_uestion over and over by those who don't RTFM." Yet when I reminded him about how even he himself has spent months trying to figure something out that should have been conveniently documented on the MS site he really couldn't argue. Then predictably he went in on the attack of, "You need long term support for a company, and depending on a flaky small startup or just random community sites that pop and and go back down overnight is not going to cut it."

Just as there are over 20 million users of Windows 95, there are numerous (I don't know the estimate) users of Windows NT 4... nuff said.

I think events such as this will be another nail in the coffin of MS simply because if they are so unsure of the current capability of NT and its problems due to a complete lack of engineering and proper design then I am betting that many will rightly ask, "has MS really improved with 2000 and the impending 2003 .NET server?"

Then again, I feel no pity for the fools that chose pretty buzz words and software boxes over stable, secure and extensible solutions. That is the price of business. If you choose to pay more for less then don't come crying to the government or anyone else when your infrastructure begins to collapse from its own bloat.

NT at threat to Microsoft?

[narrowhouse]

The other day I read an article that said NT might be a bigger threat to Microsoft sales than Linux, now suddenlt there is this unfixable bug. Hmmmmmmmm.

Re:NT at threat to Microsoft?

[DuSTman31]

Windows NT4 isn't nearly as big a threat to microsoft going on as win2k could be (properly supported by a third party) in future.

Prior to win2K every version of windows had a major failing.. Win 9x wasn't stable, so that could make people upgrade. WinNT4s driver model was more limited and didn't support adding or removing devices while powered on (iirc).

Windows 2000, on the other hand, has neither of these major failings (granted, linux still has a better reputation in technical regards around these parts). It is stable enough, and it's got a driver model which, as I see it, could certainly be extended to cover future types of hardware.

If the open source movement really wanted to declare war on ms they could start working on projects to extend win2ks longevity, and effectively nullify this "forced upgrade" strategy.

ding dong the bitch is dead,

[Erris]

the cheap old bitch is dead.

M$ Exec's - "Wats this respongeability you say?"

The kind of product support you would expect from a comercial Unix killer rather than the kind of "support" you got from windoze 3.1. Oh my, the difference was only a matter of time. Pthththfit! That's some kind of incentive to "upgrade" to w2k, I mean XP.

Give them a break. Really.

[burgburgburg]

If you had to deal with half as many security flaws/exploits/holes as Microsoft, you'd be tired too.

Plus, why are people so irksome in not upgrading to ever newer and more expensive operating systems like they're supposed to? Constantly forcing Microsoft to keep looking back over legacy code. It's ugly, dirty and scary back there, not like in candy XP land.

Re:Give them a break. Really.

[zbuffered]

If your OS wasn't closed-source, the people who discover it's flaws might just go ahead and fix them, saving you time AND, uhm... money. You can spend the time napping, lazy MS!

Re:Give them a break. Really.

[Cedric C. Girouard]

If you had to deal with half as many security flaws/exploits/holes as Microsoft, you'd be tired too. Plus, why are people so irksome in not upgrading to ever newer and more expensive operating systems like they're supposed to?

What about vendor lock-in ? Say, I buy this piece of VERY specialized software that will NOT operate on ANYTHING but NT 4, or that has not been ported to 2K or XP, because it simply was not worth it. Say it's an HR system. Say that porting it to 2K, XP, Linux, *BSD, Sun or whatever would cost a bundle ?

The very point here is that MS commited to supporting and fixing the thing until at the very least this summer, and now they're trying to backpedal on their commitments. From these parts, it's called "Breach of Contract" . And I just hope that some other 800lbs gorilla will smack'em left right and center with lawsuits, so they can make a dent in that 40B$ warchest... Say, US Gov, which has surely got legacy systems running NT4. Say IBM, Say Peoplesoft, or Oracle... What about Banks ? They have bulletproof contracts. They have more lawyers then BillG. They're used to kickin' asses whenever wind doesnt blow the way they contracted it for.

This _might_ just be the start of a _very_ bleak summer for Bill...

Re:Give them a break. Really.

[humlepung]

Plus, why are people so irksome in not upgrading to ever newer and more expensive operating systems like they're supposed to? Constantly forcing Microsoft to keep looking back over legacy code. It's ugly, dirty and scary back there, not like in candy XP land.

1. Legacy applications. In a 200,000+ user environment like ours, being irksome is a slightly safer route than upgrading needlessly.

2. Sticking with version -1 has traditionally been a good practice as far as MS server OSes are concerned. Let the upgrade-horny idiots work themselves through the worst initial bugs, and _then_ upgrade when the product (at least to some extent) has matured.

3. Microsoft have commited themselves to supporting the system. No one is forcing Microsoft to do anything.

Done supporting it? Release the code!

[Angry White Guy]

See above.

An explanation

[Henry V .009]

If you click on the 'topics' link on the left, you'll see that slashdot has one icon for Microsoft (the borg) and another for Windows (this shitty one.) If you click on the Windows icon, you'll find that this is the only story ever posted with it. So we can probably rule out Bill using his mind control ray to control Taco's mind, and chalk it up to the usual slashdot incompetance.

Re:An explanation

[Vengie]

If you click on the 'topics' link on the left, you'll see that slashdot has one icon for Microsoft (the borg) and another for Windows (this shitty one.) If you click on the Windows icon, you'll find that this is the only story ever posted with it. So we can probably rule out Bill using his mind control ray to control Taco's mind, and chalk it up to the usual slashdot incompetance.

If you click in your little address bar and type "www.m-w.com" and then in the box next to "dictionary" you type "incompetance" and then click "Look it up", you'll note that "incompetance" doesnt exist as a word.

So we can probably rule out Bill using his mind control ray to control your mind, and chalk it up to the usual slashdot unjustified self-righteousness. /sarcasm

Re:An explanation

[Henry V .009]

Pointing out a spelling error on slashdot--useless.
Using the '/sarcasm' cliché in a dismal attempt at geek humor--even more useless.
Implying that bad spelling is a form of self-righteousness--kind of weird.

But pointing out to the world that you are a troll so they can add you to their enemies list--now that's priceless.

It's All Part of the Marketing Strategy

[Weasel_nmrc]

Microsoft has learned that features alone haven't been enough to persuade its users to move to newer OS versions, so they are giving the vulnerability angle a try:

"Hey, buy our newest product, we still fix those vulnerabilities. You do still care about the security of your data, don't you?"

I can't see why MS would choose to not support a product that many customers are willing to continue to pay for support for. The support charges should be gaged to cover support costs.

Re:It's All Part of the Marketing Strategy

[gandy909]

Speaking of those thousands/millions of people who are still spending millions/billions for support for this OS that has *not* reached the published EOL as of yet, is there any wiggle room for a successful class action lawsuit over this? Successful in this case means either they get a ruling in their favor and MS pays out, or MS decides it is cheaper to fix the bug...

point being?

[siphoncolder]

Even if they're being political about not being able to do this for technological reasons, this still makes sense (even though it DOES suck for businesses STILL using NT4). MS sells product, not service - you don't support a product beyond its profitability or your willingness to do so. That's not mean, dirty, nasty - that's business.

That said, I wonder if it would make sense for them to SELL a patch for older software like that. Just a small fee that effectively says "Oh, ALL RIGHT, if you insist, here. Pay up, you're wasting our time." Maybe something they should try?

Here's our chance!

[lhand]

OK guys, now's your chance to set up a Linux firewall to protect those poor, insecure little NT boxen. Get to work. It's what I'm going to do.

I say it again...

[dacarr]

If Bill of Borg would only release the source to his stuff, these bugs would be fixed real quick like.

Redhat does not fix its older lines.

[chameleonanonymous]

Why not microsoft ?

Re:Redhat does not fix its older lines.

[cbreaker]

Because RedHat doesn't MAKE the software that you're using. They distribute it.

You can freely upgrade any part of your system that's insecure yourself. With Windows NT, you can't do that.

Although RedHat, Mandrake, SuSE, etc.. would like you to believe that you have to upgrade to their latest version for the newest software, it's not true.

I have a Redhat "version 5" machine that runs gcc3, KDE3, and Samba 2.2.5 just fine. It wasn't hard, I just kept it up to date.

Re:Redhat does not fix its older lines.

[Bombcar]

You should probably run Samba 2.2.8 before you get 0wn3d like NT.

Re:Redhat does not fix its older lines.

[cbreaker]

Maybe, but I guess it's not a big deal considering I'm firewalled/natted and the only one that touches these machines from the inside.

Microsoft Refuses To Fix Bxploit

[Anonymous Coward]

Those Eastards!

Re:New Icon !

[essdodson]

Oh what a glorious day that will be. Though, I'll have to find some other pasttime than smashing linux newbie zealots.

This is usual for Microsoft

[CormacJ]

They use things like this to force customers to upgrade.

They did something similar with Windows 95 to force EDS (a huge customer) to upgrade.

Microsoft wants people to stop using NT 4, so by refusing to apply security fixes they can tell customers "you need to upgrade to fix this" and thus keep revenue coming in.

Bring out your dead...

[A_Non_Moose]

NT4: I'm not dead yet.

Microsoft: Yes you are, you just don't know it.

NT4: Really, I'm very much alive.

Microsoft: No, you're very sick and could give over any minute now. ..and on and on.

(I'm so ashamed I can't recall that conversation verbatum...
Getting old, I suppose.)

Re:Bring out your dead...

[Alsee]

Getting old, I suppose.

Yeah, but are you dead yet? Maybe you are, you just don't know it.

-

Re:Bring out your dead...

[A_Non_Moose]

Yeah, but are you dead yet? Maybe you are, you just don't know it.

No, I'm very much ali.. d'oh.

{chuckle}

Re:Bring out your dead...

[Phlarmf]

customer: Here's one.
cart master: Ninepence.
dead person: I'm not dead!
cart master: What?
customer: Nothing. Here's your ninepence.
dead person: I'm not dead!
cart master: Look 'ere, he says he's not dead!
customer: Yes he is.
dead person: I'm not!
cart master: He isn't?
customer: Well, he will be soon. He's very ill.
dead person: I'm getting better!
customer: No, you're not. You'll be stone dead in a moment.
cart master: Oh, I can't take him like that. It's against regulations.
dead person: I don't want to go on the cart!
customer: Oh, don't be such a baby.
cart master: I can't take him.
dead person: I feel fine!
customer: C'mon, do us a favour.
cart master: I can't.
customer: Well, can you hang around a couple of minutes? He won't be long.
cart master: No, I've got to go to the Robinsons'. They've lost nine today.
customer: Well, when's your next round?
cart master: Thursday.
dead person: I think I'll go for a walk.
customer: You're not fooling anyone, you know. Look, isn't there something you can do?
dead person: [singing] I feel happy. I feel happ...
**whomp!**
customer: Ah, thanks very much.
cart master: Not at all. See you on Thursday.
customer: Right. All right.
**clop clop clop**
customer: Who's that, then?
cart master: I dunno. Must be a king.
customer: Why?
cart master: He hasn't got shit all over him.

Re:Bring out your dead...

[DoubleD]

Full(modified) version. Original courtesy of www.imdb.com And no, I couldnt remember the full text either.

• /dev/null: Bring out yer dead!
• Microsoft: Here's one.
• /dev/null: That'll be ninepence.
• NT4: I'm not dead!
• /dev/null: What?
• Microsoft: Nothing. There's your ninepence.
• NT4: I'm not dead!
• /dev/null: 'Ere, he says he's not dead.
• Microsoft: Yes he is.
• NT4: I'm not!
• /dev/null: He isn't.
• Microsoft: Well, he will be soon, he's very ill.
• NT4: I'm getting better!
• Microsoft: No you're not, you'll be stone dead in a moment.
• /dev/null: Well, I can't take him like that. It's against regulations.
• NT4: I don't want to go on the cart!
• Microsoft: Oh, don't be such a baby.
• /dev/null: I can't take him.
• NT4: I feel fine!
• Microsoft: Oh, do me a favor.
• /dev/null: I can't!
• Microsoft: Well, can you hang around for a couple of minutes? He won't be long.
• /dev/null: I promised I'd be at SCO. They've lost nine today.
• Microsoft: Well, when's your next round?
• /dev/null: Thursday.
• NT4: I think I'll go for a walk!
• Microsoft: You're not fooling anyone, you know.
• Isn't there anything you could do?
• NT4: I feel happy! I feel happy!
• [/dev/null glances up and down the street furtively, then silences WindowsNT4 with his a whack of his club.]
• Microsoft: Ah, thank you very much.
• /dev/null: Not at all. See you on Thursday.
• Microsoft: Right.

Re:Bring out your dead...

[Art Tatum]

I'm so ashamed I can't recall that conversation verbatum

Not to worry--there are plenty of Slashdotters that can help you. And I'm sure they will. :-)

The official reason

[fateswarm]

The official reason of this decision according to windowsupdate is, NT 4 needed more parts to be recompiled than rest platforms, therefore - as I logically assume - more trouble for them, more trouble for people that download critical updates with slow connections and old hardware.

This is of course unacceptable in the unix world of stability.

In the Windows world of features, this sounds like a normal decision.

Not surprised.

Not until 06/30/03 it isn't!

[burgburgburg]

They are contractually obligated to support NT 4.0 until June 30, 2003. Not forever. Just until then. "It's old and boring and we don't understand it" isn't an acceptable excuse.

Re:Not until 06/30/03 it isn't!

[eht]

Can I see a copy of this contract?

They said they would support it, it doesn't mean they're required to.

Re:Not until 06/30/03 it isn't!

[Gudlyf]

Here ya go

And here

Re:Not until 06/30/03 it isn't!

[TeraCo]

Maybe you are confusing 'legally binding contract' with 'some stuff they wrote on a web page'.

Because, well.. the guy asked for the first.. and you gave him the second.

Why fix it...

[Fig, formerly A.C.]

...when you can claim it is unfixable and encourage an "upgrade"?

Good opportunity to test open/shared source...

[AEton]

at least in terms of PR.
Microsoft: "Um, we don't want to fix this. But here's the kernel source, so why don't you fix it for us?"
Beady-eyed kernel hacker: "OK!"
It's not such a silly idea with a practically end-of-life'd product; bugs and exploits would get found and fixed and since Microsoft doesn't seem to want to support certain OS changes, we'd do it for them. And it would be a great PR boost. "Microsoft supports freedom to innovate!". Hm.

Re:Good opportunity to test open/shared source...

[BaronAaron]

The problem is that the NT4 kernel isn't much different from the XP/2000/2003 kernels.

They basically be releasing the source code to their whole server platform...

Not going to happen.

Which also makes me think that this whole thing about NT4 being to old to fix is a load of crap. If they fix it in 2000/2003 they can fix it in NT4. They just don't WANT to ...

Re:Good opportunity to test open/shared source...

[DavidBrown]

A pleasant idea, but it would result in free Open Source NT Server 4.0. Microsoft won't make any more money on it, it will cost them sales of current products, and when the inevitable problems occur, people will still blame Microsoft, even if the open source community is at fault for failing to maintain the software and provide timely fixes. For this reason, making NT 4.0 open source is a lose-lose proposition for Microsoft. The only plus is that it would make the /. crowd happy, and since when would that do any good for Microsoft?

Re:Good opportunity to test open/shared source...

[nutznboltz]

Why bother when there's ReactOS?

Quick Fix?

[JonTurner]

>blocking port 135 on a firewall is a better option.

I can't help but wonder how many brainwashed MSCE's will "solve" the problem by setting up a firewall running Win2K.

"Rearchitecting"

[Kymermosst]

Microsoft's explanation of why they will not fix the bug, in the security report, uses so many 5-dollar words like "rearchitecting" that I prefer to think it is just a way for them to avoid the effort of making a patch.

Perhaps they don't employ any rearchitects that can do the rearchitecting needed to fix it.

BTW, how does one pronounce "Bxploit?"... I submitted the same story, but spelled correctly :)

Re:"Rearchitecting"

[CrayzyJ]

"...a way for them to avoid the effort of making a patch"

However, they already have a patch for 2K and XP. There is such a thing as a bad architecture - which is why they re-wrote the RPC stuff in 2K. I'm all for MS bashing but this bandwagon is losing a wheel :-)

NT4 is as old as Linux 2.0.0

[MagPulse]

NT4 came out in September 1996, just three months after Linux 2.0. The last 2.0 version is 2.0.39, which was released January 2001, over two years ago. Both groups have moved on, and aren't willing to spend much effort on the old versions. It's true there are more recent 2.0 pre-patches, but if you're willing to use one of those, simply adding a port to your firewall block list should be cake.

And yes, with Linux, you have the source, so you could fix this yourself, right? Microsoft says this requires a large architectural changes. I think any person or group willing to re-architect NT4 or the 2.0 kernel would better spend their time and effort upgrading to a newer OS version.

Re:NT4 is as old as Linux 2.0.0

[N3WBI3]

Yes But I dont have to pay to upgrade my Linux Kernel, where as at my shop where we still use alot of NT (I know, I know but those systems are not my call). Now given we are still using a system that is not EOL (until June I think) MS is going to tell me they are not going to try and update their system, and my only recourse is to 1) Use someone elses product (firewall) to protect my NT systems, or 2) Pay us more money so you can go to 2K or XP?

Now while a firewall is a must and 2K (not XP) is a good idea If the OS is not EOL you should do better than that..

Re:NT4 is as old as Linux 2.0.0

[gimpboy]

And yes, with Linux, you have the source, so you could fix this yourself, right? Microsoft says this requires a large architectural changes. I think any person or group willing to re-architect NT4 or the 2.0 kernel would better spend their time and effort upgrading to a newer OS version.

if i upgrade my linux kernel, it will probably run just fine on hardware from 1996. if i upgrade to windows 2000 or xp i would take a serious performance hit. this would require me to upgrade my hardware. this is a serious issue in my mind. microsoft touts their lower total cost of ownership and to estimate these costs customers include the use of the product for it's lifetime.

for nt40 server the "end of life" is sometime in 2004. this is fine, and companies plan around these dates. companies that find out that the product they were going to phase out in 2004 has a vulnerability now and microsoft has no intention of fixing the problem might not be too happy.

say you budgeted the upgrades for the first quarter of next year and find out you have to move that forward a couple quarters? this is not the type of thing to which business take kindly-especially in an unforgiving economy such as this. microsoft has an obligation to these companies, and i dont think it is unrealistic to hold them to this obligation.

Suprised why?

[banzai51]

I bet their not going to batch NT 3.51 either. So what? If you're still using NT 4.0, you knew LONG ago this would happen.

Re:Suprised why?

[banzai51]

And if you knew what you were talking about, you would have known that Microsoft was end of lifing NT4.0. We've all known this since 2001.

Trustworthy Computing

[muzzmac]

This is just another example of Microsoft displaying it's new philosophy of "Trustworthy Computing".

Ever since they announced their Trustworthy Computing initiative they have been going out of their way to build the publics trust in them...

Oh wait...

yeah, yeah, sure right

[Erris]

support for NT4 is dropped at 30 june 2003 and that's not really far away.

We are going to do something unacceptable by the end of June^H^H^H^H March. See there? We told you that we were going to do it, that makes it right. Be greatful, very greatful and send more money.

Another workaround for NT4

[jasonditz]

Instead of patching the problem, format the hard drive and use someone's OS who actually fixes security problems next time.

in other news...

[kasper37]

RedHat doesn't support RedHat 5.2 anymore...sigh...

lol

[Quasar1999]

Why not just tell them to upgrade to windows XP? Then they have solved the problem, and made microsoft money... I don't get it. Why tell them to use a firewall... how does microsoft make money that way???

MS is right... and wrong.

[Zerbey]

So, here it is from both angles, the way I see it.

Microsoft do have a point, NT 4.0 *is* 7 years old now (released 1996) and supporting it is probably a major headache for them, at least until June when it reaches end of life (bear in mind that end of life for most software is 5 years). How long can you keep patching software? I guarantee that if they did take the time to patch it many other things would break resulting in the need for more patching and more headaches.

On the other hand, they are still going to get a nasty backlash from the millions (billions?) of people still using NT 4.0. Yes, you can laugh at businesses who haven't moved to 2000 or XP yet but if you are a multinational company who depends on NT facing the huge costs of moving to 2000 it's a big deal.

Microsoft recommends we firewal port 135 - which every network administrator with a brain should already be doing! Unfortunately, good network administrators are in very short supply.

Re:MS is right... and wrong.

[n3rd]

On the other hand, they are still going to get a nasty backlash from the millions (billions?) of people still using NT 4.0

Yes, 17% or more of the world's population uses NT 4.0.

Microsoft recommends we firewal port 135 - which every network administrator with a brain should already be doing! Unfortunately, good network administrators are in very short supply.

Unfortunately people who also realize this is exploitable from any system inside the firewall are in very short supply as well.

Re:MS is right... and wrong.

[pmz]

NT 4.0 *is* 7 years old now (released 1996) and supporting it is probably a major headache for them, at least until June when it reaches end of life (bear in mind that end of life for most software is 5 years).

I'm always suprised in how much volatility we've come to tolerate in software. In other industries, the customers would be fleeing in hordes.

I take all this as just more evidence that the software industry won't reach maturity for at least several more decades.

Re:MS is right... and wrong.

[esarjeant]

Here here! I know this example is old, but imagine if another industry sold you a broken product -- consumers would be demanding their money back in droves.

A good example is a book. What if your new Stephen King novel "crashed" every so often and forced you to start reading it from the beginning again. This wouldn't be much fun, you would spend a lot of time reading materials you are already familiar with.

Then at some point the paper develops a problem that causes it to change colors and become unreadable in spots. This is an occasional defect, and by replacing individual pages you can save your book.

Eventually, the publisher realizes the book has too many issues to keep fixing -- so a new version is published. While you are offered an upgrade, you have made numerous notes in your copy. Therefore, a replacement would require a migration of this content.

Unacceptable. Software needs to be approached differently, when people really use your programs they don't want to always have to start over again. The next generation of software needs to reflect a continuous upgrade path... I think Gentoo is on the right track!

Re:MS is right... and wrong.

[tupps]

The replacement for windows NT4 *is* less than three years old! You have to give people time to replace these things. If they had a constant upgrade cycle (with an easy upgrade path) then it would be fine, but Windows 2000 was only relase 2 and a bit years ago, it does take time to migrate systems.

Re:MS is right... and wrong.

[RoLi]

(bear in mind that end of life for most software is 5 years)

In late 1999 and January 2000, NT4 was Microsoft's newest server OS.

I don't know about you, but for me 2000 + 5 is not 2003.

Re:MS is right... and wrong.

[myov]

Just about all of my windows-based customers are still using NT, on workstations and servers. In one case, a new 2000 server showed up last week, while another doesn't know when they will upgrade. Another one has a planned migration to 2000, but I don't see it happening very soon. At school, everything that doesn't run Solaris or Linux runs on NT - including the new machines added every year. So NT is still going to be around for a long time, whether or not microsoft likes it.

My question is what is so flawed in NT that was fixed in 2K/XP, but can't be ported back to NT? Or is "Built on NT Architecture" just another marketing term?

Re:MS is right... and wrong.

[Zerbey]

Response to comments and flames I've been getting!:

I know maybe not Billions - Tens of millions for sure though. I had had maybe 3 hours sleep the night before I posted this article so my brain wasn't quite up to speed.

Speaking of brains, yes I know it can be exploited internally and it's not so easy to firewall port 135 internally (it may break other things). This is why we have logs, and LARTs.

I stand by my statement that the average life cycle of MOST software is about 5 years from date of first release. Sorry, but that's my opinion.

Thanks MS, steal DCE's port and make it insecure

[finkployd]

Way to go MS. Take the port used by the DCE endpoint mapper, use it in your own broken, buggy, and insecure version of DCE RPC (also known as DCOM), then refuse to fix it.

My University uses DCE all over the place, from a financial application to the distributed filesystem. Now people are going to start blocking this port (135) to protect against then start complaining when some of the applications they use and their file system access stops working.

Finkployd

A 7 year old OS deserves no support

[g_bit]

BTW, a fix is available for a charge, it's called: Upgrading to Win2k.

Re:A 7 year old OS deserves no support

[Jugalator]

It deserves the support MS has said it should get. Please read up before posting *yet* another of those comments.

After all...

[Renraku]

..it isn't Microsoft's fault that people refuse to redesign their company, buy a new licencing scheme, and further Microsoft's evil cause just to ensure the safety of their data.

Just like Visual Studio.NET

[estoll]

Kind of like how they threw in the towel at Visual Studio.NET! Its a brand new product and they have only released a minor patch for a very specific problem in it. It still crashes several times a day and we are all going to be forced to upgrade to Visual Studio.NET 2003 instead.

Hmm

[LMCBoy]

So much for their "you get what you pay for" argument for commercial software...

How come it's common to all of them?

[Atomizer]

What seems odd to me is that they can't make a patch for NT4, because the system was changed so much between NT4 and 2000 (for improvements, no less), yet they all happen to have the same vulnerability. Hmm. That sounds like the systems might be sharing something in common...

I know it's possible that the rewrite reimplemented the same bug, but it doesn't seem likely.

What really bugs me...

[sabri]

...is that professional system administrators and network designers still make de desicion to use Microsoft's products. We see it over and over again; huge security flaws in their closed source software while the admins have to wait and wait until someone with cvs access has the time to write a fix and release it.

As long as it would be only their security, I could not care less. However, the recent 1434/udp worm showed us that there are enough clueless admins out there that it is possible for 376 bytes to have networks go down completely because of Microsofts complete irresponsable behaviour.

What would happen if Boeing would stop patching security issues in their airplanes? It's just too sick for words. Everyone using Microsoft products should be asking themselves one question: what if...


Note: this is not a flamebait, it just my observation.

Fair point. In that case...

[jabber01]

You make a good point. If it is infact unreasonable effort for MS to support one of their better products, then maybe, just maybe, the could consider releasing the source code for it, so we could support it for ourselves?? Huh?

Yeah, I know, wishful thinking. Makes no sense if most people would rather just pay for an upgrade.

From the horse's mouth...

[The Ancients]

Software Engineer:

"The architectural limitations of Windows NT 4.0 do not support the changes that would be required to remove this vulnerability."

Marketing Engineer:

Uhh, guys, you can't say that - we said this!

Bullshit Engineer?

Microsoft - who would you like to believe today...

Just a thought...

[alaffin]

But NT 4.0 is technically still supported right?

Depending on who you ask in this thread, until June 1993 or the end of 1994. But there is nor argument that it is still supposed to be supported by Billy and his gang.

Now, if the random car company makes a car that sometimes ejects you from the passenger side for no real reason, then they have to call the automobile back and either fix it or provide you with a new car. So shouldn't Bill have to call back all copies of Win NT 4.0 and either fix it or send them a nice shiny new server?

Just curious...

Obligatory...

[guacamolefoo]

Instead of patching the problem, it's advised to... ...run linux instead. While it may not be more secure inherently, at least you run less risk of being EOLed.

GF.

This is why MS is evil

[Jason1729]

If you use windows NT, your choice is now pay for the next version of windows or live with the hole. Some companies still use NT because they have custom mission critical software that will not work on a newer OS, and some companies still find (found?) that NT 4 met their needs and there was no need to undergo the expense and re-training effort to upgrade.

If the average user had half a brain, they'd see why this is proof that using MS software is too dangerous for their company. I refuse to use XP because of the activation, but I have to use win2k to get along with my clients. What happens when MS says it's time to force everyone off win2k?

Jason
ProfQuotes

Re:This is why MS is evil

[SN74S181]

If you use Red Hat 4.2 your choice is to pay for a newer version of Red Hat, pay for someone to patch it up for you at substancial cost, or live with the swiss cheese of holes.

Re:This is why MS is evil

[Jason1729]

If you use Red Hat 4.2, you have the full source to your OS which you can patch and upgrade to your heart's content. Also, Red Hat is not an operating system, it's a distribution. There's no reason you can't throw kernel 2.4.25 onto RH 4.2.

I'm not saying MS should be required to patch all their OS's until the end of time for free. They just should not force their product into an end-of-life just to make people pay for the right to enter into a more draconian licensing agreement and break all their custom legacy code that will cost a fortune to repair. It might even be cheaper to pay RH to patch their 4.2 than re-write all the old code. The point is you have that option.

If MS releases well documented source code for NT 4 as well as a free complie environment, I will withdraw my complaint. Until then, MS deserves to die for this.

Jason
ProfQuotes

Re:This is why MS is evil

[SN74S181]

Think like a business person, not like a hobbyist.

pay for someone to patch it up for you at substancial cost,

.

The idea of backporting Kernal 2.4 to Red Hat 4.2 just makes my head hurt.

bash bash bash

[Erris]

All Microsoft-bashing aside,

You got BASH up on windoze? Cool!

They're basically saying that they can't fix it because the OS makes it impossible to do so.

We all know that nothings less changeable than SOFTWARE. That's why we have such stollid windoze 2000, based on NT Technology or New Technology Technology. That strain of sollid stuff is what makes XP rock too. So you see, we can't change the softwer because we already changed it and changing it twice to support our customers would be like a double negative in the bank. Unix killer, ha ha ha.

NT4 still in most organizations

[eodmightier]

Funny first the Microsoft Hacker Proof ad gets pulled by the ASA and now they refuse to fix an exploit in an OS that is still in a majority of the organizations out there. When you look around most people are slowly making the move toward 2k AD setup but most organizations still stand by their NT4 domain setups. Most folks can block the port but the solution isn't coming from Microsoft and when you pay the amount that you do for the licensing you expect the company to actually back you (I know, I know it is M$).

This is actually helping me work linux into our organization. An insurance agency even. And I thought that this task was going to be impossible.

What about your intranet

[Foochar]

What about an attack launched from behind the firewall. The way the article reads to me if port 135 is blocked then anything the depends on RPC, like print services for one, will break. So its not really feasible to block that port off from your local intranet. However if one of your employees decides that they want to make it so that no one can print they could launch an attack using this vulnerability against the print server.

Microsoft said they would be providing security hot fixes through January 1, 2005. They also said that general hotfixes would be available through January 1, 2004. There is an obligation to live up to what you have promised. If you buy a car and there is a 10 year, 100,000 mile warranty on it, the manufacturer can't change things after the fact. This would be like the manufacturer saying that if someone bangs on your hood your car won't start. The design of your car doesn't allow us to fix this, so we recomend that you always park your car in a locked garage.

Re:What about your intranet

[Winterblink]

*sigh* Not a car analogy. I'm just going to pretend you didn't go there at all.

Quite honestly if one of your employees wants to make it so nobody in your company can print it's easier to go over and unplug it. They have access to the printer, as well as other more sensitive areas of your network as well. I mean jeeze, they have LOGINS. Do they need to hack to cause problems? No.

Re:What about your intranet

[MWelchUK]

Or a new virus which came through the firewall attached to an email, etc, which _also_ attacked using this exploit...

There is a fix for this on NT4

[Znonymous Coward]

Step 1. rawrite.exe cdrom.img
Step 2. reboot insert Linux CD-ROM
Step 3. ???

be advised

[Erris]

What other operating systems from back then are still "supported" now ? Solaris 2.6 maybe ? (Rapidly approaching EOL/EOS) What else ? Point is: NT4 is so old (and so BS), I can see why they want it to die (apart from the reason that they want to sell the new OSs)

If you have a sun, you will be provided with software with all the fixes free of charge. A friend of mine bought a nice ultraspark on Ebay a while back and he was provided with all that he needed.

If you simply have a 486, all the BSD and Linux distro you want, with all the fixes, are available under the same terms from way back.

Re:be advised

[stanmann]

If you are running a system more than 10 years old, you either do not need support/upgrades(because the system works as is for all you need to do and your only connection to the world is 33.6) or you need support like IBM Provides. PS/2 Model 30(8086)

Re:be advised

[stanmann]

Yes, I'm replying to my own post. Here is another IBM Product. Which oddly enough will run on the one referenced previously.

Re:be advised

[cscx]

That is actually still used a lot in embedded applications, like cash registers.

Re:be advised

[pmz]

A friend of mine bought a nice ultraspark on Ebay a while back and he was provided with all that he needed.

Well, to be totally legitimate, your friend needs to buy a $99 right-to-use license from Sun if he runs Solaris, because the EBay vendor is most likely not Sun-authorized. However, Solaris will certainly work without it, because the RTU license is just a slip of paper (this is one reason I like Sun--no activation, no questions, no guilty-before-innocent crap).

With or without that piece of paper, sunsolve.sun.com is certainly freely accessible for patches and other documentation, so your first statement is completely correct. In fact, SunSolve has patches going all the way back to SunOS 4, if you need them. Their hardware documentation also goes back to the early SPARCstations.

There are no bugs. Repeat after me ...

[John Jorsett]

Time to roll out the old Microsoft standby: "It's not a bug, it's a limitation".

Re:There are no bugs. Repeat after me ...

[sharkey]

"It's not a bug, it's a limitation".

You mispelled "You installed in wrong".

So?

[wumarkus420]

You should never have port 135 open on a windows system, anyways. Get over it and either upgrade to Win2K server or put together a decent firewall.

good

[silicongodcom]

i think this is good. people still using nt4 systems will be influenced to upgrade.

say what you want about windows but 2k+ is a lot better than nt4.

anyways, apple is doing the same thing with osx. im all for it

Since I found the bug....

[daveaitel]

This is not a new bug. As the original discoverer of that bug, and [linux binary] this other unpatched bug against port 445 on Windows 2000, I can say that these bugs are, in fact, months and months old. Not to mention another kernel memory leak in port 445 (their netbios stack) I found and released with SPIKE 2.8 a GPLed program for finding these sorts of issues.

The real issue with Windows is not that they don't patch these bugs - it's that they didn't foresee these bugs. The fact that a pooly implemented, and impossible to understand, DCE-RPC stack is built so heavily into the NT architecture is Window's inherent security weakness compared with Unix, in my opinion.

Don't think I don't have more bugs waiting in the wings...:>

Don't buy it

[GQuon]

That's what is great about the United States - if you don't like windows DON'T BUY IT and shut up about it.

if you don't like the war in Iraq, and the way it's covered on Fox, DON'T WATCH IT, and shut up about it.

Seriously though.
If nobody were working to provide alternatives, people wouldn't get away from using it.
And if nobody were speaking up against it, all those violations of the law would just be swept under the carpet quietly. It is still being swept under the carpet, but not as quietly.

Yet another Ploy

[!Freeky2BGeeky]

You'd think Microsoft would stop trying to force people to upgrade to the "Next Great Thing"tm , instead, they hold off on a security patch claiming that it's too hard (insert whine here). Just wait, there'll be enough of an uproar that they'll come out with the patch. In the meantime... why not consider upgrading... to Linux?

Get over it

[Randolpho]

I'm tired of the MS bashing / karma whoring. Get over it. When was the last time Redhat released a security patch for Redhat 6? Is Redhat expected to patch a security flaw in 6 today, or is it allowed to say "work around it or upgrade to 8 (9, now, I guess)"?

This is an early branch in the software. If you want a flaw fixed, get a later version.

Re:Thanks MS, steal DCE's port and make it insecur

[daveaitel]

Have you SPIKE'd your DCE Endpoint mapper? The Unix versions I've tested with the tool that found this bug (http://www.immunitysec.com/spike.html) all fall over just as quickly, if not more quickly.

Dave Aitel

Awww, Man.

[jpsst34]

I'm the head of IT at a somewhat late-adopting company. We are preparing a company wide migration from NT 3.51 to NT4. We have a lot of client machines on Win95 that we hope to have to 98 by Fall and Me by this time next year. I thought that by moving to NT4 and Me that we'd be caught up on all this security hullaballoo. What am I going to tell the CIO?

Re:Awww, Man.

[Violet Null]

That you won't have a problem because you already have a firewall, and port 135 is already blocked.

That is, if you're any decent at being the head of IT for a company. Otherwise, you'll use it as an excuse to inflate your budget to "deal with the problem".

Have to stop support eventually....

[nurb432]

In all fairness, NT is beyond its life expectancy, its time to retire it.

While i agree its expensive to retire a product that 'still works' and move on, you really cant expect any company to support products this old.. Regardless of who they are, not in this day and age....

Re:Have to stop support eventually....

[SuiteSisterMary]

If I was running a five year old copy of Sendmail, and asked for a patch for the latest Sendmail bug, the overwhelming (and flaming hot) response from the /. and Linux community would be 'upgrade to the current version of sendmail.'

Re:Have to stop support eventually....

[HuguesT]

You chose the wrong example. Actually sendmail.org is pretty good at providing security patches for older versions of sendmail.
See this

Re:Have to stop support eventually....

[IXI]

But you have the chance to backport the patch yourself, or have someone do that for you -- if you really needed this you will be a company and can afford to pay someone to do the job.

Yay!

[Dragonshed]

Microsoft strikes another blow for the benefits of closed systems!

(sarcasm)

Better Workaround

[Eric Savage]

Isn't is a better idea to firewall ALL ports on ALL machines where a compromise could cause problems (and open up those you need to, when you need to)? This seems to be common sense to me.

Win2K PDC is too backwards compatible

[g_bit]

Running a Win2K PDC cuts off functionality from NT and Win9x clients

Actually, that's only true if you're running the Win2K PDC in Native-Only mode which is NOT the default. The default is to run in Compatability Mode which works great with WinNT 3.5/4 and Win9x clients.

As for software that will only run with 9x and NT, could you perhaps tell us which software that is? The only reason I ask is because I have a lot of stuff that was built for Win 3.11 and DOS (My father's business accounting software, old HP Scanner software, etc.) that runs great on Win2K.

Windows: Telling Linux to try to keep up since 1991.

Redhat 3.0 patch

[SHEENmaster]

Is available for free download here for anyone who wants it.

New Microsoft software requires new hardware

[yerricde]

Consider this like Red Hat refusing to patch up Red Hat 3.0 with the latest security fixes.

Two differences here. First of all, while Red Hat Linux 8 can be slimmed down to run on the machines that Red Hat Linux 3 ran on, Microsoft Windows Server 2003 apparently cannot be slimmed down to run on the machines that Microsoft Windows NT Server 4.0 ran on. Please correct me if I'm wrong.

Second, as dhovis mentioned, Red Hat Linux is free software. Unlike the license on Microsoft Windows operating systems, the license on Red Hat Linux lets anybody provide security patches; if there's still enough demand, some third party will offer maintenance contracts and backport the security patches.

This is a bad thing?

[redelm]

I'm sorry, but this sort of thing is a "feature" of closed-source.

I'm glad it's getting a high profile because people should always realise the consequences of their decisions.

Re:Of course, what idiot...

[more fool you]

a lot depends on whether you trust your internal networks or not

Re:Microsoft smote the NT...

[cant_get_a_good_nick]

TROGDOR!!!!!!!

Re:Thanks MS, steal DCE's port and make it insecur

[Anonymous Coward]

There goes Unix, being more efficient than Windows again!

No Way To Know

[4of12]

And MS wonders why people get upset with them!

Anyone with a nice working NT 4 based shop have no choice but to believe MS' explanation, since no one else has access to the source code to verify the story.

It's possible they're being truthful in their explanation, but since there's no conflict-of-interest-free source of independent verification, the paranoid among us will suspect it's all just a plot to get us spending time and money on an otherwise needless upgrade path to XP.

Quote from article, admission of fatal design flaw

[x-empt]

"The architectural limitations of Windows NT 4.0 do not support the changes that would be required to remove this vulnerability," Microsoft says."

So, Microsoft admits finally, that Windows NT (a "SECURE" OS) is fatally flawed from the ground up and there is no way to fix this basic vulnerability.

The crucial difference. -- open source

[Linux-based-robots]

Of course, Red Hat is also phasing out earlier versions of Red Hat Linux, but due to its open source nature you could get security updates from another source (apt-rpm repositories for instance) or make your own patches. Windows users are forced to rely on Microsoft for timely security updates, which they frequently fail to provide even in recent versions of Windows.

Latest patch instructions from Microsoft for NT4

[mustangdavis]

• Remove patch (bandaid, tape, or bubble gum) from container.
• Physically block port 135 with above mentioned patch.
• Done.

Seriously, how many people are running RH 5.0 or HP-UX 9.x??? Those aren't supported anymore, but they were around (and supported) when NT4 came out ....

I, like most people on this site, have an intense dislike for Microsoft ... but maybe, just this once ... we should cut them a break??

... and if you're running an app that is "that" important, then it should already be behind a firewall ... so seriously, other than having to shell out a couple bucks for a current OS, what is the problem?

... or instead of complaining and viewing this as something bad, look at this as an opportunity to convince your boss that it is time to switch over to Linux!!

See, every cloud can have a silver lining!

Well, here's proof that winnt is poorly designed

[amalcon]

"The architectural limitations of Windows NT 4.0 do not support the changes that would be required to remove this vulnerability."

If proper design practice was followed, this should not happen. The issue is, under proper design practice, all expected features must be designed in from the get-go. If a new feature is thought of later, it usually gets "tacked on" to the existing infrastructure. This is what happens when one constantly adds functionality to the same product, as MS does. You get the benefit of being able to put a feature in with little development time, but every time this happens, you lose some extensibility.

This is essentially the problem with the constantly-evolving upgrade business model Microsoft has used from the get-go. If it's different enough to be a new OS, PLEASE, make it a new OS!

Funny Quote from Security Bulletin

[syntap]

"it is infeasible to rebuild the software for Windows NT 4.0 to eliminate the vulnerability"

M$ has billions of dollars and rebuilding software is infeasible? Why didn't they just say it would be a pain in the ass?

Please....ths is not that big an issue.

[Anonymous Coward]

Unsupported OSes;

1. Solaris pre 2.6
2. Linux 2.0 kernels
3. Red Hat pre 7
4. OpenBSD 3.0

All of these are a hell of a lot newer than Windows NT 4! Microsoft isn't obligated to support old software forever. Anyone complaining -- tell your execs to start making a real commitment to IT.

Re:Please....ths is not that big an issue.

[the eric conspiracy]

Microsoft isn't obligated to support old software forever.

Hmmm yes, except they say NT4 IS supported, until 2004. They also sell support contracts for it.

This is very bad because it screws up lifecycle planning.

Synonyms?

[sharkey]

They quote Microsoft as saying 'The architectural limitations of Windows NT 4.0 do not support the changes that would be required to remove this vulnerability.'

Sounds like they're saying NT4 is "Broken by design".

It's almost time

[oaf357]

It appears the Microsoft is going the way of so many other vendors in saying that they will no longer support "legacy" software and equipment. I agree that NT4 is at the end of its life cycle but Microsoft isn't. Microsoft should support its products as long as support is requested regardless of how old they are. This is only fuel for the fire. Now the IT directors of the world will think, "Hmm... save the money and not upgrade or save the headache and upgrade." Either way there will be headaches but there is only one way Microsoft gets more money.

a disparity in terminology

[The1Genius]

I think 'Refuses' is a little different than 'architectural limitation'. They aren't refusing to fix it - they claim that they cannot. The title of this item is a little mis-leading.

Firewalls

[booch]

How stupid are people? If you'd bothered to pay attention the past couple years, your firewall would already be blocking this. Your firewall should already be blocking port 135 -- and every other port that you don't explicitly need. Your outbound connections should be limited to basically HTTP, HTTPS, SMTP, FTP, SSH, POP/IMAP, and perhaps a few others.

Re:Firewalls

[cute-boy]

While the above may be true, if you are in a big corporation, even the intranet can be a wild and dangerous place, and attacks from within, both deliberate and accidental (viruses etc), can be a problem.

Maybe these big corporations (and the not so big too) will feel a bit let down by their previously trusted vendor, and will wonder if there are alternatives.

RG

Not the first time

[throwaway18]

I'v been irritated by Microsoft's support for NT since they descided to not distribute service pack 7 for NT.

I find Microsoft's explaination for not fixing this RPC problem unconvincing. I suspect that if they wanted to they could add a check for malformed packets in wahtever bit of code listens on port 135. It might not be pretty or high performance but I think it would work. Any experts on windows architecture reading?

NT4 is my favorite version of windows. I keep a sacrficial install around to test new software. By being carefull about what gets installed I'v had uptimes of 100+ days from NT machines and reboots are usually hardware related. It is possible to run NT4 without IE4/5/6 so you don't have IE intergrated into all the system dll's bogging it down.

NT4 workstation is available cheaply. At large computer shows there is usually a trader with a few cd+license packs for about E25 each.

I hope to use NT4 for another five years or so, until I can't buy hardware with NT support.

Hang on a sec, we could really do with more work for geeks at the moment. If a load of corporations are pushed into upgrading their fleets of NT4 machines, with all the attendant problems that go with buggering about with computers, that means more work for geeks. Yah microsoft! Where's that alpha copy of windows longhorn...

Easy Solution

[dheltzel]

MS should just offer all remaining NT 4.0 users a free upgrade to their choice of 2000 or XP server. They would engender much good will and finally be done with the platform they don't want to support.

Of course, this might be sending the wrong message to customers for the next upgrade cycle (just wait until we're tired of supporting it, and you get the upgrade for free), but it seems like the current message is "if you don't like us leaving you stranded, don't use Windows anymore".

NT4 Firewalls?

[suprchargd]

So what does this mean for those who use Windows NT4 on their firewall/router box?

Re:NT4 Firewalls?

[cranos]

They're probably the same people who leave your office doors and windows wide open as well? With a big sign that says "Come on in, we're easy".

Bullshit

[waldoj]

Nice... Another MS basher. I am really sure that was what they *really* meant to say. When you don't know much about business it is easier to just slag it huh?

NT 4.0 is over 7 years old...

NT is still supposed to be supported through June. Arguments that "hey, it's old" are bullshit. My family's business uses NT 4.0 as their primary file and fax server. The machine, while whizzy at the time that NT 4.0 came out, cannot possibly support Win2K. We expect to switch to Linux for our file server by the end of the SLA, and have figured for years that Microsoft would, as per their support agreement, patch security holes until that end of life date. Turns out that they were lying.

"MS basher"? Only because they're a horrible company. What's your excuse for being an apologist?

-Waldo Jaqutih

Re:Bullshit

[lsoth]

Horrible company eh? Are you bitter because they make more money in a day than you'll ever see in your lifetime?

Please... You want to talk horrible companies why not AT LEAST start with companies that test products on animals, use slave labour, etc...

Microsoft uses bad business ethics sure, I don't like them either. However they aren't a "horrible company". They need a lot of improvement for sure, but they don't deserve to be labeled by un-educated extremists.

Re:Bullshit

[lux55]

You can't justify the thief's actions by comparing them to murderers. They are still a thief, and thievery is a horrible thing. Thievery on a global scale, as we're seeing more and more of these days, does include slave labour practices, and contributing to poverty and unemployment here and abroad (see Sun's latest H1B lawsuit). I'm not specifically accusing Microsoft, but they have been convicted of using illegal business practices. That's not as horrible as torturing animals, but the comparison doesn't justify their actions either.

Re:Bullshit

[waldoj]

Horrible company eh? Are you bitter because they make more money in a day than you'll ever see in your lifetime?

Please... You want to talk horrible companies why not AT LEAST start with companies that test products on animals, use slave labour, etc...

Microsoft uses bad business ethics sure, I don't like them either. However they aren't a "horrible company". They need a lot of improvement for sure, but they don't deserve to be labeled by un-educated extremists.

Blah blah blah worthless ad hominem blah blah stupid comparison blah blah failure to address any of my points blah blah blah...

You talk a lot, but you sure don't say much.

-Waldo Jaquith

I feel sorry for those using NT4.

[Mustang Matt]

It seems to me Microsoft has a couple of options here:
1. Open source NT4
2. Free upgrades to Win2k Advanced Server
3. Fix the problem

What a great idea!

[niom]

I wonder how Saddam didn't thought of it. "Architectural limitations do not support destroying my illegal al-Samud missiles".

It what Microsoft said they would do that matters

[meosborne]

The age of NT 4.0 is not relevant. What is relevant is that Microsft said that they would provide security fixes until a certain date and they aren't. As an IT manager, this tells me that this company is not reliable. If you promise me service, I expect to get that service.

Note that is not possible to verify Microsoft's claims as why they can't fix it, nor is it possible to get anyone else to fix it since the code is not available. This situation is a perfect example of why a business is better off with open source.

os/2 warp?

[gimpboy]

i believe ibm still has support contracts out (2004 i believe) for os/2 warp. i had a friend who worked at tivoli and he mentioned it to me. here is ibm's strategy for 2003. i believe os/2 warp 4 has been out since 1996.

By not fixing it...

[crivens]

By not fixing it, they're trying to force people to upgrade to Win2k. "If they won't upgrade, let's force them to!"

Nah, I'm just being cynical, but I'm confused about something. I thought Win2k was based on WinNT? So how much of the NT internals were re-designed for Win2k? What I'm saying is, if it's not possible to fix it in NT, why is it possible to fix in Win2k if Win2k is the son of NT?

Re:By not fixing it...

[Matrix2110]

why is it possible to fix in Win2k if Win2k is the son of NT?

Because XP is the mother of all OS'es

Re:Thanks MS, steal DCE's port and make it insecur

[finkployd]

DCE on z/OS didn't seem to fail :)

Finkployd

nt 4.0 came out 1996

[asv108]

Microsoft is obviously under breach of contract here since it is suppose to fix all security holes till the end of the year for workstation and a year more for server, but lets consider when NT 4.0 came out, I beleive it was the fall of 1996. Around the same time redhat released version 4.0 (colgate). Is redhat still supporting 4.0 or even 6.2? If I decided to buy a Linux distro in 1996 or even 1997 was there anyone who agreed to provide security updates and paid support for eigth years?

Re:nt 4.0 came out 1996

[the eric conspiracy]

It's not like Microsoft stopped selling the NT4 product six years ago - in fact, it is still currently sold in the VAR channel. In some sense Microsoft is failing to supply security hotfix support for a product that they are still selling. That is not very good support.

As a matter of fact RedHat 6.2 is still being supported, but not for much longer.

I imagine that you could easily hire somebody to support it for you, which would be quite feasible due to the availability of source code. You aren't tied to the original vendor for fixes as with Microsoft.

Or if you didn't want to go that route with RedHat, you could always upgrade - RadHat ISOs are available for free download, and you should be able to upgrade from 6.2 up through 8.0 using the standard installer.

Holy hell this site pisses me off - posted anon

[Anonymous Coward]

NT4 is almost seven years old, not four. Big difference. How can you trust that Microsoft will support it? You can't.

That's what it comes down to, really. That is why this whole website is here. A group of folks decided that open and free is better than closed and wildly profitable. Then they set out to prove it. Along the way, community sites like slashdot sprang up. Some communities focus on improving the product and helping the users. This particular one focuses on bashing the competition.

This is a limitation of Microsoft's business model: stay in business and stay profitable.Linux doesn't have these requirements, so it wins by your standards. Unless you actually use or
develop linux or linux apps then you are a baffoon for speaking out like you do. And the majority of readers of this site are just this; impotent whiners who don't actually support "the cause". I don't think Microsoft is wrong for doing this; I DO think this validates our way of doing things at the OS level.

I write this knowing it will be ignored because I am posting as an AC, but I must say SOMETHING. All this miserable site does is foster zealots.

That being said, see you tomorrow!

Shared Source!

[hendridm]

Why don't y'all make your own patch :D

I did read, obviously you didn't.

[g_bit]

It deserves the support MS has said it should get.

Exactly right my man, it deserves whatever support MS says it should get, which at this point is none.

And it's too much fun to make all the Linux zealots upset when I say something pro-MS, so *NO* I won't stop :)

Re:I did read, obviously you didn't.

[Jugalator]

I'm no Linux zealot =)

I'm just saying that MS has said that they'll support it but they don't. Is that hard to understand?

MS fixed the problem...

[Anita Coney]

All you have to do is upgrade to XP. It's as simple as that.

Anita Coney

"Now that's sarcasm." Homer Jay Simpson

DOD

[kruczkowski]

Wow!

DoD systems are not allowed to run Windows 2000 on the servers. (Well you can, but you can't use AD, just as a stand-alone)

I think that MS just wants one of it's biggist customers to upgrade!

Bill gates borg

[56ksucks]

Hey, what happened to the nifty little Bill Gates borg picture?

Re:Bill gates borg

[the eric conspiracy]

Notice how much advertising Microsoft is doing here? I bet they complained about the borg icon.

Probably a sell-out.

Next thing we can expect is fewer articles critical of Microsoft.

Re:Bill gates borg

[cant_get_a_good_nick]

Bill Gates is attatched to Topic Microsoft

My guess is they figured MS has their hands into so many things now, they split the group up. Now there's a Windows specific topic, of which this seems to be the first entry. Makes sense: look how many Apple topics there are. As far as anyone claiming "sell-out" conspiracy, notice the Windows icon is pretty broken up.

The Ford Version of M$

[web0]

sorry but due to the design limitations of our cars we DO NOT support the brake system required to stop the car! please improve ur driving skills ;)

Re:The Ford Version of M$

[macrom]

More like :

Sorry, but due to the design limitation of your 1965 Ford, we are unable to retrofit your car to fix a recently-found problem in the braking system. Third-party companies may provide small fixes that can help alleviate (but not completely fix) the problem. This problem is not present in our current line of products.

Windows NT 4.0 hit end-of-life back on December 31, 2002. An IT department should know that commercial software companies, MS included, routinely EOL software and drop support for them. A 7-year-old OS is going to have moth holes in it. If your company cares about security, upgrade to something more modern and (theoretically) secure. If you can't afford it, then evaluate migrating to OSS solutions. If you can't afford that, well, you're in big trouble.

MS makes it clear on their Product Life Cycle pages what support they plan to give for all products. Anyone caught surprised by this probably shouldn't be making IT decisions for an organization any larger than 1.

Re:The Ford Version of M$

[hughk]

This is a very poor analogy.

Sorry, but due to the design limitation of your 1965 Ford, we are unable to retrofit your car to fix a recently-found problem in the braking system.

More linke your 1996 Ford only lasts four years, after that, we refuse to maintain it.

Third-party companies may provide small fixes that can help alleviate

Unlike car manufacturers we do not publish full design information or permit reverse engineering. Not only are you on your own, we'll sue your ass off if you even ty to fix the problem yourself. MS makes it clear on their Product Life Cycle pages what support they plan to give for all products

Where was that timescale when I bought NT 4.0? In theory anyone can still drive a Ford Model-T, not many spare parts for those around. The interesting thing is that the product can be completely reverse engineered and replacement parts produced by anyone. This is where the software vs auto analogy really breaks down. And heck, I own my auto, but I do not own a Microsoft OS, I only license it.

Actually a client of mine does get 10yr support commitments on any given release level of its critical software. Suffice to say, Win2K isn't permitted anywhere near that critical area. I understand DOD gets 20yrs.

Not quite

[XSforMe]

only people using NT are businesses that are reluctant or unable to upgrade.
Je, I remember too when I was a student and thought that to upgrade software all you needed was to buy the thing and then run a wizard.

Unfortunately, this is not the case for most systems. Upgrading takes much time and puts strain on IT staff to get the monster running on schedule. Last time I upgraded the CEO of the company walked in on me during a sunday to see if the systems would be ready to run on Monday. Must I say more?

Re:The patch is called windows2k or win2k3

[Billly Gates]

I read it as this from Microsoft.

Yes we have a security fix! Its called Windows2k3 or w2k. If you want to be secure give us money and upgrade.

They want corporate customers to upgrade to satisfy their shareholders. Also I am very skeptical of their 40 billion dollars in the bank claim and think Microsoft may be having financial difficulties. Why?

Notice they never list how much profits are made from sales during quarterly briefs? Only units sold. I smell some RIAA and Enron style math.

Please stop using Windows and other MS products

[RoboLobster]

Linux is superior to the Windows platform. The file system makes it difficult to remove essential OS components or corrupt program files. With Windows, any user can delete any file so long as it isn't resident in memory. With Linux, processes can safely be killed. On Windows, killing a process might corrupt the state of the OS and require a reboot. Also, Linux has less security problems than Windows, and when Microsoft learns about security problems, they are not always prompt or even responsible when it comes to resolving them.

Microsoft cannot be trusted. They steal technologies and innovation from other organizations like Xerox, Sun, and the WC3, and use their financial power and lawyers to stomp out competitors. Sometimes, they make modifications to the innovations others have come up with, and modify them so they will not interoperate with the originals. Furthermore, Microsoft has been known to be untrustworthy by employing technologies that are anti-competitive. They also use patent warfare as a way to make themselves money and supress the technological community. Linux is free to use, modify, and distribute, so long as you give authors credit. That is not much to ask. Moreover, there are thousands of great programs and utilities for use with Linux. These are free as well.

If you use Windows, you are doing yourself and the world a major disservice. If your reason for using Windows is because of the application support, you should change your applications or write to vendors encouraging them to port there software. There is no excuse.

If you use Windows because it is user friendly, that may be true in the short term. It is not true in the long term because your dll's will overwrite one another when you install a new program causing binary incompatibitly. Also, programs are free to modify the registry resulting in slower load times and system corruption.

I urge everyone to stop using this Operating system in favor of a *nix OS. Please stop supporting Microsoft and start supporting more viable OSes. Reasons you can't refute have been stated above, and the software is readily available. Now go to www.linuxiso.org and get started.

who was Christine Watkins?? seriously

[Unknown Poltroon]

i have no idea

Re:The patch is called windows2k or win2k3

[Tingler]

You may have a point:

click me

Where do you want to go today?

[permaculture]

As yet, no-one's posted a variation on Microsoft's favourite slogan to suit this story.

I'm shocked.

Linux Firewalls

[xneilj]

If you want to quickly turn an old box into a dedicated and very secure firewall, then Smoothwall and a fork of it, IPCop are fine GPL examples. Smoothwall also sells a non-GPL version of their firewall with extra custom functions, but the basic Smoothwall is still GPL.

Both of the above support a load of network cards, and even USB-based ADSL (like the Speedtouch) right out of the box and are an absolute cinch to get running, even if you only have limited networking knowledge. They also provide a simple but powerful browser interface for administration (port forwarding, dyndns registration, squid caching web proxy, etc.).

If you want to add a firewall to an exising Linux box, then a good recommendation is ShoreWall which I've just recently set up on a Mandrake box and been very pleased with. It uses the kernel's Netfilter (iptables) support to do its thing, and is the best option if you want a multi-function firewall/router, etc., since both smoothwall/ipcop are designed to be more restrictive 'all in one' firewall distros where it can get tricky to do things like recompile the kernel without it breaking. Smoothwall and IPCop do provide regular security patches which are very easy to install via the browser admin interface (which even warns you when new ones have become available).

Smoothwall are usually a little quicker than IPCop at getting new patches out. Shorewall is a standalone firewall so it's up to you to keep the other apps updated.

Re:Linux Firewalls

[shadowbearer]

I'll second this. I've installed numerous routers for people who went cable and had an old machine laying around, which I stripped down and installed IPCop (I don't like Smoothwall for, uh, political reasons)

Very stable, easy to install and works very well, even for dialup machines if you want a network shared dialup without using windows shared dialup.

One caveat: on small harddrive machines with SW or IpCop make sure you tell the logger to ignore port 138 and 137 requests, or else on a windows network your logs will fill up to the point where it dogs the machine badly ;-)

SB

Car Support

[OYAHHH]

I noticed on another site today (I forgot which one) how MS is selling OS products for installation in cars.

How long will they support those operating systems. Will I be forced to upgrade buy a new Honda after only seven years because MS refuses to support my old one?

I've heard that car manufacturers must support their products with spare parts, etc. for seven years after selling it.

BMW 7 series owners are already sorta bumping up against this issue. They have a MS OS in the newest vehicles and it seems things are very whacky on those cars and the dealer cannot do squat about it.

I think all of this brings up some very serious issues...

Bug or what?

[/Idiot\]

Let me get this straight, you have port 135 open to the world and want a software fix? hmmm....

Why they aren't making a patch, from Microsoft

[shrikel]

From the faq:

The Windows NT 4.0 architecture is much less robust than the more recent Windows 2000 architecture, Due to these fundamental differences between Windows NT 4.0 and Windows 2000 and its successors, it is infeasible to rebuild the software for Windows NT 4.0 to eliminate the vulnerability. To do so would require rearchitecting a very significant amount of the Windows NT 4.0 operating system, and not just the RPC component affected. The product of such a rearchitecture effort would be sufficiently incompatible with Windows NT 4.0 that there would be no assurance that applications designed to run on Windows NT 4.0 would continue to operate on the patched system.

Sure it's idiotic that their system couldn't handle a patch. But if that's how it is, then it's a good thing they made their more recent versions dynamic enough to be fixable!

Re:Why they aren't making a patch, from Microsoft

[Cyno]

Kinda sounds like how Internet Explorer was fully integrated into the OS and couldn't be removed, doesn't it?

Microsoft lies to you and you fall for it every time. Hahahhahahahahahahahaha.. hahaha. :)

Re:Why they aren't making a patch, from Microsoft

[mbstone]

Translation: We haven't attempted a build of NT 4.0 in fuckin' ages, give us a break. We're not even sure we put the punchcards back in the box in the right order after we dropped 'em the last time.

Re:Why they aren't making a patch, from Microsoft

[whaley]

Hey, they only kept the rock solid parts you know...

Re:Why they aren't making a patch, from Microsoft

[IamTheRealMike]

Hmph. It sounds rather unlikely to me. It sounds like this is a fairly typical case of not checking the incoming data correctly. The fix for 2000/XP is to verify the messages. Why does adding a few checks to the incoming data buffers require a fundemental rearchitecting?

Well, I can't think of any real reason why they'd deliberately screw their customers over this, NT is going to be EOLd soon anyway, so we just have to take their word for it. Something still seems a bit wrong here though.

Or more ominously...

[MsGeek]

Which also makes me think that this whole thing about NT4 being to old to fix is a load of crap. If they fix it in 2000/2003 they can fix it in NT4. They just don't WANT to ...

Or more ominously, what if the bug is just as unfixable in 2000/XP/2003? And they just don't want to admit it?

I suspect there will be more trouble in the future. This isn't the last you've heard of this problem.

WHY THE BLEEP CAN'T IT BE SHUT DOWN ???

[knorthern knight]

*nix RPC runs on port 111. If I don't intend to have outside computers log in and run apps on my linux machine remotely, I shut down RPC, and uninstall it too, as well as blocking *ALL* privileged ports (0..1023) with iptables. It's bad enough that Windows comes with unnecessary stuff enabled. But when *YOU CAN'T TURN IT OFF*, something is drastically wrong.

Re:WHY THE BLEEP CAN'T IT BE SHUT DOWN ???

[Hierarch]

Ye Olde Blockquote:

*nix RPC runs on port 111. If I don't intend to have outside computers log in and run apps on my linux machine remotely, I shut down RPC, and uninstall it too, as well as blocking *ALL* privileged ports (0..1023) with iptables.

This is great for linux, not so great for Solaris. I frequently have to work with customers (yes, I'm a consluttant) where they need CDE (Common Desktop Environment) because they don't know how to use anything else. CDE requires RPC. RPC requires security vulnerabilities. The phrase "BOHICA" comes to mind.

For the curious: if you don't have the portmapper running when you try and login using CDE, the login session hangs after accepting the password and before starting anything that would let you cancel. And the hell of it is, CDE doesn't actually require any of the RPC services it is looking for, if you disable the services it works fine. But you must have the portmapper running. Microsoft isn't the only one with massive stupidity in software design.

Oh well, at least SunScreen Lite is now bundled with Sol8+, and full SunScreen with Sol9.

Re:What does this do to their Virtual PC strategy?

[TeddyR]

My question is WRT to many of the Network Accessible/Attached Storage devices like some the Iomega NASes which are essentially windows 2000 server machines what would need to be patched against some of these issues.

In some cases it is not possible to simply do a windows update since the devices are "uber-tweaked" as you say.....

Ever heard of Discovery?

[LibertineR]

I dont think any of those so-called 800 pound gorillas want to take on Microsoft any time soon, unless they ALSO have hundreds of lawyers, and 40 Billion in the bank.

Suppose just one of those companies cant account for each and every one of their Windows or Office licences? Can you say MASSACRE? The cost of the audit (mandated by Discovery laws) would be enough for most to take a pass. The cost of fees, penalties, royalties, etc, for so much as a single violation, would wipe out any gains to be made in litigation.

In case you havent noticed, GOVERNMENTS have not been able to hurt Microsoft. Suing Microsoft almost killed Apple, WILL eventually kill Sun Microsystems, and pretty much anyone else who tries. Oracle? Bring it on. That is some nice Bayside property they've got there. Might be nice to see some flying Windows flags north of Mountain View.

Re:Ever heard of Discovery?

[Cedric C. Girouard]

In case you havent noticed, GOVERNMENTS have not been able to hurt Microsoft. Suing Microsoft almost killed Apple, WILL eventually kill Sun Microsystems, and pretty much anyone else who tries. Oracle? Bring it on. That is some nice Bayside property they've got there. Might be nice to see some flying Windows flags north of Mountain View.

You do have a point... But in this case, wouldnt doing nothing be the worst of the options ? That's basically giving Bill a get-out-of-jail free card...

I guess that someone taking on Microsoft _would_ seem like a trip to Utopia, but then again... One can dream cant he ?

I still believe that someone has to take them on... Set precedent... Maybe a foreign government, like Japan, or those in malaysia who happily told MS to shove it up where the sun doesnt shine... Then maybe it can crank-start a movement to sue MS...

What if you get a corp. where all is accounted for ? Where they follow licensing properly. It's not unheard of. Anyways... As I said earlier, not doing a thing sends a message clearly saying that as long as you're the richest, you're above the law, and that every and any contract you sign can be rolled up, tacked to a wall near a toilet...

Re:Ever heard of Discovery?

[LibertineR]

Unless a company has a VERY close relationship with Microsoft, it is almost impossible to keep up with the changes in their licencing policies. Can you think of a company that can ON DEMAND produce 500 licences for Office, and prove that none has been used twice? Not me. From what I understand, the penalty with the Software Publishing Association is $250K per instance! No thanks.

Using Sun Microsystems again as an example, I think most companies would be much better off focusing on their own core business than to try to take on Microsoft. They leave a trail of dead and dying companies in their wake whenever attacked. They are like the Marines in Iraq.

If they cant kill you, they will wait and starve you out. They will lay siege to their opponents, who dont have the stomach for warfare like Microsoft does.

You cant kill the giant without a giant killer idea. Some company is going to have to take a risk, and develop something WAY better. Not just stuff that is just as good, almost as good, or just different.

The odds are, that isnt going to happen in a big corporation that has to answer to shareholders. It will probably be some dudes in a garage somewhere who can keep their mouths shut long enough to get a proper patent BEFORE they open their mouths.

What's the big deal? Who leaves 135 open, anyway?

[captainfugacity]

Jeez, an explicit block on port 135 was the first rule that goes into any firewall I touch. I always ALWAYS put in explicit blocks for in / out on port 135, 137-139 even when they are redundant Oh right...the noninitiated home users are screwed because they don't even have zonealarm. Well...yeah. They don't install service patches either so what's one more security flaw matter? "You been playin da foosball??"

Re:ZoneAlarm - NT was named for a different reason

[pariahdecss]

Actually NT was named for a different reason - MS was targeting NT to the Intel i860 (code-named 'N-Ten)', a RISC processor that was oft delayed. That's why it was called NT, because it worked on the 'N-Ten. Marketing later said it stood for "New Technology" . . .(post dev). You can read about it here: http://www.winsupersite.com/reviews/winserver2k3_g old1.asp

(Enter Frodo) I will deliver the patch for this exploit to Redmond . . .though I do not know the way.

bullshit

[dh003i]

This is just part of their plan to force people make costly upgrades.

So let me get this straight

[PinkX]

(Another) security bug is discovered on Microsoft software, which affects Windows NT 4. It also affectes Windows 2000 and Windows XP, which clearly means that the later two are direct derivates of NT 4 (which we all already know).

So now Microsoft is refusing to issue a fix for NT 4, arguing that there is no way they could make it so that no other existing apps stop working. But a fix for 2k and XP has already been done. That's because of the great differences between NT 4 and 2k/xp, nonetheless they are based on the same product.

So how come that, being 2k and xp SO different from NT, that they can still run the same apps without needing any modification? How come there is no way to patch a NT4 system so that it can still run the same apps but they can surely do it over 2k and XP, and the same applications will still run without a problem over the same system.

This is clearly a move from Microsoft to force their customers to either upgrade their NT 4 installations, or else they are left to their own luck. Many people WON'T upgrade their NT 4 because that just works for them, because their hardware is not powerful enough for a 2k/xp system, or because any other reason they can think of.

Windows NT 4 has been in the market for about seven or eight years now (if my memory isn't failing it was released almos alongside with Win95). This recently discovered vulnerability has always been there since then. What would have happened if someone discovered before w2k was released? Would still Microsoft be unable to release a patch for it because it would break the whole system down?

I've seen many posts saying that noone should have port 135 open to the world. That port shouldn't be listening for request from the whole world, in the first place. There is no way you can know which ports that (for some obscure reason, valid for Microsoft of course) are listening represents a threat to the security of the system. Sure, the same could be said (no) about Linux and other systems, but there's always a way to shut them off and not let the system in a non working state.

And that's all I have to say about it.

Microsoft is doing the right thing

[Theovon]

With Linux, we have practically unlimited resources. As soon as we jump a kernel version, the last version can be handed off to a new volunteer who will maintain it indefinately. For Microsoft, they have limited engineering resources and, as large as they are, can't afford to expand indefinately to maintain older versions of their OS. Particularly as they feel more and more the pressure from the Free Software movement bearing down on them, they're going to have to devote more and more of their resources to newer versions of their OS and other products, and as FS developers get ever more organized, we're going to get ever harder to compete with. Microsoft is doing the best thing for themselves and for the rest of us, because, frankly, we need the competition to keep us motivated.

They maybe really can't

[Zygo]

I'm not so sure they can fix it.

In the beginning, NT was written on something else (for obvious reasons). Since the first version, Microsoft has probably been rebuilding their toolchains to be hosted on previous NT versions, if not completely self-hosted. This process would have been repeated at least twice since NT 4.0. The current tools might not be able to build low-level NT 4.0 code.

The Hallowe'en documents suggest that building low-level pieces of NT is not a trivial or common endeavor, and supposedly not something that the compiler toolchain usable by typical MS customers is capable of doing. It's very possible that there are only a handful of machines in Microsoft which are set up for building NT 4, and those are probably getting old, crotchety, and fragile, if they haven't broken already...

Try building a working 1.0 or 1.2 Linux kernel on modern binutils and gcc 3.2, or build 2.4.20 on gcc 2.6.3. If you somehow manage to get it to compile and link without patches, it probably still won't work properly without deep understanding of the toolchain and its bugs.

Now consider the same problem, but you only get to use the tools that came with Minix (or worse, SCO). That's probably Microsoft's current situation.

I've seen shops where coders get new computers on their desks after a product release--the old computer, with all the software, source code, development tools, etc, gets locked in a vault. If the company needs to do support work on the product years down the road, they pull the computer out of the vault, do the work, then put it back again. No worries about software rot (although hardware rot is a very real problem), although admittedly it's hard to find someone in 2003 who is fluent in Windows 3.0...

Re:What's the big deal? Who leaves 135 open, anywa

[TeddyR]

dont forget 445....

More Bullshit

[g_bit]

...(we) have figured for years that Microsoft would, as per their support agreement, patch security holes until that end of life date. Turns out that they were lying

We all feel sooo sorry for you. Primarily because you're not all that bright.

MS isn't going to fix ONE security problem that wont' even affect your File or Fax server's unless you have them on the Internet like an a$$ (you probably do don't you?) and you're going to switch to Linux.

We expect to switch to Linux for our file server by the end of the SLA...

I would wait until you get a bigger brain to attempt that. If you haven't gotten NT to work as a simple File and Fax server by now, then you won't be able to do anything with Linux. It requires reading. Furthermore, if it does work why are you switching at all??

I will say though, wonderful troll! I applaude your efforts! Your post was on topic and sprinkled with just enough "fact" for people to really believe you and you only used the word Linux one time.

I say again, excellent job!

Re:More Bullshit

[waldoj]

MS isn't going to fix ONE security problem that wont' even affect your File or Fax server's unless you have them on the Internet like an a$$ (you probably do don't you?) and you're going to switch to Linux.

How in the world does Microsoft know what I'm doing with an NT box? "ONE security problem?" This is not a small security problem, though perhaps you haven't noticed. Further, does it matter how many security problems that they won't fix? A third of Microsoft-OS-running servers are running NT 4. And they told all of them to go screw.

I would wait until you get a bigger brain to attempt that. If you haven't gotten NT to work as a simple File and Fax server by now, then you won't be able to do anything with Linux. It requires reading. Furthermore, if it does work why are you switching at all??

Why would you say that I've not gotten NT to work as a file and fax server? What part of "[m]y family's business uses NT 4.0 as their primary file and fax server" indicated to you that it doens't work?

I'm switching because I don't want to run an OS that has as many holes as WinNT does, I don't want to run an OS that isn't going to be updated after June, I don't want to run an OS that takes extremely poor advantage of its hardware, I don't want to run an OS that thinks that a server demands a GUI, I don't want to run an OS that is being squeezed to force its users to upgrade to the newest version...the list is long.

But there's no point in discussing this with you. You're an inflammatory troll. "IBM and other OpenSource backers (Sun, Apple) *know* that M$ products are currently far more superior than anything available for *nix."

NewbieTroll, begone!

-Waldo Jaquith

Re:More Bullshit

[g_bit]

...This is not a small security problem...

From microsoft.com: Flaw in RPC Endpoint Mapper Could Allow Denial of Service Attacks (331953)

You're right, this is HUGE (A DOS attack!? We'd better protect our File/Fax Servers from this one!! Our employees might try a distributed DOS on us!

I'm switching because I don't want to run an OS that has as many holes as WinNT does...

You're right because all of the reasons you stated affect your silly File and Fax Server sooo much. Good one.

But there's no point in discussing this with you. You're an inflammatory troll.

If that means that I defend all of the nonsensical MS bashing that goes on here, then you're right. You made NO sense in saying that this affects your 2 piddly little servers, and you're just making things up to be a karma whore. I didn't say that I dont like Linux, I've done a lot with it in my career but I hate stupid people who make no sense.

NT is a fucking dinosaur

[sbillard]

Good riddance you piece of shit with your stompable system32 DLLs and your weak device driver signing requirements. Windows 2000 + is so much better than this relic. I know, I know, ginne a break
Sadly, the glacial pace of the financial service industry's adoption of new technology has left many with this outdated OS. Poor programming techniques (mfc42.dll stomp DLL hell make me wanna pull out my short hairs) combined with upper-mangement risk aversion has led to upgrade paralysis at some companies.
I'm not advocating that everyone immediatley accepts everything comming out of Microsoft's pipeline (if they make a bank-based "agile business" ad i'm gonna puke).
All I'm saying is NT has be hacked to shit. Let it go. Anything that doesn't comply w/ 2000+ should be rewritten/reinstalled/replaced.
DO YOU HEAR ME?!?! YOU GRAY-HAIRED STUFFED SHIRTS IN YOUR CORNER OFFICES! GET A CLUE!

Sorry for the rant. I know many of you are thinking...."Go Linux" or "Thin client". Go0d fucking luck with PHB that can't even navigate his own "Start" menu, nevermind the comprehend the benefits of modern offerings.

I love it.

[ninejaguar]

A Perfect example for corporations. And, they call the GPL a virus. M$ is the carrier of the freakin' black death, and its proprietary software should be avoided like the plague it is.

Re:Im as quick to Bash MS as the next guy but

[SN74S181]

Any mention of Apple Computer that's less than glowing gets marked down these days. The crowding onto the 'Anything but Microsoft' wing of the Slashdot complex by Mac heads was about a year or so ago now. It coincided with the new Apple sections on this site.

Apple is no longer to be seen as the litigious closed-source company who championed the look-n-feel lawsuits in the 80's and tried to limit and control whole User Interface concepts, who the whole geek community hated with a passion. No, they're now a fine company, even under the same rather slimy management.

Awhile back it was starting to look like hAndover was going to be purchased by Apple Computer. That doesn't appear to be the case any longer. Thank goodness.

no way to tell

[Build6]

No way to tell if it's really "impossible" to do it, or just "nobody in MS team can see a way to do it" (I'm not going to suggest that MS isn't interested in keeping NT4 useable in order to drive people to upgrade and pay more $$; however I do find it interesting that they've refused to roll up all their post SP6a + SRP patches into one easy-to-apply package). MS does not have a monopoly on smart people. It does have a monopoly on the source code... Anyone wonder if the source was available someone would have piped up and said "no, you CAN fix it by ..." ?

Use what works ...

[StupidKatz]

... and that's fine. If NT4 is filling the role you want and you have no need to expand any time soon, then great. Leave it at NT4.

Only problem with that is detailed by this story: when a vuln is discovered and does affect your server in the future... you're screwed. :)

It's not the number of releases....

[Kjella]

NT4 came out in September 1996, just three months after Linux 2.0. The last 2.0 version is 2.0.39, which was released January 2001, over two years ago. Both groups have moved on, and aren't willing to spend much effort on the old versions.

If I install a machine with 2.0.39, is there any known big vunerability? If one was discovered would there *then* be a 2.0.40? With free software there's not much interest in backporting features, since upgrading to the latest version is free, should you need those features.

Anything that has outlived it's time as the mainstream stable branch wouldn't normally be updated except for security fixes, so I expect both 2.0 and 2.2 to have very slow release cycles now. Unlike Windows, where you expect some feature creep (for example DirectX upgrades) without having to pay for an OS upgrade.

Anyway, this isn't really about that either, but it's about the EOL date Microsoft has set. What do you think would happen if RedHat said "Uh RedHat 8 is fundamentally flawed, so we won't fix this bug even though its still under support. Block this service, or upgrade to RedHat 9, oh and you'll need a new support contract for that version." Would you find that acceptable?

Kjella

linux

[upt1me]

...it is also advised you switch to linux.

Except

[Snaller]

A friend bought the pro version of zonealarm for an NT server ... it kept crashing.. so he went back to the free version - cool...not.

So What?

[Jim_Hawkins]

Okay, so it does suck a little that Microsoft is not supporting their software before they officially said they would stop supporting it.

However...

NT? That's like the 95 of the NT Kernel. Please move on...there is nothing else there. Microsoft seems to realize this. They're just trying to kill it off. (Much like they are working to kill of 95/98/ME by writing applications that DO NOT WORK for those systems. Ex. Office 11)

NT 4.0

[csis]

This may not be popular but I was never a fan of win95/98/me to many problems NT 4 was the biggest step windows ever made. I worked with it a bit today and after about sp3 their was really nothing wrong with it. I have many customers who have been using it for years and lots that really would have no benifit to upgrading. It really was the last really good change microsoft made and was a quantum leap over win9x.

If your still confused as to why fix = screw it

[SlimFastForYou]

Quite frankly, Windows NT 4 is why spaghetti coding is BAD. Earlier operating systems created by Microsoft show lack of focused planning and eagerness to create something new. I supposed the debugging/patching team finally had the last straw and had subsequent OSes built with more stable kernels. Developers: Always comment your code and begin coding with a well-thought out plan. Even with RAD, know what your doing before you start!

I remember the days of the antitrust suit against Microsoft... it was because everything was too integrated. Microsoft swore up and down that their severe integration was good. You decide that for yourself - especially in light of the current situation.

Although you may think I am simply another Linux proponent, I do not believe that a flaw would be simply unfixable with Linux. Distributions are highly modular, and although spaghetti code is inevitable, it is minimal in the Linux kernel and important services - namely because hundreds, perhaps thousands of developers contribute and sloppy base code is not an option. In no way am I saying Linux is for grandmas, however I would never entrust my business/server to Windows. It simply seems imprudent.

Don't fix if it isn't broken

[slaida1]

In this case, even when NT4 seems to be terminally broken, there's no reason whatsoever to believe that 2k/xp aren't even after MS has provided it's stinky useless patches for those.

What's the point of MS's pro-secure(haha) stance if it's unwilling to patch even one of it's products so long as it takes to make it bulletproof? NT4 is old but proven and been around so long that seems foolish to throw it away and bring in new OSes with new flaws. Doesn't help much if 2k/xp are "based on NT technology" because at the same time the get bloated with all kinds of new stuff.

One thing MS can't do is keeping it's OSes simple. Unfortunately simplicity is one of the requirements of secure software.

Take your time and plan it

[SgtChaireBourne]

Interpret the premature EOL as a heads up. If the DRM planned for Office2003/Server2003 had already been implemented in NT, there'd be no choice but to pay, whatever the price.

It's not a matter of if you must upgrade, but when. However, realize that buying new products from the same company will not necessarily protect from this happening again. It would be a bad idea not to use the situation to explore options. Many are making the move.

There may be some ideological reasons to try Microsoft's server experiments, but no technical ones. Even the ideological ones don't float: no matter how much you admire Bill G's enormous personal wealth, giving him more of your company's money is not going to make you rich(er).

So many corners have been cut on service and products that it looks like Microsoft may not live out the summer. WinNT and other legacy software can keep running with the help of work-arounds as long as no one was dumb enough to sign a subscription.

Re:ZoneAlarm .... We still use Win95!!

[catch23]

It's pretty amazing, but the hotel company that I work at, 95% of the users still uses Windows 95, an 8 year old operating system! It really becomes a problem when software developers write applets that require Java 1.4 and 1.4 doesn't support Win95. Yeah, the applets don't even run under Win95. Surprisingly enough, they have decent hardware here (Pentium 4s) but their operating system is about the oldest thing here.

Re:Thanks MS, steal DCE's port and make it insecur

[Some Bitch]

Change your first period to a comma and your third to a semicolon if you wish to be pedantic about the grammar of others ;)

how it is in other areas

[hany]

Well, if bank/shop/... says that they are open till 18:00 and you walk in say at 17:59 they ussualy does not throw you away just because your quite ussual request may take longer than 1 minute to process.

Best examples are bars - if you had come when it was open you may well end up being there even hours after official closing hour if you are "making business" with bar. :)

So, such cases IMO pretty clearly illustrate how each business value their customer.

not true

[rastos1]

>That works no matter what

You got in Informative?
I did some development of NT services, spooler modules and such, and I can tell you that this is not true. 1st it is difficult to kill process owned by SYSTEM account. If it is a service, you can stop it - if it is not hung. If it is a system process and it is hung/consuming much resources or is not a service, or is owned by not your account, it get's pretty resistant to such attempts. Sometimes you can attach by debugger and kill it - but not always. What works for me is Process explorer

my solution

[erikdotla]

I'll set up a Linux firewall, it's the only reasonable option. It's fast, easy, free. I won't buy new 2K licenses to deal with this - I'm definitely not upgrading six NT servers, buying a new version of our $10,000 accounting software to work properly with Win2K, or upgrading Exchange 5.5. I just won't - not because of this, anyway.

MS will never see another nickel from me for as long as I live. I understand the EOL issue, but EOL doesn't exist with open source, and MS simply can't compete with that concept.

I hate this business sometimes.

Translation . . .

[Dausha]

What Microsoft means to say is that it previously introduced a flaw to bolster later excuses for not supporting legacy software, thus pressuring businesses to invest in the next 'buggy' that comes along. Time to ramp up the marketing for 2003.

Re:Done supporting it? Release the code!

[surprise_audit]

Yeah, release the code - except that if there's still other security holes, they're likely to be exploited after hackers review the code. Saying that folks will release patches is all very well, but someone still needs to control the code to make sure trojans are not introduced. Maybe M$ could do that, out of the goodness of their hearts...

Besides which, the folks that haven't upgraded to something else are still not likely to upgrade, for the same reasons. They'll just be more vulnerable.

BTW, does anyone know if the US Navy is still using NT servers?

Personal Favorites....

[kalimar]

Personally, I've had great experiences with Tiny Personal Firewall.

http://www.tinysoftware.com

Same thing regarding OS...works great on 98, 200, XP. Same thing regarding application limiting. Also does nice things like MD5 sum checking to see if an application has changed and then prompts you if you want to accept the new application.

Apple is even worse

[xpromache]

They refuse to release samba and openssl patches for their 10.1 server forcing users to upgrade to 10.2.
And this is after only one year!

Re:Apple is even worse

[Scudsucker]

umm that link is for a system enabler for the Mac II, don't see samba mentioned anywhere....

Re:Apple is even worse

[xpromache]

:(
the correct link is http://docs.info.apple.com/article.html?artnum=120 199

supporting old stuff

[geoff lane]

In other areas, say cars, even if the maker drops support it's simple and legal for a 3rd party to do maintainence (though not for much longer if engine management becomes totally s/w based and DCMA remains in force.)

In closed source software, when the supplier drops support you are fscked. Even if you can find someone with the skills, the components are not available and you can't even look at the broken bits to see how to make new ones.

Re:Done supporting it? Release the code!

[Angry White Guy]

Hmm, I never thought of that. And even if they did release the code, they probably would still own it.

Long term customers?

[silverhalide]

I know the software industry isn't really cut out for this, but why the hell can't they make a solid product and support it indefinitely? If it ain't broke, don't fix it! For example, my father's company still runs a DOS application programmed in the late 80's that is STILL SUPPORTED. It works *perfectly*. If it aint' broke, why fix it? The major problems we run into are because M$ forces us to upgrade operating systems ever 4 years and getting the DOS app to work again becomes increasingly difficult.

We are seriously considering a platform change to linux.

What incentive is there for a company to make a sometimes multi-million dollar investment in a product that isn't guaranteed but for four years? My uncle runs a manufacturing plant, and has machines in there built in the *1920's* that are still on the line. Whenever they break, his shop fixes them now (see an open source link here?).

Get with it Microsoft. Build a product for companies to use long term. We don't ALL need the latest 'features'.

You obviously didn't either...

[Svartalf]

The EOL for NT4 Workstation is in June. This isn't June, if I'm not mistaken, nor is it June for another couple of months. Furthermore, NT4 Server has a much longer lifespan than Workstation does.

It, according to MS, is still supported.