Microsoft's Security Report Card

Decaffeinated Jedi writes "In January 2002, Microsoft launched an initiative called 'Trustworthy Computing' aimed at building better security into its products. It's now two years later, and News.com serves up a report card evaluating Microsoft's efforts. Kevin Kean, a group manager at Microsoft's Security Response Center, points out that customers are better off now than they were before the company made the move to refocus on security issues. An analyst quoted in the article, Stephen O'Grady, agrees that he would give Microsoft 'improved marks,' but also notes that the company is not yet where it needs to be in terms of security. He goes on to suggest, however, that 'the numbers indicate that they are at least taking it seriously.' It sounds like Microsoft might have earned itself an Incomplete on this report card."

Comments

Let's be honest

[ObviousGuy]

Is any software really at the point where we can install it and forget about it?

Security is a job for all of us, not just Microsoft.

As long as hackers out there have the tuits to break into systems, security is everyone's business.

Re:Let's be honest

[bryhhh]

I think that it is great that less critical problems are being found now then with Windows 2000, and I hope the trend continues.

The quantity seems to have dropped, but the severity seems to keep increasing.

Just look at the havok caused by the recent RPC worms.

- I'm also in disbelief that Microsoft still haven't released a patch for the %00 bug in IE that allows spammers and malicious web admins to obscure the real URL the user is being directed to, perhaps Microsoft don't see a bug which could be used to trick people out of their hard earned cash as a Critical problem?

Re:Let's be honest

[SlashDread]

I have to give MS two thumbs down.
Sure, the security is improving, the SUS server is a nice tool.

But what bugs me beyond belief is the amazing lack of information it gives.

SUS out of the box does not:

- Client cannot be controlled, you cant use Windows update to update your system NOW, you will have to rely on reghacks, and stopping and starting services, to make sure your system will be updated in approx 15 minutes..

That is crap, Im the sysadmin, I want to make sure that the system is updated NOW.

- The SUS Server has no simple reporting -who-, -when- and if successfull or not, of events like a client connected and pulled updates.

This is even more crap, I cannot scan the server for activity from clients, unless I go digging in cryptic log files, which are not identified in the MS docs about SUS anyway.

Sure, there is a smart guys script that does that, which involves installing stuff for IIS, without properly explaining how and where. Again unacceptable.

It is that Nachio blasted our network away that we HAVE to be protected so I use it.

But Im very dissapointed in the lack of control and information it gives.

THATS my gripes with MS, stop listing to the damn users already!@ And start listing to the sorrow admins, like me.

NOT just for security in press, but for the daily lives of their admins. After all THEY need to understand whats happening, THATS the basis of REAL security.

"/Dread"

Re:Let's be honest

[houghi]

Updates are usually still handled manually with apt-get update/upgrade. RedHat has live notification, but it's still done manually for the most part, which slows down the process. There are wasy of caching apt packages for internal use by making your own apt-source, but they can be difficult to implement. You can do similar things with RedHat, but there isn't a lot of work being done in this area.

SUSE has the possabilaty to do automated updates. Just put them in a crontab. I asume this can be done by other distro's as well. You apperently aplaud the fact that Microsofy has automated updates and there is nothing wrong woth that. Most Linuxusers however would like to know what is being installed on their systems and are very afraid of some automagic system that will install stuff on their boxen. As you point out there are systems to do updates under Linux. The question remains if this should be on by default or not.

On one side we have the fact that we do not want Microsoft to do anything on our system, because they are the evil emire. On the other side we want them to have automated updates. Choose your poison.

Re:Let's be honest

[tres]

Updates are usually still handled manually with apt-get update/upgrade.

Sorry, but if I really felt stupid enough, I could have cron job'd my portupgrade, apt-get, urpmi or up2date long, long before Microsoft thought it was a good idea to push updates to clients; we could have been doing this back while microsoft was trying to convince the court that a HTML interface was the only way that they could update their OS.

You seem to have gotten lost somewhere along the way--updates are manual for a reason. The prudent admin takes the time to know what vulnerabilities or potential problems are going to affect their system. The prodent admin knows whether updating is necessary and what potential problems it may cause. Availability of new code doesn't mean that updates are required.

Automating updates isn't "progress." It isn't even hard.

Open Source developers might "hug" C, but they are much less aflicted by language myopia than are Windows developers.

What Windows IDE will do syntax highlighting for Python
How about PERL?
or PHP?
or Ruby?
or any of the other numerous languages that are not only supported, but are afforded real, working tools natively supported by the environment.

I think your point is something to take very seriously; but I don't see the Open Source community sitting, waiting for MS. Ultimately the idea is fallacious because it takes for granted the idea that new == better. There are many, many reasons to stick with something that works.

Words of wisdom that have been around much longer than you or I: "If it ain't broke, don't fix it."

Re:Let's be honest

[AbbyNormal]

Not an m$ fan, but there are a few points I'd like to make.

. Hence why .net can't be used by linux programmers Huh??? Um...what about Mono?

Blaster Non .NET signed code, what's your point?

Microsoft's code signing as a way to enact DRM What about signing Java applets for security?

MS's software is only used on desktops because everyone knows it. Um, a majority of enterprise environments that I work in all use Win2k servers to a good degree of success. (Some of the logic to use Win2k is pretty lame...most could easily be replaced with Linux based systems. )

Ms's software was designed for idiots, Why is this bad? Going back to your previous argument, are your "ma n' pa" linux gurus? Are the majority of enterprise/home users, gurus? This is the very elitist attitude that ticks me off. I see it routinely on newbie bulletin boards and chats...it really chaps my you know what. I almost completely switched over all of my systems to FreeBSD for this very reason (support base).

I believe most of your comments were rants against the evil Empire, rather than anything of content.

Linux needs to START catering to "idiots" if this is going to be the "Year of the Linux Desktop". Not all users and even developers are masters of their operating system (I'm going to get flamed for this, but they really don't have to). A user/developer needs to be able to adopt a Linux system and then say: "Hey you know what would be cool" and then proceeds to build a couple of apps

I think that is when Linux will really take off. A few of my developer friends (Perl mongers) refuse to run linux because of the amount of time it takes them to do simple stuff (Plug-in cameras and other peripherals and have them instantly recognized). I can see their point sometimes, when I'm trying to get a pacakge to be installed, only to be told I need four other updates in order to install the first.

The post was right thought:Linux was designed for people who know what they are doing...

That needs to change very quickly.

There are a lot of flavors of Linux out there that I believe are on the right path (I, for one, like Mandrake...and previously Red Hat).

Wait a minute...

[AstrumPreliator]

Does anybody remember the article where old Microsoft basically said it was the end consumers responsibility to keep things secure and not the developers? I'll have to find the article, but it's only a couple months old or so. I think the "report card" should be re-evaluated knowing that Microsoft really doesn't care about security like they claim to.

Re:Wait a minute...

[JanusFury]

It is a responsibility of the end-user to keep a computer secure. If you are in control of your PC, it is your responsibility.

If the end user was to grant full control over his computer to Microsoft, then it wouldn't be his responsibility to keep it up to date.

'Secure' technlologies like the DRM used in iTunes' M4P and WMP's WMA files are exactly that - granting some of your control over your computer to those companies in exchange for being able to get music files.

In this case, by granting some of your control over your PC to Microsoft (allowing them to automatically update your PC with new fixes) you can gain more security.

But do you really want to leave your security and privacy in the hands of a corporation? Or would you rather spend the time to do it yourself? You can't have it both ways. Either you keep your PC secure (either by updating Windows often and using a firewall and not visiting random sites and opening random attachments, etc., or by switching to a more secure operating system), or you let someone else do it for you.

MS improving

[Esteanil]

That MS is actually improving security is good for all of us.
It's about time, and they still have a long way to go, but increasing security gives less room for E-mail viruses, worms and other network-hogging exploits.

Hmm... Any chance of a class-action suit from people who do NOT use Microsoft, addressing the way their lack of security has wrecked important services for non-MS users?
After all, those of us who don't use MS have never accepted their EULAs, but they've still wreaked havoc for our systems.
Could at least lead to an even further increased MS focus on security, which would help everyone...

They've still got a ways to go.

[Anonymous Coward]

If you don't use Windows Update to handle your security patching, it's quite a bit of work to patch a system.

Just trying to figure out what needs to be updated is a pain in itself, unless you figure out that you need the MBSE. Then you need to wade through the security bulletins, which sometimes contain the patch (in varying locations of the document and with no fewer than two pages to go through to get to the patch) and sometimes tell you to go to Windows Update. Not an option when you're trying to cut a disc for a client, or are dealing with an environment that doesn't allow Windows Update for security reasons.

Grabbing MBSE and every available patch from the website and applying said patches to a fresh Windows XP installation took about two and a half hours, and was incomplete (MBSE reported four patches that weren't applied). Windows Update isn't appropriate for a fresh install because of things like Blaster that will automatically infect the system upon connection to the Internet.

Then, there's all the defaults they've got to have their system phone home, such as sa.windows.com for searches, IE automated updates, WMP automated updates (including DRM), ntp.windows.com, Automated Windows Update. Locking down a Windows XP system is an exercise in frustration.

Trustworthy computing? Methinks not. Linux/BSD/OSX may have their myriad security and design flaws (except OpenBSD, which has yet to have a remote root compromise), but Windows XP holds a special place in my heart. Microsoft has admitted they've got an issue with security, which is a good thing, but now they should really address it -- they should be doing everything possible for the user to take control of his/her system, instead of heading the other way.

Re:They've still got a ways to go.

[Clovert Agent]

If you don't use Windows Update to handle your security patching, it's quite a bit of work to patch a system.

Uh-huh. And you use what to update your Linux systems? Do you manually visit every relevant website and download updates, compile and reinstall everything, resolving dependencies by hand?

Or do you use apt, up2date, emerge...? I'm not clear on how this differs from Windows Update, with the obvious exception of altered EULAs and similar nastiness. There's no excusing that.

My point is that updating any OS without some sort of frontend to do the legwork is horrible. Bash MS, sure, but bash fairly. They've got a decent-and-improving frontend to their patching, a variety of tools to check your network for patch levels, and so on. Good enough? Depends on your environment, but it's a LOT better than nothing.

OK, I'm VERY sorry but...

[TheMMaster]

I am not quite sure if this is off-topic, but I'm going to take a gamble here :)

""There is an order of magnitude--more people using Automatic Update and downloading patches," Microsoft's Kean said."

This would be the system that gave the world the "DRM or be unpatched" situation, right? how trustworthy.... changing functionality along with a "security" patch

I know that bashing microsoft is a favorite past-time here :) but I'm really bothered that this "report card" doesn't include anything from the myrad of unpatched internet explorer holes and the way microsoft relicenses PATCHES... I mean, really EULA's for PATCHES? what if I DON'T agree???

really HOW is this "trustworthy" ??

I am REALLY impressed by the stupidity of these "reviewers" and how easily people forget these sorts of things... cudos to microsoft PR... AGAIN :)

I REALLY needed to get this of off my chest :)

Re:OK, I'm VERY sorry but...

[Tim C]

Microsoft finially pushes the final patch that makes it impossible for your windows system to play ANYTHING not WMA AND signed.

And you know as well as I do that there would be an absolute uproar should that ever happen. MS are big, but they've been swayed by public outcry before - just look at the extension of support for Win98 as one example.

Besides which, as soon as the story hit, people would simply stop applying that patch - while some would almost certainly reinstall the OS to rid themselves of it if need be. I really can't imagine such a thing lasting very long, were it to happen.

in fact in the eula you had to agree to get the patch I mentioned before, even says they have the "right" to do such a thing.

I can't imagine that sort of thing standing up in court though. Sure, perhaps the EULA could be interpreted as allowing MS to do it, but that doesn't necessarily make it binding. EULAs aren't contracts, but here in the UK at least, you can't get away with putting just anything in a contract, and I would imagine that an EULA is the same. For example, just because I sign an employment contract with a clause in it that states that should I ever leave, I have to give them my firstborn, doesn't mean that I'd have to honour it.

In fact, if you read most EULAs thoroughly, you'll see something to the effect that should any clause be found to be unenforceable, that won't render the entire agreement void. That would imply to me that a court has the power to throw out terms it deems unreasonable. I would very much expect that enforced manipulation or deletion of software and data would be found to be unreasonable, whether the EULA allowed for it or not.

Re:Microsoft Security

[bryhhh]

Microsoft Security. What's it all about?

Well that's an easy answer. It's all about educating 'users'.

1. Don't open emails unless you are certain it is from a trusted source.

2. Keep your system patched

3. Ensure you have Anti Virus software installed, and up-to-date.

4. Use the firewall built into XP, or install one of the many free (for personal use) 3rd party firewalls, or even better look for an ISP that firewalls sensitive ports for you.

This is all basic stuff, but many home users don't really give a stuff if their machine is taking part in a DDoS attack, as long as they can still get to their email, view web pages, send instant messages and download pr0n (actually - forget the last one, that's us geeks)

Re:Can't get into Yale with this...

[mumblestheclown]

And the sad thing is, your gratuitous cheerleading will probably be modded "insightful."

Look, I have on my desk a rock. It has never been broken into by hackers. It rejects all spam sent to it. It was free.

And yet, somehow, I don't think the world will soon use rocks instead of computers to connect to the Internet. If we go with the premise that OSS is 100% secure, this doesn't mean that it's any better a computer system than this rock per se. The tiny end-user market pentetration of OSS despite its free-as-in-beerness suggests that the moon is not yet close to being colonized by hobbyists.

That is why you will never be Bill Gates.

[Anonymous Coward]

Why work on the Model-T, when you can build the next generation automobile. They have to be competitive to stay in the market place. If they kept patching Windows 3.1, where would we be?

This happens because of competition. If people were looking for more secure systems, then M$ would invest in it.

Regards,

Re:Let's Compare

[Anonymous Coward]

Ah, package managers.. in practice the very essence of vendor-tie-in from the people who nominally claim to despise it the most!

And I suppose that you're one of those people who slams microsoft for stopping support for win95.

updating my copy of windows takes about 3 mouse clicks. 1/2 hour a week vs 3 mouse clicks.

80::20 rule applied to Microsft Security

[leoaugust]

"Customers are better off today than they were a year ago, and they will be even better off in the future," said Kevin Kean, a group manager at Microsoft's Security Response Center.

What a well worded articulation - almost Greenspan-ish like in a sense that it looks like he is saying something, but you can never hold him upto for "whatever he is saying." And I think this quote summarises the whole article well.

It is 80:20 rule or in Microsoft's case 40:60 rule. In the first year you move 40 % of the distance towards the the Security Goal-Post. So, "Customers are better off today than they were a year ago, . In the next year you move another 40 % towards the goal. So, "Customers are better off two years from today than they will be a year from today. . An so on and on ...

Now if the security Goal Post moves and you find yourself heading in the wrong direction, as it always does in Real life, you can frame your message as follows. You are now 60 % away from the old place. So, "Customers are better off today than they were a year ago, . In the next year you move another 60 % away from the old place. So, "Customers are better off two years from today than they will be a year from today. . An so on and on ...

So,

• "Customers are better off today than they were a year ago,
• and
• they will be even better off in the future,"

And how can you be wrong when you say it the way it is said. What a well worded articulation.

Improved marks!?

[MasterSLATE]

I'm sorry, but after such large-scale security issues like Blaster and Klez, I don't think it's appropriate to give them any sort of improved marks. Sure, the patch might have been out.. But security is also about education.

Give them an "F" on the report card

[QuantGuy]

Three observations.

• First, Microsoft gets no points for "taking security more seriously," because that's a DUH! instinct. Consider that large parts of the public sectors in Israel, the UK, India, China and Germany have decided to go the open source route -- in part because of security fears. Consider also that Microsoft's deferred revenues (new contracts!) were off by ~$600M last quarter; Connors specifically pointed out that this was because "salespeople were helping customers deal with security." Ballmer must be crapping himself. So what we're seeing is a survival instinct, not shrewdness, on Microsoft's part. So, no points for that.
• Second, the scourge that is the Windows security problem has reached the level of pandemic in 80-90% of all companies. The patch-and-pray vicious cycle is overwhelming everything else. For IT staffs, it's Love in the Time of Cholera out there. As we speak, the spreadsheet monks at Gartner and IDC are probably flailing wildly as they attempt to update their TCO models.
• Third, I resent the fact that Microsoft has commingled the need to fix a serious quality and customer satisfaction issue (shoddy code) with the implementation of market-preserving technologies (e.g., Palladium^H^H^H^H^H^H^H^H^H er, the "Next Generation Trusted Computing Base"). Business model enforcement through cryptography should not be confused with security.

Re-writing Windows from the ground up seems to me to be the best remedy. Forcibly breaking backwards compatibility should be a design goal.

Re:Can't get into Yale with this...

[Penguinshit]

Almost all of whom contribute their work for free, as in unpaid.

I don't know about your math, but last time I checked, "free" was considerably less than "~$38 Billion".

Confusing figures...

[Polkyb]

It says here, Mr Gates, that you released 32 security advisories and 21 vulnerability fixes for Windoze 2000 Server in the first six months, yet for Windoze 2003 server you 14 flaw fixes and 6 critical issues...

Would this be because W2K3 server is based on Windoze XP code and that the majority of bugs had been ironed out already in the months between the releases?

hmmmm....

Re:Microsoft Security

[Afrosheen]

1. Don't open emails unless you are certain it is from a trusted source.

That's the big problem here. When your email client, by default, displays HTML and executes macros and scripts, you're extra vulnerable. Even if it's from your pal Bob that you've known for 40 years, his computer may have been owned by a worm and just emailed all his friends seeking to propagate. You say 'hey it's from Bob, I trust him' and open it. Boom, you're owned too, and may never know it.

Bad design is bad design, there's no two ways about it.

Re:Microsoft Security

[WIAKywbfatw]

It's an oxymoron.

Seriously though, it's good to see that Windows 98 support has been extended. I shudder to think how many compromised Windows 98 systems there are out there now, let alone imagine how many there would be in 6-12 months time once vulnerabilities that hadn't been patched before support was dropped began to be exploited in earnest.

Microsoft Culture

[gen2002]

Although Microsoft is knowen for its security problem the individual microsoft programmist is a good one . Microsoft don't make secure products because the programmers are directed from the menegment to prefer nice Shiny GUI instead on security.

Yeah, right...

[pjrc]

If Microsoft were really taking security seriously, why would they not yet fix the IE phishing (URL obfuscation) bug. This is such a simple thing to fix, and it has been public knowledge since at least December 9.

For an indication of just how seriously Microsoft is taking security, rather than quickly fixing the bug, Microsoft is advising users to manually type URLs rather than click on hyperlinks. Well, of course, only malicious hyperlinks... but because of this bug, a scammer's link appears to be to the genuine website. Of course, they offer other gems, such as a chuck of javascript you can run to tell you the URL of the website you're actually viewing, since their software can't be bothered with giving you a correct indication. Or you can launch notepad and copy a shortcut. Yeah, everyone should have to go to the trouble of doing these steps, because they couldn't manage to get a fix out quickly (within the 1 week between the disclosure and scam artists starting to use it to trick end users to disclose sensitive indo). Microsoft also suggest viewing email at text-only... effectively reading all the html source, and changing to the high security profile )turning off all the dangerous technologies they have "innovated" over the years: ActiveX, scripting, etc...) not because they will help you avoid being tricked, but because it will limit the damage.

All because they couldn't fix this simple problem quickly.

Yeah, that's taking security seriously!

Re:Yeah, right...

[Tim C]

All because they couldn't fix this simple problem quickly.

Interesting; I take it that you've seen the IE source code, then? I mean, you have to have, to know that it's a simple problem that can be fixed quickly, rather than something buried deep in the bowels of the code in a module that has hundreds of dependencies - or even something buried deep in the bowels of the OS/MFC, with thousands of dependencies.

No, I don't think it's likely - but you're spouting supposition as though it were gospel. Unless, of course, you've seen the source.

Yeah, that's taking security seriously!

Well, rushing a patch out as fast as possible isn't taking security seriously either, if that patch introduces another exploitable bug.

Seeing it in another perspective

[euggie]

I am reading a lot of MS-bashing here. But let's take a look at some facts here:

Consider a pretty standard setup--the OS, plus ftpd and httpd--here's the count of errata advisory between M$ Win2k Server and RedHat 9:

Microsoft: 1, for the botched FrontPage Extension patch released in November.
RedHat: 4, for the following:
1. Dec 2nd: Updated 2.4 kernel fixes privilege escalation security vulnerability RHSA-2003:392-05
2. Dec 16th: Updated lftp packages fix security vulnerability RHSA-2003:403-07
3. Dec 17th: Updated httpd packages fix Apache security vulnerabilities RHSA-2003:320-09
4. Dec 24th: Updated 2.4 kernel fixes various bugs RHBA-2003:394-08

Not to mention I will need to think about what to do when RH9 becomes EOL in April.

Interesting.

I am by no means by pro-MS here. If I have my way it'd be all qmail and publicfile. In fact, I don't have the balls to put my company's Exchange server directly on the 'net; I put it behind a RedHat box running perdition, and have qmail as the MX, behind an IOS IDS/FW.

Trust needs to be earned, and MS is slowly earning mine in the security front. I don't trust MS software enough to stick them directly on the Internet yet, but they did earn my trust to let Windows Update automatically sort things out: Not a glitch in the last 18 months.

The fact of a matter is, with a little clue as a admin, Windows can be made pretty secure. Being clueless, Linux can be made to be a big wad of swiss cheese.

We Linux and /. crowds--me included--can be an arrogant and blinded bunch. Sure, we can sit around bashing MS and fool ourselves on how insecure Windows is, but that doesn't accomplish anything. MS is catching up /fast/; that's fact. If we remain complacent, we can fall behind sooner than you think.

Now that you have the facts... Go ahead, mod me down.

Re:Seeing it in another perspective

[Oriumpor]

Well when Microsquish made the switch to akamai recently for their software update hosting they broke many users ability to update and gave no release on how to fix it. Yes sure, it was just an issue of changing the default url to httpS instead of http and accepting the new certificate, but how many joe blows are going to know that? And no, an obscure technet article referenced by a letter and a number does not count as a release, especially in a service as important as software update has become for M$.

Even if SUS works properly, what is the purpose of needing to reboot every system that is updated. Can't this be taken care of with minimal (3-6 seconds) downtime while a service resets?

We all know by it's very nature Linux is more secure than microsoft. The sheer number of vulnerabilities available is not neccessarily a good measure of the actual security of the system. The measure is properly the number of vulnerabilities successfully taken advantage of easily and massively.

Let me sound off for a second here on the major issues I personally have with MS:
CODERED
NIMDA
MIMAIL
BUGBEAR
KLEZ
NACHI
BLASTER

Good security practices, updating regularly and keeping up to date virus protection is an important part of stopping the above garbage from getting on your network. EVEN then, the affects of the above will still cause you downtime since your provider will have to scramble to deal with all the there-after DDoS.

The following is reason enough to be extra wary of any microsoft product security wise. Believe it or not, Nachi apparently SAVED M$ ass when it came to MS-Blaster. The number of source addresses scanning for 135 dropped by nearly 80% in these first weeks of 2004. AND there are STILL code red systems out there attaching to my Apache server occasionally. I sure don't see a massive SSH/Apache Code Red/Nimda style worm topping the bandwidth charts.

The duece you say, imagine that the web browser with 70% market share doesn't have a massive network-screeching-to-a-halt worm spreading with free reign?

Who cares anymore, it's been 8 years GNU/Linux+Apache+SSH has proven itself the most secure and reliable system for Web-Serving and MySQL+PHP is fast overtaking MsSQL+ASP as the most popular method of dynamic content distribution.

Once I start seeing massive changes to the netcraft survey, then I'll believe Microsoft has done enough to curb their Virus problems. The proof is in the puddin so to speak.

Re:Microsoft Security

[bryhhh]

umm how about switching to a more secure OS so you don't have to put up with all that BS.

Your choice of OS doesn't make your system secure. What makes a system secure is a user that has a clue.

In the past 3 years I have only used linux at home. Never had to worry about viruses, nor spam (yeah, that's right, I averaged 2-3 peices a year), nor spyware (spam maker), nor adware (spam maker), nor web browsing issues (IE security flaws). Now I spend more time cleaning up all this crap then anything cause I have to have a winblows box at home so i can do .net crap

Like you, I've not had a Virus in countless years. I don't get spam, My system has no spyware, or adware or web browsing issues (Firebird rules!), and I run a Windows box (Prerequisite of being a Windows Sysadmin). Had I have been an uneducated user, I'm sure I would have fallen fowl of most (if not all) of the issues you have listed.

But at least I never had to reinstall my entire OS because a windows update failed (which just happened to my brother yesterday, and I have seen it several other times, too!)

There are aproximately 3000 Windows PC's on the university network that I admin, and I don't see Windows Update issues that you see. Occasionaly a patch will fail, but if you know what you doing it is quite simple to fix, without having to resort to a complete re-install. Reinstalls are for failed disks and compromised machines.

So, no, it is not just about educating users, it is about makeing a more secure system!

But who makes the system secure? Why _educated_ users do. - If a user is clueless, the odds are that they will be compromised, regardless of what OS they choose.

Windows is crap,when will the world realize this?

I'm beginning to think you are a troll.

Glass Houses?

[gregarican]

This honestly isn't intended to be a troll, but I'm sure it will probably be modded as such. Microsoft has had a slew of issues trying to patch apparently flawed reused code (since all Windows versions are built on top of each other's code, with reportedly Longhorn being the first "from scratch" Windows version). The fact that the same buffer overflows are so pervasive in their product line is inexcusable. Input validation and boundary checks are basics most folks learn in CS101 - Introduction to Programming. You wouldn't expect such flaws in each and every version of Windows software.

All of that being said, no technology area is devoid of security flaws. Look at the recent attention given to H.323 standard vulnerabilities due to default ASN.1 parsing. That affects many vendors and product lines. Today I read an ISC diary entry detailing a couple of exploits that affect non-Windows environments. Apache, OpenSSH, QMail, Sendmail, etc. have all had their share of recently announced flaws.

Of course Open Source Software *should* be more secure since many eyes can review the code as it is maintained and updated. But the fact that nevertheless there are significant flaws and exploits in this area further proves my point. Microsoft is the largest software company on the planet so of course they have a target on their back. There are no doubt many third party organizations dedicated to doing nothing but trying to break Windows in order to submit security reports. Of course there are anonymous black hats doing the same but for other obvious reasons.

If the same manpower and effort was dedicated to breaking Linux and OSS applications (which currently have much less exposure and market share) I am sure that even more holes would be poked into what most folks on this board defend as being the silver bullet against corporate greed, monopolistic tyranny, and gaping security holes.

Yeah, wait a minute!

[$ASANY]

Just when was it that "visiting random sites" or "opening random attachments" became sufficient explanations for a system going kablooie? "Well, Joe, you surfed www.turnips.net and you know it's a bad site! What were you thinking?" "Oh, my bad. Next time I'll consult the list of 'safe' sites before I go someplace unfamiliar."

We're not going to hold a software company responsible for selling a product that risks the data on your system by leaving itself vulnerable to normal user actions? What next, advisories that you shouldn't drive north because cold weather might make the wheels fall off your car at speeds in excess of 40 mph?

If I surf to a site, or open a random attachment in a viewer, and my system dies as a result, that software is defective by design. Any company that tells me I can't do either of these things with their products is admitting that they are knowingly selling defective software.

Really, though, it's the users who shell out significant coin buying products that are known to be defective that needs to change. If users won't hold a vendor accountable for their miserably defective garbage by not buying it, I guess the user community deserves all the pain that bad decisions cause. At least they could be rephrasing their complaints as "I bought a piece of crap and it exploded when I used it. I made a stupid decision." rather than "I surfed this site and my PC blew up. Bad site! Bad, bad site!"

Re:Microsoft Security

[poptones]

But that's the thing, see. I do agree that it's largley because of MS that machines are so cheap and available as they are today (although I'm not saying another MS wouldn't have come along). Without a "commodity OS" we would not have "commodity systems" and would be well back from where we are today.

Look to the past to see the future: when radio first began it was completely unregulated because no one knew exactly how it even worked. Even after radio receivers had become affordable enough to enter "middle class" homes radio was still largely unregulated - until it came to the point you had neighboring transmitter stations engaging in kilowatt battles for the same frequency space because "that's where people were listening." The bands became increasingly crowded because ANYONE could rig up a transmitter and have at it.

What you and I have come to expect from the PC has been shaped by our participation in the "invention" of it. But a vast majority of users - even users who witnessed that invention process - have no ethical relationship to that community. They no more expect to have to defend their personal computers from attack in their own homes than they expect to have to defend themselves from personal attack in that same space. Even when it comes to "attack" from communications mediums like TV and radio and telephones.

THAT'S why the modern PC is still not what it needs to be. not for grandma who just wants to check her email and surf the net. If grandma wants to play games there's nothing at all wrong with being able to download free games from a website - but there absolutely SHOULD be mechanisms in place to prevent grandma's computer from requiring a repairman's attention simply because the game didn't "like" her computer. Yes, it would take a lot of clock cycles to have this kind of protection. And yes, it would impact performance. But clock cycles are ever increasingly cheap, and there's nothing to prevent grandma from learning HOW that box works and then delving deeper.

The solution IS technological. the internet is not "broken" but it still needs a way to be "fixed" at least as perceived by the majority of inexperienced home users. And it better come quick, because the lawyers and lobbyists are lining up their constituents.

You should not have to know how to build a radio just to be able to listen to music. And you should not have to know how to "install a program" and "configure user identities" just to be able to surf public spaces, correspond via email and chat, play games and watch movies and listen to music without being accosted or verbally abused in your own home.

If we don't fix it, the politicians will... or they'll bleed us to death trying.

It's going to be a long, difficult march

[mwood]

Many of the problems have been embedded in their corporate culture from Day 1. It's gonna take a long time to train *everybody* to think first about how some new whizzy feature might work against the security of the system as a whole, especially in a place where (apparently) whizzy features are the medium of exchange, and the more you can coin the richer you are.

Re:How come we never see an OSS report card?

[MattMan741]

as much as its a good thing to see someone who doesnt blithly follow the "if i install linux the box will magically become secure" myth, there are a few reasons that OSS isnt getting this kind of attention. first off, theres the process. someone reports the problem to ms, ms denies it, someone else reports it, ms denys it, but starts looking at it. it gets validated and the maintenance guys start looking at it. eventually they find the bug and make the patch. the patch goes to qa. the qa people make sure nothing gets broken by the patch, and then it makes its way to ms update. as opposed to (worst case) someone posting the problem to the mailing list of the app, (best case) someone posts the problem and a fix to the mailing list of the app. the turnaround in OSS is much faster, patches are issued all the time, usually within hours of the vulnerability being found. compare that with the microsoft turnaround.... the second thing is that, as much as people here hate to admit it, linux related stuff doesnt matter as much. when the overwhelming majority of computers on the internet can be harnesed for DDoS attacks, the scruteny falls on the people who allow this to happen. last point, do a comparison between the number of microsoft CERT warnings compared to those of other operating systems and tell me that the scruteny is unwarrented