Microsoft's Security Report Card

Decaffeinated Jedi writes "In January 2002, Microsoft launched an initiative called 'Trustworthy Computing' aimed at building better security into its products. It's now two years later, and News.com serves up a report card evaluating Microsoft's efforts. Kevin Kean, a group manager at Microsoft's Security Response Center, points out that customers are better off now than they were before the company made the move to refocus on security issues. An analyst quoted in the article, Stephen O'Grady, agrees that he would give Microsoft 'improved marks,' but also notes that the company is not yet where it needs to be in terms of security. He goes on to suggest, however, that 'the numbers indicate that they are at least taking it seriously.' It sounds like Microsoft might have earned itself an Incomplete on this report card."

Comments

Microsoft Security

[Klerck]

Microsoft Security. What's it all about? Is it good, or it is whack?

Re:Microsoft Security

[bryhhh]

Microsoft Security. What's it all about?

Well that's an easy answer. It's all about educating 'users'.

1. Don't open emails unless you are certain it is from a trusted source.

2. Keep your system patched

3. Ensure you have Anti Virus software installed, and up-to-date.

4. Use the firewall built into XP, or install one of the many free (for personal use) 3rd party firewalls, or even better look for an ISP that firewalls sensitive ports for you.

This is all basic stuff, but many home users don't really give a stuff if their machine is taking part in a DDoS attack, as long as they can still get to their email, view web pages, send instant messages and download pr0n (actually - forget the last one, that's us geeks)

Re:Microsoft Security

[Afrosheen]

1. Don't open emails unless you are certain it is from a trusted source.

That's the big problem here. When your email client, by default, displays HTML and executes macros and scripts, you're extra vulnerable. Even if it's from your pal Bob that you've known for 40 years, his computer may have been owned by a worm and just emailed all his friends seeking to propagate. You say 'hey it's from Bob, I trust him' and open it. Boom, you're owned too, and may never know it.

Bad design is bad design, there's no two ways about it.

Re:Microsoft Security

[Anonymous Coward]

Outlook 2003 does none of those things by default. MS has learned.

Re:Microsoft Security

[WIAKywbfatw]

It's an oxymoron.

Seriously though, it's good to see that Windows 98 support has been extended. I shudder to think how many compromised Windows 98 systems there are out there now, let alone imagine how many there would be in 6-12 months time once vulnerabilities that hadn't been patched before support was dropped began to be exploited in earnest.

Re:Microsoft Security

[NemoX]

umm how about switching to a more secure OS so you don't have to put up with all that BS.

In the past 3 years I have only used linux at home. Never had to worry about viruses, nor spam (yeah, that's right, I averaged 2-3 peices a year), nor spyware (spam maker), nor adware (spam maker), nor web browsing issues (IE security flaws). Now I spend more time cleaning up all this crap then anything cause I have to have a winblows box at home so i can do .net crap >:[

Granted I kept the system patched, and used the built in firewall (switched no to yes, how hard is that? Thanks to SuSE for the easy prebuilt firewall). But at least I never had to reinstall my entire OS because a windows update failed (which just happened to my brother yesterday, and I have seen it several other times, too!)

So, no, it is not just about educating users, it is about makeing a more secure system! Windows is crap,when will the world realize this? (I'm not saying linux is the best, just better...every OS has it's problems, but windows just has the most...by far)

Re:Microsoft Security

[Anonymous Coward]

There is only room for 2 types of OS in this world:

1 Mac for the beginners/home users due to less issues and easier to use.

2 *NIX Linux/BSD/Solaris whatever, for the more advanced users, servers, etc.

There is no place in this world for MS...it has no benifits other then it has "lots of software" for it...which it didn't always have, remember. Its more expensive, insecure, unstable, resource hog, bloatware, big brother POS. Ok, I'm done...just had to vent since MS security topics always piss me off since MS never gives a crap about any of this, they just want the big $$. They only reason they rush stuff is so they can make MORE $$ on fixes then blame it on lack of time to finish the product. I mean come on, they've been "rushing" unfinished products out the door all the time, why? They are a monopoly!? That's it - their bottom line is the green back. Linux has its dedicated geeks doing it for the good of all. Mac has its following of dedicated users and have tried to do their best to please their customers (i.e. is very customer service oriented...except in lui of the news articles as of late, maybe). What does windows have? Just a 2ton gorilla in the corner if you look at the other two...nothing but bullied its way into the market and onto peoples desktops...hell, the original DOS code wasn't even Bill Gate's he bought/stole it from someone else.

Re:Microsoft Security

[Anonymous Coward]

Okay troll, I'll bite.

First of all, Mac isn't the solution. OS X is quite expensive and doesn't run on the relatively inexpensive PC hardware.

Microsoft doesn't make money on the fixes. Remember, Windows Update is free. You get the fixes for free.

Windows is simple and easy to use, but also runs on the inexpensive PC hardware.

Re:Microsoft Security

[bryhhh]

umm how about switching to a more secure OS so you don't have to put up with all that BS.

Your choice of OS doesn't make your system secure. What makes a system secure is a user that has a clue.

In the past 3 years I have only used linux at home. Never had to worry about viruses, nor spam (yeah, that's right, I averaged 2-3 peices a year), nor spyware (spam maker), nor adware (spam maker), nor web browsing issues (IE security flaws). Now I spend more time cleaning up all this crap then anything cause I have to have a winblows box at home so i can do .net crap

Like you, I've not had a Virus in countless years. I don't get spam, My system has no spyware, or adware or web browsing issues (Firebird rules!), and I run a Windows box (Prerequisite of being a Windows Sysadmin). Had I have been an uneducated user, I'm sure I would have fallen fowl of most (if not all) of the issues you have listed.

But at least I never had to reinstall my entire OS because a windows update failed (which just happened to my brother yesterday, and I have seen it several other times, too!)

There are aproximately 3000 Windows PC's on the university network that I admin, and I don't see Windows Update issues that you see. Occasionaly a patch will fail, but if you know what you doing it is quite simple to fix, without having to resort to a complete re-install. Reinstalls are for failed disks and compromised machines.

So, no, it is not just about educating users, it is about makeing a more secure system!

But who makes the system secure? Why _educated_ users do. - If a user is clueless, the odds are that they will be compromised, regardless of what OS they choose.

Windows is crap,when will the world realize this?

I'm beginning to think you are a troll.

Re:Microsoft Security

[jefe7777]

let's go further, with a geeks help. others feel free to add on.

1. Don't use Outlook or Outlook Express, I don't care what your reasons are. Don't do it.

2. Use Mozilla 99.9% of the time. Fall back to IE only for sites that absolutely need it. In mozilla disallow window/image/statusbar manipulation by the browser, as well as supressing popups.

3. Run spybot search & destroy, innoculate your machine. run a spybot host file.

4. Run AV, something other then Norton, they are the number one target now, as far as anti-anti-virus software is concerned.

5. Home users with a single computer should disable workstation and server service. Many other services are excellent candidates as well.

6. Ditch MSN messenger (and popups) and go with GAIM if you have simple messenging needs.

7. Check your startup programs once every few weeks...i.e. start>>>run>>>msconfig

8. a repeat of parent's #4, but I think the xp firewall is tripe, make it a "must do" and get a linksys type firewall device. stopping the constant hammering a little up stream.

Most average users don't know about these options, it's up to us geeks, to show them.

Re:Microsoft Security

[Tim C]

many home users don't really give a stuff if their machine is taking part in a DDoS attack

That's rather unfair - the vast majority of home users don't know what a DDoS attack is, and wouldn't know how to tell that their machine is involved in one.

Re:Microsoft Security

[jadavis]

4. Use the firewall built into XP, or install one of the many free (for personal use) 3rd party firewalls, or even better look for an ISP that firewalls sensitive ports for you.

Or, MicroSoft could just turn off the services by default.

But let's get realistic, Microsoft doesn't really have an interest in security, in fact I'd argue they prefer to keep their OS from being "too secure" on purpose.

Re:Microsoft Security

[queen of everything]

I completely agree. Why is it that people just inherently hate microsoft so much? (aside from the zealots) Its a decent OS, I wouldn't say it was the best by far, but it helped bring personal computers into everyone's home. Although one can argue how much good that did us. I guess without it I wouldn't be in the position I am today..but I digress.

95% of the people I support, all of whom use Windows (mention linux and they think you are talking about a prescription drug for cholesterol) don't even know that windows update exists. I ask if they have anti-virus installed. Yes they answer, meaning they have an extremely out of date version of mc affee waiting to be initialized, never been actually installed or updated. If they go to a website that has some fun new screen saver program or little cartoon for their systray, they think its fun and download it. They don't know that could hurt their system. If a dialog box pops up, they click yes, no matter what it says. They don't know better.

The operating system can only do so much. Sure MS releases their software with security holes, at least they offer patches. Its the responsibility of the user to take care of their system. If you don't patch and take care of your OS, you'll be taken advantage of.

Re:Microsoft Security

[andih8u]

I second that. Many people tout Linux's security, but many of the distros allow you to choose to not have a root password during install and they have ssh on by default.

Your security is only as good as your latest patches. People believe that linux security is better, but you have a much higher user knowledge level on your average linux box than your average windows box.

Re:Microsoft Security

[rifter]

Microsoft Security. What's it all about? Is it good, or it is whack?

I'd have to say whack. As is this report. Crowing about the lack of reported vulnerabilities means nothing when you have paid security firms not to report vulnerabilities! Of COURSE the vulnerabilities reported have decreased. But have the real vulnerabilities decreased? Thanks to Microsoft, we will never know.

Without subjecting themselves to the same review other operating systems undergo, they have no cause to crow about a perceived dearth of vulnerabilities, especially since many previously reported vulnerabilities persist and will not be patched (but are not included in this report since they are not newly reported).

Re:Microsoft Security

[poptones]

I work in tech support too. And I've seen more than one system botch a windows update and end up having to be reinstalled from the ground up. Doesn't mean a format, but it does mean the OS was so botched in the process the ME or XP installer no longer recognizes it as a repairable version of itself. I'm one of several hundred in the building (and several thousand on the total support staff) and I see this problem twice a month, easy. Sometimes it seems to be caused by the POS Norton anti-virus software so technically it's not MS' fault - but then, whose fault is it these users are all forced to load crap like NAV on their system in the first place?

I too use a windows desktop at home, and I too have rarely become infected - and the two times it happened it was entirely my fault (once before I started worrying about keeping my machine on dialup patched, the other when I stupidly rebooted on a machine still plugged into the network fresh from a new install - took code red all of ten seconds to find me all over again).

Anyway, I use Mozilla too, and I use proxomitron, and I use an IPCop firewall - and my system has STILL been intruded upon (right before the most recent SSL flaw was made public) even with "Zone alarm" running on the windows box that was attacked. In fact, the first thing the intruder did was disable ZA and all my system logging.

XP with the XP firewall is still XP. No OS is absolutely secure, but there's simply no way I would connect a personal windows workstation directly to the internet any more. Out of necessity I'll allow my laptop to swim in that ocean, but I make sure there's NO personal info on that and I purposefully keep the HD small and the partition empty as possible so as to make for quick image reinstalls.

User education would go a loooooong way to fixing this problem. But I argue that the Windows PC system itself is flawed in regard to home computing: rather than put up "safety barriers" that can be easily overcome with a modest amount of education, the system is instead setup in "hack me" mode right out of the box. Do I need RPC services to be able to check email and surf the internet? SHOULD I need these services just to be able to do those simple things? No - then why is it enabled by default?

The list goes on from there, of course, but I do think you get the point. Giving administrative priviledges to every executable on the desktop of an admin who knows nothing at all about computers is an exercise in insanity. XP comes configured to make user accounts easy to create and use - but do they even bother to educate the user on WHY these should be used? Of course not - MS is not going to tell the user their machine is vulnerable out of the box! That would be like Ford including instructions in the owner's manual on "what to do when the steering wheel stops working" or "what to do when the brakes fail."

Re:Microsoft Security

[Anonymous Coward]

Outlook 2003 does none of those things by default.

That may well be. But to actually do anything, you have to turn those things back one. Whammo! You're owned, 'cept this time it's your fault for turning the settings back on.

Re:Microsoft Security

[poptones]

But that's the thing, see. I do agree that it's largley because of MS that machines are so cheap and available as they are today (although I'm not saying another MS wouldn't have come along). Without a "commodity OS" we would not have "commodity systems" and would be well back from where we are today.

Look to the past to see the future: when radio first began it was completely unregulated because no one knew exactly how it even worked. Even after radio receivers had become affordable enough to enter "middle class" homes radio was still largely unregulated - until it came to the point you had neighboring transmitter stations engaging in kilowatt battles for the same frequency space because "that's where people were listening." The bands became increasingly crowded because ANYONE could rig up a transmitter and have at it.

What you and I have come to expect from the PC has been shaped by our participation in the "invention" of it. But a vast majority of users - even users who witnessed that invention process - have no ethical relationship to that community. They no more expect to have to defend their personal computers from attack in their own homes than they expect to have to defend themselves from personal attack in that same space. Even when it comes to "attack" from communications mediums like TV and radio and telephones.

THAT'S why the modern PC is still not what it needs to be. not for grandma who just wants to check her email and surf the net. If grandma wants to play games there's nothing at all wrong with being able to download free games from a website - but there absolutely SHOULD be mechanisms in place to prevent grandma's computer from requiring a repairman's attention simply because the game didn't "like" her computer. Yes, it would take a lot of clock cycles to have this kind of protection. And yes, it would impact performance. But clock cycles are ever increasingly cheap, and there's nothing to prevent grandma from learning HOW that box works and then delving deeper.

The solution IS technological. the internet is not "broken" but it still needs a way to be "fixed" at least as perceived by the majority of inexperienced home users. And it better come quick, because the lawyers and lobbyists are lining up their constituents.

You should not have to know how to build a radio just to be able to listen to music. And you should not have to know how to "install a program" and "configure user identities" just to be able to surf public spaces, correspond via email and chat, play games and watch movies and listen to music without being accosted or verbally abused in your own home.

If we don't fix it, the politicians will... or they'll bleed us to death trying.

Re:Microsoft Security

[wfberg]

Your choice of OS doesn't make your system secure. What makes a system secure is a user that has a clue.

Not ALL security risks are PIBKAC (Problem Is Between Keyboard And Chair).. I'd say stamping out the remaining ones is what secure software is all about..

Like you, I've not had a Virus in countless years. I don't get spam, My system has no spyware, or adware or web browsing issues (Firebird rules!)

So you attribute your system security in part to software? How queer.. You should be able to use Microsoft Internet Explorer in a "clueful" manner and it would never have any security issues, right?

The OP is right in one thing; he doesn't have to worry about a lot of things. Personally, I'm worried about things like COM listening to every damn IP on the planet instead of localhost or 192.168.0.0/24. That means I have to run a firewall.. I worry about spyware; used to be you could stick to the trusted download sites like tucows and download stuff you knew didn't contain crap (in the day, virusses). Now I'm not so sure any more, after I got my system infected from a "trusted" download.. (And yeah, occasionaly you use a computer with, shock, horror, new software..)

I worry about my mom's computer even more. I needn't fret as much if she were on a more secure and/or less targeted system.

Try educating your mom. Or even better, mine. There's a limit to what miracles you can perform, trust me.

Re:Microsoft Security

[bryhhh]

So you attribute your system security in part to software? How queer.. You should be able to use Microsoft Internet Explorer in a "clueful" manner and it would never have any security issues, right?

Well, yes, I guess I do use Internet Explorer in a clueful manner, because I don't actually use it. Mozilla Firebird is my browser of choice.

Re:Microsoft Security

[arevos]

Your choice of OS doesn't make your system secure. What makes a system secure is a user that has a clue.

To a large extent, yes. But some systems are easier to secure than others.

Re:Microsoft Security

[nytmare]

What makes a system secure is a user that has a clue.

That's true! But in order for users to be clued, the OS needs to start informing them. They need to know what's going on in their system. But universally vague error messages; system controls and files scattered all over the OS haphazardly rather than grouped in one location; failure to accurately identify and log net connections, both user-initiated and remote; and other stuff I forgot about -- all contribute to an environment of HIDING INFORMATION from users. This is not security. Has Microsoft improved their attitude? No, I think it's still their mantra.

Re:Microsoft Security

[NemoX]

I am glad that you administrate 3000 Windows PC's at a University, because so have I, although mine were closer to 250 unique PCs for DNA sequencing, hooked up to alot of odd equipment (of which I was the only admin, but hey it was my first job out of college, and I am admittingly still green with only 3 years experience). My network comprised of Solaris, Linux, and Windows. So unlike you, I have a more insightfull understanding as to the comparision between OS'. Unfortunatly, I am not a Mac user, so I can't include that as a comparision, too. I never had a production system fail due to windows update, but that is why I have a test box, which did fail once due to a peice of software for a Microarray machine. But, I fixed it before deploying it (obviously)...but how many home users have a "test box" at home? Come one, now. As a comparision, NONE of the Solaris or Linux updates have EVER failed...and we have just as bizare equiment and software installed on them as well. Since all of my machines were unique, I could not just reimage them once a month like I am sure you do, and neither do home users.

Here is the run down in my experience:
UNIX: faster to install
Windows: faster to setup
UNIX: less time in post-install maintance

The main things that kills windows are:
1. its popularity
2. its file structure security permissions
3. mulitple files dependent on system files (but I won't get into that here, since that is a another long thread within itself, one which effects several platforms, also)

1, Its popularity make it a greater target for people to do evil things such as insert spyware, et al. I mean like you, I don't have any spyware on my systems, but I am an advanced user that has the appropiate firewall to catch anything I miss, plus I run anti-spyware software and obviously anti-virus. But, see that's just it...with the other OS' I dont' have to spend time and company money constantly checking log files of these programs to make sure nothing slipped in. These programs don't have to constantly run in the background eating up resources and the coffers every year for renewals.

What you and many others are saying is not about basic education, it is about *advanced* education. It is not telling someone to take their car in for an oil change every 3000 miles, it is about telling them that they have to change the oil themselves. I am sorry, but if I had to perform all the maintanace on my car myself, there is no way my car would run properly. This, in turn, harms others on the road by jeprodizing their saftey, just as a compromised computer jepordizes my livelyhood (by being used as jump points for hackers, and spam, etc.) I am sorry, but the majority of people don't have time to learn every aspect of their computer or vehicle, and shouldn't be expected to, either.

I don't have to be constantly watching over all the *NIX systems everytime a weird peice of email comes in either. Why? because it can't harm the system as a whole, just the user's information. Which brings me to point 2:

2. Sure there are trojans and such for *NIX systems too, however due to its secure OS, the most harm that comes of it (from a user POV) is that the user's home directory gets snuffed. And that's what backups are for. You can retore their data. Any malware that the user catches is confined to their home directory, and cannot gain access to the main system files (unpatched systems, for the most part, are excluded - as exploits to this theory exist on every platform). Therefore making viruses, and other malware more contained, and less of a threat to the system as a whole. Windows, however, inherently lets greater access to the system's file structure (which somewhat ties into point 3). If windows had a more secured file structure that containted all malware to the user's directory, then it would make life ALOT easier. But let me ask you this, if a user comes to you and says "I need this software installed to finish my Ph.D., make it so." do you not spend th

GNAA announces plans to bomb Christmas island

[timecop]

GNAA announces plans to bomb Christmas island
by GNAA Staff
Due to recent AUP policy changes at .cx NIC, one of the key GNAA sponsored websites, http://goatse.cx has been found "in violation of .cx AUP policies". This announcement delivered a huge blow to the GNAA organization.
Without goatse.cx, we lose an important piece of GNAA.
"We will not let this happen", GNAA representative goat-see said to the press. "GNAA will begin planning a terrorist attack on the Christmas Islands."
GNAA currently operates a back-up site, also located at the .cx TLD, http://goat.cx. Users are welcome to use this website while we try to persuade .cx NIC to reinstate goatse.cx domain.
"In the event that our peaceful negotiations will fail, Christmas islands are sure to be gone off the face of this planet", added another GNAA member, penisbird.

If you would like to show support for goatse.cx domain, please visit the following links:
Petition to reinstate goatse.cx (currently down due to attack)
nic.cx feedback forums goatse.cx thread

Thank you!


excerpt from an irc log

@b- The domain goatse.cx has been found in violation of .cx AUP policies, http://www.nic.cx/policies/pdf/cx.AUP.pdf #5, page 7, and is therefore suspended.
@r- shit, that sucks
*** joey (joey@brodels.gngsta.com) has joined nologin
@s- yea i read, page 7 only talks about payment issues though
@s- nothing about content
@b- ya
@b- im confused too
@s- i dunno what the #5 means
@s- oh i see
@s- Communication publication or distribution of adult or obscene content
@s- or images by way of embedded links in unsolicited email, postings to
@s- news groups, internet forums, notices to instant messaging programs,
@s- where the internet user is not explicitly made aware that by clicking on
@s- the link they would be directly exposed to adult or obscene content.
@b- hah
@b- he'll have to make a splash page
@s- i already put the lawyer warning on there
@p- hah
@b- that amendment to thier AUP
@b- is like 100% goatse
@s- - Over the years we have received numerous complaints of this domain's
@s- - content, but no person filee an AUP violation form against the
@s- - domain. Recently the .cx board met and revised all .cx policies (December
@s- - 2003). One of the .cx policies that has not changed is that each domain
@s- - holder is required to review the policies every thirty days and make sure
@s- - their domain is in compliance (Please read part 1, page 2 of
@s- - http://www.nic.cx/policies/pdf/cx.registration.agr eement.pdf).
@s- -
@s- - We do not review web sites and cannot ensure every domain holder is in
@s- - compliance. But, if a domain is brought to our attention that fails to
@s- - comply with our policies, we reserve the right to suspend the domain.
@s- -
@s- - I am unclear if you change the content, the suspension might be
@s- - revoked. If you are considering this option, please send a note of inquiry
@s- - to info@nic.cx.
@s- -
@s- - Best Wishes,
@s- -
@s- - Elaine Pruis
This commentary brought to you by a proud GNAA member.

About GNAA
GNAA (GAY NIGGER ASSOCIATION OF AMERICA) is the first organization which
gathers GAY NIGGERS from all over America and abroad for one common goal - being GAY NIGGERS.

Are you GAY ?
Are you a

Let's be honest

[ObviousGuy]

Is any software really at the point where we can install it and forget about it?

Security is a job for all of us, not just Microsoft.

As long as hackers out there have the tuits to break into systems, security is everyone's business.

Re:Let's be honest

[littlerubberfeet]

Comon sense is a job for all of us, including Microsoft. Most vendors use common sense when they delay a product release due to security problems. Microsoft has historicaly not done that.

I think that it is great that less critical problems are being found now then with Windows 2000, and I hope the trend continues.

As an aside, I installed OS X on my grandmother's computer, and until now, forgot about her. Thanks for the reminder to write. Unfortunately, even that is not maintenence-free. Apple has had their own security problems of late.

How about an honest embrace of common sense?

Re:Let's be honest

[Anonymous Coward]

Well if you want to be honest, lets look at it this way:

Do you want to depend on a OS that has a crappy track record for security and is produced by a company that has a spotty reputation at best for reacting correctly to security crisis situations in the past?

OR

Would you want a OS that has a decent track record and whose developers are aproachable and respond to issues quickly. Plus unlike the previous OS you have access to the internals and can choose how to modify it to make it more secure? And if that doesn't always work then you have the option of fixing it yourself or using other people's fixes to correct or nullify a issue.

Hmmm... I think most people would choose the second.

Do you know what 2 OS's I could be refering to?

Lets be honest here, now.

Re:Let's be honest

[NanoGator]

"Security is a job for all of us, not just Microsoft."

But we get precious few opportunities to use our pitchforks. :(

Re:Let's be honest

[bryhhh]

I think that it is great that less critical problems are being found now then with Windows 2000, and I hope the trend continues.

The quantity seems to have dropped, but the severity seems to keep increasing.

Just look at the havok caused by the recent RPC worms.

- I'm also in disbelief that Microsoft still haven't released a patch for the %00 bug in IE that allows spammers and malicious web admins to obscure the real URL the user is being directed to, perhaps Microsoft don't see a bug which could be used to trick people out of their hard earned cash as a Critical problem?

Re:Let's be honest

[bryhhh]

Microsoft don't see a bug which could be used to trick people out of their hard earned cash as a Critical problem?

They wouldn't see it as a bug, heck that's exactly what Microsoft have been doing to their customers for years!

Re:Let's be honest

[jamwt]

Is any software really at the point where we can install it and forget about it?

Qmail is pretty damn close.

Re:Let's be honest

[Chemical Serenity]

The DJBDNS suite can be added to that list. Hasn't changed in years... apparently hasn't ever needed to.

Re:Let's be honest

[woohoodonuts]

Is any software really at the point where we can install it and forget about it?

yadda yadda... flame me... whatever...
the answer is yes. I've been using my mac for eight years--spent a lot of time on some pretty sketchy sites (infer what you will)--and I've never once got, thought about, or had to remove a virus. I realize this statement is batted back and forth endlessly... but yeah--some software is at that point. And ya know what, I don't really give a damn why apple's stuff isn't targeted. Market share? sure, maybe... but what the hell do i care what the rest of the world is running when all I can see is the ibook sitting in my lap? If they choose to use something else that's fine by me... but don't think that there aren't solutions out there because you don't use or can't see them.

Re:Let's be honest

[j3110]

I have to give MS two thumbs up. They now have automatic updates pushed to clients. They also have the Server tools to cache the updates locally for networks, and push them from there so you can hold updates back if they break some internal software.

MS is also working on more secure technologies like .Net. In the future, code written for windows will be written in .Net by default, and buffer overflows will pretty much go away.

MS is working on code signing at every level of the system. This means no more boot viruses, no more trojans.

MS is still lacking on speed to update. The RPC bug was on the streets long enough for exploits to be written BEFORE they got even the smallest patch out. The big worms came after they did get the patch out, but people weren't updating.

Where does Linux stand in all of this?

Updates are usually still handled manually with apt-get update/upgrade. RedHat has live notification, but it's still done manually for the most part, which slows down the process. There are wasy of caching apt packages for internal use by making your own apt-source, but they can be difficult to implement. You can do similar things with RedHat, but there isn't a lot of work being done in this area.

Open Source developers still hug C and hate most anything running in any other safer languages because of performance. Despite it actually costing more man hours to manually go out and install new versions of SSH, bind, sendmail, etc. every 3 months, for some odd reason open source developers value cpu clock cycles on a machine that sits idle 99% of the time more than an actual person that can hardly find 5 minutes, and usually admins so many computers it turns into an all-nighter.

Open Source people see code signing as a way to enact DRM and are fighting it.

Open Source releases updates within minutes of being aware of prossible security problems, sometimes it can take an hour or a day on less critical projects, but for the most part updates are very quick.

I see progress in MS land, but Open Source people are fighting the future, and are living in status quo. There's no reason why 99% of the daemons out there couldn't be written in Python or Java (with Kaffe even). There's no real reason to fight TCP yet.

Re:Let's be honest

[Anonymous Coward]

There's a patch for that vulnerability here

Re:Let's be honest

[Anonymous Coward]

You idiot! You forgot to spell it with a dollar sign and actually said something NICE.

The zealots are going to mod your bitch ass into oblivion!

Re:Let's be honest

[j-pimp]

Well I know it was the first to automatically figure out PTR records for reverse DNS, but what about DHCP updated DNS entries ala BIND9. Thats showstopper for replacing active directory.

Re:Let's be honest

[SlashDread]

I have to give MS two thumbs down.
Sure, the security is improving, the SUS server is a nice tool.

But what bugs me beyond belief is the amazing lack of information it gives.

SUS out of the box does not:

- Client cannot be controlled, you cant use Windows update to update your system NOW, you will have to rely on reghacks, and stopping and starting services, to make sure your system will be updated in approx 15 minutes..

That is crap, Im the sysadmin, I want to make sure that the system is updated NOW.

- The SUS Server has no simple reporting -who-, -when- and if successfull or not, of events like a client connected and pulled updates.

This is even more crap, I cannot scan the server for activity from clients, unless I go digging in cryptic log files, which are not identified in the MS docs about SUS anyway.

Sure, there is a smart guys script that does that, which involves installing stuff for IIS, without properly explaining how and where. Again unacceptable.

It is that Nachio blasted our network away that we HAVE to be protected so I use it.

But Im very dissapointed in the lack of control and information it gives.

THATS my gripes with MS, stop listing to the damn users already!@ And start listing to the sorrow admins, like me.

NOT just for security in press, but for the daily lives of their admins. After all THEY need to understand whats happening, THATS the basis of REAL security.

"/Dread"

Re:Let's be honest

[houghi]

Updates are usually still handled manually with apt-get update/upgrade. RedHat has live notification, but it's still done manually for the most part, which slows down the process. There are wasy of caching apt packages for internal use by making your own apt-source, but they can be difficult to implement. You can do similar things with RedHat, but there isn't a lot of work being done in this area.

SUSE has the possabilaty to do automated updates. Just put them in a crontab. I asume this can be done by other distro's as well. You apperently aplaud the fact that Microsofy has automated updates and there is nothing wrong woth that. Most Linuxusers however would like to know what is being installed on their systems and are very afraid of some automagic system that will install stuff on their boxen. As you point out there are systems to do updates under Linux. The question remains if this should be on by default or not.

On one side we have the fact that we do not want Microsoft to do anything on our system, because they are the evil emire. On the other side we want them to have automated updates. Choose your poison.

Re:Let's be honest

[lintux]

Enough reasons to change DJBDNS. Just to pick an example: IPv6 support?

DJB has some problems with his attitude and other things, which make it hard for him to understand IPv6. That's why other people have to distribute patches to add essential features like this.

Actually, just do a quick search on Google and see that there are many people who have patches for DJBDNS. DJB is too afraid to release new versions with these fixes because that could make people think that his programs aren't that good after all...

(Hope I'm not too offtopic/trolling here. ;-)

Re:Let's be honest

[nighty5]

To at left defend any company (not just MS) products must be updated and improved to generate sales. Qmail hasn't changed in 5 years since its 1.03 release in '98.
If any company took on the methodology that DJB has implemented, you wouldnt have a need for software to be written because you wouldnt have a job nor a company to run.

Re:Let's be honest

[Tim C]

There are essentially two ways to update a modern Windows machine (ie Win2k or newer - I've not used 98 in years, or Me at all). You can either visit the Windows Update site and choose what updates you want to install, or you can use the Automatic Updates tool.

Automatic Updates checks for critical updates only, and works in three modes: notify me, download and notify me, or download and install. In the first two modes, you have complete control over what gets installed - even in the case that it's downloaded, it won't be installed unless you give the go-ahead. The third mode, of course, is fully automatic - available critical updates are downloaded and installed at a time specified by the user (it defaults to 3am, iirc).

Personally, in the year or so I've been using XP, I've found no reason not to have it set to automatically install updates. Nothing has broken, and if any unpleasant features have been installed for me, I certainly haven't noticed. (And given the way sites like /. and the Register jump all over anything MS does, I assume that nothing has been)

Re:Let's be honest

[ceeam]

What's funny that _even_ with all these super-duper security-focus, auto-update etc... technologies a Windows server is not the one to leave and forget about it and sleep well. OTOH - any semi-knowledgeable IT guy can (IMO) setup a UNIX (EG: Linux) server that will _work_ for months and no-one would even know it's there. I think that the problem mostly is not how to "protect your stuff from malicious hax0rs" but rather how to make it all work given your average users. Windows sucks there. Like no (easy) automation even for trivial tasks. Like "locked" files all the way.
And yes - file sharing and VBA in Excel is not the answer whatever your boss thinks.

Re:Let's be honest

[tres]

Updates are usually still handled manually with apt-get update/upgrade.

Sorry, but if I really felt stupid enough, I could have cron job'd my portupgrade, apt-get, urpmi or up2date long, long before Microsoft thought it was a good idea to push updates to clients; we could have been doing this back while microsoft was trying to convince the court that a HTML interface was the only way that they could update their OS.

You seem to have gotten lost somewhere along the way--updates are manual for a reason. The prudent admin takes the time to know what vulnerabilities or potential problems are going to affect their system. The prodent admin knows whether updating is necessary and what potential problems it may cause. Availability of new code doesn't mean that updates are required.

Automating updates isn't "progress." It isn't even hard.

Open Source developers might "hug" C, but they are much less aflicted by language myopia than are Windows developers.

What Windows IDE will do syntax highlighting for Python
How about PERL?
or PHP?
or Ruby?
or any of the other numerous languages that are not only supported, but are afforded real, working tools natively supported by the environment.

I think your point is something to take very seriously; but I don't see the Open Source community sitting, waiting for MS. Ultimately the idea is fallacious because it takes for granted the idea that new == better. There are many, many reasons to stick with something that works.

Words of wisdom that have been around much longer than you or I: "If it ain't broke, don't fix it."

Re:Let's be honest

[JPriest]

It's security 101

Services should not default to listening state. Nobody has ever been able to write secure services yet people keep saying "I think we've got it this time"

Leave it off, if I need it I will turn it on. If I am too stupid to turn it on than maybe it shouldn't be on, or at least not accepting connections and data from any IP address on the net. This common sense and they are just now adding it to SP2. And before you step in and call me a Linux zealot, most Linux destroys do this wrong also.

BTW, I suspect the incomplete will be reevaluated on after the release of SP2, which I admit, is a large improvement.

Re:Let's be honest

[Chemical Serenity]

Nah, you're being honest. I've seen the third party patches but for what I need them to do (basically push out classic ipv4 resolutions reliably and securely without any of the newer, fancier addon goodies), it works peachy. The point of the post wasn't whether it does everything that everyone wants it to do today, more a reflection as to how solid and hax0rproof the code itself is.

I'll stipulate to his attitude 'issues' ;)

Re:Let's be honest

[TyrranzzX]

You forgot a few things in your honesty, as I'm sure I'll forget a few from mine.

1: Microsoft has been convicted of antitrust violations. Hence why .net can't be used by linux programmers.

2: Blaster.

3: Many linux groups are still nitpicky crazy people who instead of agreeing and copromising, they bicker. Even more are lazy, or greedy, or just plain stupid.

4: Open source people see Microsoft's code signing as a way to enact DRM, which is a polite way of saying they want total world domination. Many linux guru's like the idea of code signing, they just don't like Microsoft and they have good reasons.

5: Linux, netware, and other operating systems are still used for servers more often than Microsoft's software. MS's software is only used on desktops because everyone knows it. I'v used KDE on suse 8.1, it works well for anyone accept power users and I see no reason for ma n' pa to spend $300 on a new copy of winxp so they can check their e-mail.

6: Coding tools for linux exist that are open source and that work well. Not everyone is coding in C. .Net isn't unique.

7: Linux is known for it's efficiency. On a server, efficiency > ease of use. Ms's software was designed for idiots, Linux was designed for people who know what they are doing. Linux is for the person who says "my powersupply blew out last storm, I'll replace the fuse and see if it works" whereas microsoft is for people that say "computer doesn't work = replace computer".

I see progress in for both linux and windows. I see more mind-blowing applications coming out for linux next year and I also see the first idiot proof interfaces coming into being. I don't see microsoft living upto their security bullshit, which they've had several years to implement but haven't. You can say "they're getting better" all you want, but is their security really better than it was in 2000? I see more DRM being brought into play, and it being either accepted or rejected on an individual basis. Ultamatly, in 10 years, I see microsoft becoming a linux distibutor, weither announced or unannounced.

Re:Let's be honest

[Anonymous Coward]

Actually Microsoft funds ActiveState to produce "native" ports of Perl and Python for Windows. ActiveState also sells an IDE for those languages.

Re:Let's be honest

[Chemical Serenity]

Stuff like that and IPv6 support are still not all that important for many people providing simple, 'classic' authoritative lookup. It is starting to show its age at this point though, I'd agree, and is probably a function more of the author's stubbornness than anything else as to why the software hasn't seen updates.

I'd opt for damn near anything over BIND, though. I've been around for a while, and it's caused me more than enough headaches to last me a lifetime, thank you all the same, zippy ska-bang dhcp updating or no.

Re:Let's be honest

[bryhhh]

most Linux destroys do this wrong also.

That's what I like about a default(?) gentoo install

bash-2.05# netstat -an | grep tcp | wc -l
1

as opposed to the default install of most other distros

bash-2.05# netstat -an | grep tcp | wc -l
10

Re:Let's be honest

[goranb]

What Windows IDE will do syntax highlighting for Python? How about PERL? or PHP? or Ruby?

How about SciTE?
Oops...

Re:Let's be honest

[hauer]

Open Source developers still hug C and hate most anything running in any other safer languages because of performance.[...] for some odd reason open source developers value cpu clock cycles on a machine that sits idle 99% of the time

This argument that programs need not be fast because computers are mostly idle anyway comes up again and again and I fail to understand why.

I want my computer as fast as possible when I am using it no matter whether it is 50% or 0.001% of the total time while it is switched on. I want to compile fast, have webpages rendered instantly instead of letting the machine do it overnight when it is idle anyway.

This argument is like saying that a car which can go at 10 km/hour is just as good as any other ... it is after all idle most of the time

Re:Let's be honest

[Anonymous Coward]

...not only supported, but are afforded real, working tools natively supported by the environment.

oops

Re:Let's be honest

[Tom]

Is any software really at the point where we can install it and forget about it?

No, but neither is anything in the real world.

There is, however, a huge gap between "regular maintainance and it'll run forever" and "read security updates daily, look for updates every other day, and still you can't be sure there isn't an unpublished 0day".

Re:Let's be honest

[chthon]

The prodent admin probably has very shiny teeth!

Re:Let's be honest

[tres]

and a long tail...

and fat fingers. :-)

Re:Let's be honest

[JPriest]

I miss my bash shell when I am in windows but it can be done.

C:\>netstat -a | findstr LISTENING >file.txt
C:\>wc -l file.txt
file.txt: Lines: 12
C:\>ver
Microsoft Windows XP [Version 5.1.2600]
C:\>

wc binary link here

Re:Let's be honest

[dbIII]

What Windows IDE will do syntax highlighting for Python

Vim is cross-platform.

Re:Let's be honest

[dbIII]

Updates are usually still handled manually with apt-get update/upgrade. RedHat has live notification, but it's still done manually for the most part, which slows down the process.

It really has to be that way. I had Redhat update kill off apache once on a live webserver, but was able to roll it back to the previous version before anyone noticed. If something is important enough you don't let it happen in your sleep - unless you want a rude awakening or to face angry people in the morning. With microsoft machines you also have the option of doing the upgrade when you are there to watch it like a hawk and fix it when it dies.

.Net by default, and buffer overflows will pretty much go away.

Just like divide by zero errors didn't go away in the fifties, or race conditions at the same time. Sadly, a lot of programing is still the equivalent of one guy sitting on a rug weaving a basket and another guy weaving lids on the other side of the markets - there's usually a huge difference between the planning that goes into the average engineering project and the planning that goes into a software project run by guys that call themselves engineers or architects.

Re:Let's be honest

[LnxAddct]

So I guess when I ran this and got 18, that was a bad thing? :)

bash-2.05# netstat -an | grep tcp | wc -l
18

Regards,
Steve

Re:Let's be honest

[jadavis]

There's no reason why 99% of the daemons out there couldn't be written in Python or Java (with Kaffe even).

UNIX people "hug" C, but not because of performance. It's portability. Python and Java are more of a moving target. They do a good job of maintaining compatibility for the most part, but it's nothing like C.

I don't think we're going to see a serious move in that direction for a while. One thing we need first is a standard VM that's completely free and changes very slowly, and is compatible to many platforms. Basically, I'm talking about a free, cross-platform .NET.

Re:Let's be honest

[Florian Weimer]

Security is a job for all of us, not just Microsoft.

Yes, that's a nice spin -- it's your own fault when your computer has been successfully attacked, even if the vendor has known about the vulnerability for months.

The most important part about patching is that you have to do it. If something goes wrong, the vendor can blame you. You don't pay your virus scanner tax? Your fault. You don't pay for personal firewalling software? Again your fault. You don't apply that multi-megabyte security upgrade? Of course, it's your fault.

As long as hackers out there have the tuits to break into systems, security is everyone's business.

But if your basic infrastructure is broken, you can't fix it on your own. There's no workaround for gaping security holes in Internet Explorer, and Microsoft hasn't been able to deliver a patch to fix these.I nstead, they more and more "security researchers" end up on Microsoft's payroll and suddenly claim on public mailing lists that using Internet Explorer is safe as long as you use the right security settings.

By the way, Mozilla isn't better either (a number of unspecified security fixes in 1.6), and it looks as if the security audit has been stopped. But in contrast to Microsoft, they don't have to pay for the "this browser is safe to use" bullshit.

Re:Let's be honest

[Slightly Askew]

You seem to have gotten lost somewhere along the way--updates are manual for a reason

This just goes to show how little experience most Linux desktop (not server) admins have in the real world. End users can not be trusted to update their machines. Yes, updates should be done manually to test for potential problems...in a lab environment. After they have been tested and approved in the lab, they should be rolled automatically to the end user. It is simply ludicrous to assume that one admin, or even a team of them, is going to manually install patches to 50,000 workstations every couple months.

Re:Let's be honest

[rabidcow]

Is any software really at the point where we can install it and forget about it?

Well sure, there's that one... oh, what's called...

Re:Let's be honest

[Anonymous Coward]

Also, C is based on an open standard (both regarding source and ABI). Python doesn't really have a standard, and java is as closed a standard as they get (any implementations of java 1.4 are automatically owned by sun, which is why there are no open source java 1.4 vm's).

Re:Let's be honest

[glh]

1: Microsoft has been convicted of antitrust violations. Hence why .net can't be used by linux programmers.
What's stopping them? The go-mono project is quite active- I get at least 50 emails a day from linux programmers that are using .NET on linux. There is also .GNU and some other projects. Rotor is only for "educational purposes" but it runs on OpenBSD.

2: Blaster.
The most popular platform, ran by the most people in the world, etc. is bound to have security holes that get exploited. Unfortunately when 95% of the people out there don't know how to patch, these are blown way out of proportion. One company can only do so much to prevent the problems- anything else and you get complainers (see point #4).

Many linux groups are still nitpicky crazy people who instead of agreeing and copromising, they bicker. Even more are lazy, or greedy, or just plain stupid.
I've presented at LUG's and I would somewhat agree with this point. There are some people that are just interested in getting things work, but many of them are hecklers, complainers, etc. It's just the sub culture. I used to be "on the other side of the fence" and I know the mindset. Once I graduated college and started working with business, my perspective changed quite a bit. People are drawn to anger/hate/etc. and unfortunately leaders in the linux community help foster this so it continues to pervade.

4: Open source people see Microsoft's code signing as a way to enact DRM, which is a polite way of saying they want total world domination. Many linux guru's like the idea of code signing, they just don't like Microsoft and they have good reasons.

Exactly. MS starts implementing security to eliminate things that happen in #2, and now the complaints start rolling in. No matter what MS does there will always be naysayers. They will never be satisfied.

5: Linux, netware, and other operating systems are still used for servers more often than Microsoft's software. MS's software is only used on desktops because everyone knows it. I'v used KDE on suse 8.1, it works well for anyone accept power users and I see no reason for ma n' pa to spend $300 on a new copy of winxp so they can check their e-mail.

In most companies that I have worked in or with, Linux tends to be used primarily for non-critical systems. Solaris is used on any other *nix based system for critical things (eg. production oracle databases), and the hardware cost is astronomical in comparison. We are converting to Win2K servers. The license cost for a business is not what a consumer would pay, in fact it is significantly less (ex-$100 instead of $300 for XP). Most new PC's that companies order (ie, dell) come with WinXP anyway.

6: Coding tools for linux exist that are open source and that work well. Not everyone is coding in C. .Net isn't unique

Ok, as a .NET developer I definitely have some comments on this one. One of the biggest reasons I "switched" to MS was because of the development tools available. Not only that, but also the support, and the willingness of the developer community (tons and tons of support- just do a google search), as well as Microsoft. There are MS dev leads that help support developers FREE of charge. Sure, the cost of the tool can be pricey, but you aren't just buying the tool. Also, I have never found a tool that has all the needed capabilities/performance/integrated environment of VS.NET in an open source project (for any language). Some open source Java tools come close, but they tend to be really slow and lacking one or two key features that I need to be productive.

7: Linux is known for it's efficiency. On a server, efficiency > ease of use. Ms's software was designed for idiots,

I don't think it was designed for "idiots" but I agree that there is definitely a level of abstraction that MS unnecessarily gives the sys admin that ca

Re:Let's be honest

[Anonymous Coward]

Open Source people see code signing as a way to enact DRM and are fighting it.

There are md5 hashes available for everything. Most upgrade tools have md5 checking built in (though it's not used by default).

Re:Let's be honest

[rcamera]

you want to update your system now? try this.

Re:Let's be honest

[AbbyNormal]

What Windows IDE will do syntax highlighting for Python
How about PERL? ...

I kinda like this.

If you want free, check out Eclipse. Not sure if they have plugins yet, but you could always build one.

Re:Let's be honest

[AbbyNormal]

Didn't Preview, sorry:


What Windows IDE will do syntax highlighting for Python
How about PERL? ...

I kinda like this.

If you want free, check out Eclipse. Not sure if they have plugins yet, but you could always build one.

Re:Let's be honest

[caino59]

I'm also in disbelief that Microsoft still haven't released a patch for the %00 bug in IE

There's a 'patch,' just not released by MS....d/l it here.

Re:Let's be honest

[Anonymous Coward]

"What Windows IDE will do syntax highlighting for Python..." Either you enjoy advertising your ignorance, or you dont want to do your own damn search work. Google.com (it works)

Re:Let's be honest

[AbbyNormal]

Not an m$ fan, but there are a few points I'd like to make.

. Hence why .net can't be used by linux programmers Huh??? Um...what about Mono?

Blaster Non .NET signed code, what's your point?

Microsoft's code signing as a way to enact DRM What about signing Java applets for security?

MS's software is only used on desktops because everyone knows it. Um, a majority of enterprise environments that I work in all use Win2k servers to a good degree of success. (Some of the logic to use Win2k is pretty lame...most could easily be replaced with Linux based systems. )

Ms's software was designed for idiots, Why is this bad? Going back to your previous argument, are your "ma n' pa" linux gurus? Are the majority of enterprise/home users, gurus? This is the very elitist attitude that ticks me off. I see it routinely on newbie bulletin boards and chats...it really chaps my you know what. I almost completely switched over all of my systems to FreeBSD for this very reason (support base).

I believe most of your comments were rants against the evil Empire, rather than anything of content.

Linux needs to START catering to "idiots" if this is going to be the "Year of the Linux Desktop". Not all users and even developers are masters of their operating system (I'm going to get flamed for this, but they really don't have to). A user/developer needs to be able to adopt a Linux system and then say: "Hey you know what would be cool" and then proceeds to build a couple of apps

I think that is when Linux will really take off. A few of my developer friends (Perl mongers) refuse to run linux because of the amount of time it takes them to do simple stuff (Plug-in cameras and other peripherals and have them instantly recognized). I can see their point sometimes, when I'm trying to get a pacakge to be installed, only to be told I need four other updates in order to install the first.

The post was right thought:Linux was designed for people who know what they are doing...

That needs to change very quickly.

There are a lot of flavors of Linux out there that I believe are on the right path (I, for one, like Mandrake...and previously Red Hat).

Re:Let's be honest

[Anonymous Coward]

glh, you shouldn't bother trying to educate these trolls. If you slay one, another just pops up. They don't even listen anyways. Just remember, they are interested in the idea of hating microsoft, NOT interested in an objective comparison of two viable platforms.

Re:Let's be honest

[elmerf9000]

troller,troller,troller I Love M$. And Bill Gates is sexy.....

Re:Let's be honest

[lafiel]

Wow. By quoting using [...], you managed to completely make yourself LOOK like you have a point. Here, let me quote him completely for you.

Open Source developers still hug C and hate most anything running in any other safer languages because of performance. Despite it actually costing more man hours to manually go out and install new versions of SSH, bind, sendmail, etc. every 3 months, for some odd reason open source developers value cpu clock cycles on a machine that sits idle 99% of the time more than an actual person that can hardly find 5 minutes, and usually admins so many computers it turns into an all-nighter.

Notice the point is that it requires MANUAL work? He's not saying the programs don't have to be fast. Just don't sacrifice simple automation for optimization! Don't force businesses and people to put in manhours when they don't have to!

Next time, read the entire thing, quote the entire thing, then start writing. Maybe you'll come to understand his point and not need someone to hold your hand.

Re:Let's be honest

[PrimeEnd]

Where does Linux stand in all of this? Updates are usually still handled manually with apt-get update/upgrade.

This remark is just silly. I help maintain about 50 linux workstations and we have done automatic updates nightly for years. There are tons of tools to do this. It is all done by cron jobs in the middle of the night so it won't interfere with anyone's work. We use autorpm, but you can use apt-get or yum or even "rpm -F". We automatically download one copy of upgrades from redhat or a mirror (use autorpm or rsync) and then nightly do upgrades. No reboots necessary unless you upgrade the kernel. Often I notice the upgrade has been done before I get the email from redhat announcing a problem. Of course, if money is no object, you can pay redhat for (presumably) even better service.

BTW, can Windows upgrade in the middle of the night with no one logged on? I have been told no, but I don't use the stuff myself.

Open Source people see code signing as a way to enact DRM and are fighting it.

That's because code signing is DRM and one of its main objective is the elmination of open source. The fact that code is signed, does not mean it is any less likely to have security flaws, or that those flaws are less serious.

Re:Let's be honest

[C0C0C0]

What Windows IDE will do syntax highlighting for Python ... or PHP?

I like PHPEdit. Or are you just exaggerating for emphasis?

Re:Let's be honest

[74nova]

not that its free or even meant for programming, but macromedia's dreamweaver syntax highlights php. with (from what im told, its free for me) expensive plugins for it (such as www.interakt.ro) its a very powerful php development tool. lots of wizards to knock out the stuff like db connections, querys, datasets, etc.

like i said, its not free, but it sure is easy, fast, and highlights syntax.

im sure links for those would get me more karma, but im too lazy this rainy friday morning.

Re:Let's be honest

[airjrdn]

Ok, let's be honest.

Primary problems with the second OS:
I just bought a new scanner, there's no software on the CD for it.

I just bought a new digital camera, there's no software on the CD for it.

I just bought a new MP3 player, there's no software on the CD for it.

I tried installing new video drivers, but something went wrong. Something called X is having problems. I see a black screen

I went to Best Buy, and there are isles of software for Windows, but almost nothing for my operating system.

I think "most people" would include users that fit into the above category, rather than into the category that can do something about each of those "issues".

See my point?

For most people, WinXP, AVG Antivirus (free), and Sygate Personal Firewall (free) add up to a system that's secure enough they'll be safe. Add to that a broadband connection with a router/firewall,and it's highly unlikely they'll get themselves into any trouble outside of online purchases and P2P file trading.

Re:Let's be honest

[anethema]

I find one of the ways microsoft updates windows is very nice, and handy. It downloads the update locally, the notifies you that critical security updates are ready to be installed. You can review them to your hearts desire, then install the ones you want.

I dont see anything wrong with that. They are small so its not like bandwidth is an issue.

Re:Let's be honest

[smallfeet]

If by most people you mean a few thousand geeks world wide then I would agree. How many people want to be able to mess around with the source code? How many have the time or inclanation to understand the internals of the OS?

Re:Let's be honest

[SlashDread]

Man....

Any clue what that means for your internet connection?

Imagine a few hundred users trying to connect and pull a few multi megabyte updates from the Windows Update Server.

This is why the SUS product was -made- in the first place...

"/Dread"

Re:Let's be honest

[Feyr]

actually no since it also count the ESTABLISHED connections, not just the LISTENing ones

netstat -an | grep tcp | grep LISTEN | wc -l

would be the proper command

debian is pretty nice in the aspect. it has for all intent and purpose 0 open (discard, echo and the likes don't count, they're not really services)

Re:Let's be honest

[praxis]

The most important part about patching is that you have to do it. If something goes wrong, the vendor can blame you. You don't pay your virus scanner tax? Your fault. You don't pay for personal firewalling software? Again your fault. You don't apply that multi-megabyte security upgrade? Of course, it's your fault.

Yes, that's exactly how it works. In all sorts of markets. If SSH has a vulnerability, and you don't patch it and get compromised, it's *your* fault. If SQL server has a vulnerability, and you don't patch it and get compromised, it's *your* fault. If your car starts leaking oil, and you don't take it in for service and break down, it's *your* fault. The manufacturer can only provide the solution, the user must do his part too.

Sure, we can argue back and forth that different vedors make different quality products some with more vulnerabilities than others, but if it's a known problem and there is a patch available, the vendor has done his part.

I am not talking about vulnerabilites the vendor knew about but did nothing about. That's the vendors fault.

Re:Let's be honest

[Glamdrlng]

You'd think Microsoft would go after said bug as well as they who try to exploit it with great vigor: the scammers are cutting in on their action.

Re:Let's be honest

[Anonymous Coward]

Ms's software was designed for idiots,

Incorrect. MS software is designed to sell. It may harass you a lot and look like it's trying to help, but generally MS software makes many things more complicated than they need to be - even for idiots.

Re:Let's be honest

[j-pimp]

I'd opt for damn near anything over BIND, though. I've been around for a while, and it's caused me more than enough headaches to last me a lifetime, thank you all the same, zippy ska-bang dhcp updating or no.
Well if you don't need dhcp auto updating, then go with DJB. I probally would. However, if you want to provide active directory-ish services then you need an LDAP server, and a DHCP server, and you need samba 3.0 and Bind 9.Even if non of your workstations run windows this is a nice setup. samba is faster than NFS, and if you do your schemas right your ldap directory can be used fro logons to windows, unix, apple, a poop load of OSes I've never touched, your qmail virtual domains, and to boot you have a choice of address books. I'll be honest I'm painting broad brush stokes here. However, replacing BIND 9 with DJB in such a setup is going to add more problems than it solves.

Re:Let's be honest

[archen]

I have to agree, SUS has a lot of issues and sounds like a better tool than it really is. As you say, there is a significant lack of control over SUS, and if you don't use it in exactly the way MS describes then you are really left picking for information.

And seriously, how hard would it be for MS to create a small client .exe file that would allow an administrator to run and set up the Windows Update options on a machine?

My biggest gripe is that you cannot install SUS on a Win2k workstation. It requires the FULL version of IIS, which requires Win2k Server. So now I have to pay $650 for a machine in order to update MS security problems?

A FreeBSD solution is so simple in comparison that it's almost comical. While Unix udate soutions seem sort of complicated, they are typically simple in their respective steps and easily comprehendible in those parts.

Re:Let's be honest

[jtshaw]

I have a few comments to make...

First off, every opensource piece of software I download has MD5 sums done on it so I can check the integrety of the download.

If you pay for linux support you get the a decent live-update system (example: RedHat). Even if you don't pay for it, you can use a system like Debian or Gentoo and get pretty easy to update stuff (apt-get update, apt-get upgrade and your done, or emerge sync, emerge -U world and your done) which include security fixes much quicker then MS ever gets them out.

There is absolutely no problem writing code in C. Sure you will have buffer overflows on accident at times, but at least you control the problem. If the problem exists in the VM or the libraries for something like Java or .Net you are forced into waiting for somebody else to fix the problem and it could mean the problem effects many programs instead of just one application.

Microsoft's biggest security problem in my mind is there security through obscurity beliefs. If you find a security hole in a product not telling people until you have a patch is not a valid way of operating, because if you can find a hole it is likely somebody with mal intent can also find that hole and could be already using it. Also, with the way MS changes license agreements there is no way I would ever allow one of there systems to auto download the patches and possibly make me agree to a new license without even getting an oppertunity to read it.

Re:Let's be honest

[hauer]

I really do not think that I need you holding my hand.

You might notice that I also omitted 90% of the original post, points which I agreed with and/or which I did not want to comment on (just like the "[...]" which I found completely valid).

In his paragraph the original poster made an association between performance and computers being idle 99% of the time. My reply referred to this and I felt no need to repeat the axiom that man-hours cost a lot.

The OP made a bunch of good points, I offered one myself, you now repeat one of the original points.

"Next time" I would not grab keyboard for this...

Re:Let's be honest

[Anonymous Coward]

Nice, complete, objective, internal view of a rectum.

Re:Let's be honest

[Judg3]

What Windows IDE will do syntax highlighting for Python
How about PERL?
or PHP?
or Ruby?
or any of the other numerous languages that are not only supported, but are afforded real, working tools natively supported by the environment.


Sapien Primalscript.

Supported Languages:

ASP, ASP.NET, ActionScript 2.0, AutoIt, Awk, Batch, Ch, C#, CSS, ColdFusion, Flex, HTML, InstallScript, JSP, JScript, JScript.NET Java, JavaScript, KiXtart, Livewire, LotusScript, NT Command, Netscape, PHP, Perl, Python, REXX, Rebol, Ruby, SQL, Tcl, VB.NET, VBScript, WinBatch, XML, and XSLT.

Re:Let's be honest

[Judg3]

I posted it above but I'll say it again heheSapien Primalscript.
I've been using it for 2-3 years now and really like it. I write a lot of scripts, but few full blown programs so it really works well for me.
I especially like it's "Snippets" - you can define whole pieces of code that you can save to it (Like I routinely write VBScripts for Win2k and have a custom logging function I use in all of them) and simply click on it to add it to the current script. Saves a lot of time. There's a 30 day full trial to test it out and it runs $179 - which isn't realy expensive for what your getting. Check it out.

(No, I don't work there - I just love the product)

Re:Let's be honest

[scrytch]

> Qmail is pretty damn close.

But no cigar, as it is designed to bounce mail to nonexistent recipients, thus turning your box into a spam relay where all a spammer needs to is move the victim from RCPT TO to MAIL FROM.

Re:Let's be honest

[_Sprocket_]

It is simply ludicrous to assume that one admin, or even a team of them, is going to manually install patches to 50,000 workstations every couple months.

A good point. But then, it's already been pointed out that a Linux admin can automate this process. And have been able to do so for some time.

And that's the point. Automatic updates hasn't been highlighted in the Linux world because it has not been a problem; either because Linux admins don't see a personal need to do it or they already do it and don't see it as something special (how else do admins for large Linux server farms operate... or the IT folk for the likes of Burlington Coat Factory).

Re:Let's be honest

[j3110]

I'm just going to respond to the common themes in one place, I'm not picking on you :)

The arguements seem to be:
Auto updating can break things?
a) If Linux had a good API standard it wouldn't be possible. The kind that come with an application development platform built on top of a kernel. The kind that usually are named after caffeinated beverages or top level domains. Python could become an excellent API, but some people are going to want better performance. If you go Java, you'll have to go Kaffe, which is still young. .Net/Mono is still a little risky. I know what the solution is, but I don't know how far away it is. A standard, safe platform for development is going to be neccisary if Linux is actually going to go desktop. One could be built in C, but that would be putting us behind everyone else who has had a C platform for years. We need a VM platform as well. As of right now Java is the only thing that could actually work in terms of performance.
b) Even in the case of using C, there are enough projects running at Debian that they can test the API enough to know it's not going to break anything in Stable. It's not a big deal to offload the testing to distros, infact, it's part of their job. A package that breaks anything should NOT make it out to stable ever. If it does, its a rarity, and you can just go roll back some updates which should take about as much time.
c) If this is going to be the year of the desktop, we have to start acting like it. End users are too stupid to update their own systems. Auto updating should come on by default, and then we as smart admins should turn it off on servers. Expecting an idiot to enable it isn't going to happen. Maybe if you made it default on in the installation scripts, that could work, but it'll have to default on, because they don't read the EULA, you think they are going to read the actual questions?

Some people say that MD5 sums are good enough "code signing". They aren't unless the kernel checks them when loading a program and refuses to load it if it came from a root kit. Signing would certainly be easier than downloading MD5's from the original site over an SSL connection every time you run a program. We still have problems with trojan utilities on Linux that MD5 is really not going to fix.

There are a lot of IDE's for those languages, most of them written in the language. Python, I know, has a ton of good IDE's. PyPE is one of my favorites.

One person argued that you have control in C over bugs in the environment. You have no more control over bugs/buffer overflows in C as any other language. You do have to use libraries, and Python is open source. It's better that security was handled by only a couple projects instead of every single project.

I would be very much interested in volunteering in making a secure open-source framework for applications if the average open-source crazy man would actually use it. It's very much needed. I envision an RPC with SSH encryption and single sign-on support with trusted servers. You could have functions available in SOAP over HTTPS simultaneously and be able to make good, distributed, secure software with both proprietary and open RPC standards and top of the line security. Client applications can generally be trusted to run in C, thus the whole system will appear to perform just as well, I think.

Re:Let's be honest

[AstroDrabb]

Updates are usually still handled manually with apt-get update/upgrade. RedHat has live notification, but it's still done manually for the most part, which slows down the process.

BS. Red Hat has the Red Hat Network. It allows you to automate the updates for ALL your servers/desktops. You can group your boxes into any structure you want to create and push updates out to those groups as a whole or any individual box. I have been using this to updates many Red Hat servers for a while now with out any breakage. I cannot say the same for some MS Windows updates. In fact, I never have to physically touch the Red Hat boxes. I get an email when there is an update. I go to the web site and can push the update out right away or schedule it. I then get an email when it is finished. It cannot be any easier.

Re:Let's be honest

[Avihson]

It is simply ludicrous to assume that one admin, or even a team of them, is going to manually install patches to 50,000 workstations every couple months.

Funny, that you never heard of login scripts.
When the user logs in, a simple entry in their .profile will check for updates, MOTDs, actually anything you want it to do.
If Linux gets to the critical mass where routine updates are needed, you test the patch in the lab. Then post it on an inhouse server. All the desktop login scripts have a line pointing to that server. That line runs an update if it exists on the server, if no update exists, it exits and the user never knows the difference.
If you are really cranky, you can have a cron job checking every 4 hours for updates, and not post them to the server until they are vetted. You don't even have to worry about the users logging in, it updates while they are at the bar!
But none of this prohibits the savvy user from updating his/her own machine, instead of waiting till the next cycle.

Where is the problem again?

Re:Let's be honest

[lafiel]

Whether he made a good point or not, it seems to me that you are ignoring it and nitpicking on something that was never his point. Intentional or not, the point was manhours are being wasted. The whole performance thing and computers being idle are simply to show that "you can afford to waste a couple cycles if you can save a manhour". Nothing more.

As well, the lack of verbal agreement on your part (not even the slightest - "those are good points, but...") made you seem nitpicky, and rude.

I agree your point is valid, if the poster meant it that way. However, it was merely an aside to help out the whole manhours issue.

Again, read the entire post. If you have omit words within his sentences while quoting, you're taking it out of context. Think twice before complaining.

Next time you grab a keyboard, I look forward to a great post from you. Have a fantastic Friday.

Re:Let's be honest

[Overly Critical Guy]

MS is still lacking on speed to update. The RPC bug was on the streets long enough for exploits to be written BEFORE they got even the smallest patch out. The big worms came after they did get the patch out, but people weren't updating.

Wrong, they patched that thing over a month before, and even the government warned people to patch--twice.

Only a month later did Blaster come out, and all the morons who didn't patch were exposed. What do you want Microsoft to do, hold your hand and wipe your ass for you? Sometimes, users have to accept blame for their own unwillingness.

Re:Let's be honest

[Lozzer]

If you just want to count tcp listening sockets, you can do

netstat -tl|wc -l

At least with the netstat I got from Gentoo. Your code will count any tcp sockets.

Re:Let's be honest

[poot_rootbeer]

In the future, code written for windows will be written in .Net by default, and buffer overflows will pretty much go away.

In newly-written code, sure. But I bet it'll be at least 10 years before you'll be able to run a Windows desktop with NO legacy code on it.

MS is working on code signing at every level of the system. This means no more boot viruses, no more trojans.

Unless the trojans find a way to sign themselves as valid code. Think someone will eventually find a way to do that?

Re:Let's be honest

[poot_rootbeer]

That is crap, Im the sysadmin, I want to make sure that the system is updated NOW.

Exactly what kind of patches are you applying that it makes a difference whether it's applied now, or 15 minutes from now?

Re:Let's be honest

[junkgoof]

And Microsoft updates tend to break stuff. I haven't had a linux update break anything yet. I've had to reinstall hardware (and explicitly uninstall and reinstall some of it) after a Windows Update.

Re:Let's be honest

[kryptoknight]

Viruscan reports this bug as a trojan whenever it sees %00 in IE.

Re:Let's be honest

[jamwt]

Good point, but not really relevant to the discussion: it's not a security issue. Your server is not comprimised by a spammer's exploitation of this MTA behavior.

Re:Let's be honest

[Anonymous Coward]

So what cd is AVG and Sygate on? You would have to download those wouldn't you. I see the point you are trying to make but to me there really isn't to much difference setting up linux or windows. In fact the linux installation is arguably easier if you are using something like mandrake. Other things are easier to do in windows. As far as ease of making them secure i would say that linux is far easier to set up that way.

Re:Let's be honest

[j3110]

Actually, MS breaks compatibility with old software all the time :) I'm sure they'll do so again in Windows 2003, and then everyone will probably just go .Net then. Also MS has been known to run old code in compatibility layers, that could be VM like in the future.

Given MS history of security implementations, I'm sure someone will find a way to sign a virus or get one through email. Implemented properly though, it would be hard, because whoever's key signed it will be revoked and virus will be stopped dead in it's tracks. No more ongoing wars with viruses like Blaster.

They're steps in the right direction, and they will help. How much help it will be only time can tell. I'm just frustrated that a lot of Linux developers seem to be stuck in 1980.

Re:Let's be honest

[Ironica]

Exactly what kind of patches are you applying that it makes a difference whether it's applied now, or 15 minutes from now?

If I understood the parent correctly, when he said:

- Client cannot be controlled, you cant use Windows update to update your system NOW, you will have to rely on reghacks, and stopping and starting services, to make sure your system will be updated in approx 15 minutes..

He was saying that if you want to manually activate Windows Update, you have to hack the registry and then stop and start services... just to get it to run in the next 15 minutes. Otherwise, I guess, it simply goes on its own schedule.

I have no experience with this particular product, but from what he said it seems that it takes jumping through hoops to even manually initiate Windows Update.

Re:Let's be honest

[Ironica]

I have to give MS two thumbs up. They now have automatic updates pushed to clients.

Yes, they do, don't they?

So I can ask my computer to automatically get critical updates. If I do that, I'll get an update for Outlook Express 6.1. Funny thing is, Outlook Express isn't even installed on my computer. It's not in the Add/Remove Programs control panel. It's not checked in the Windows Components section of that control panel. But if I just let MS update my computer, they'll install a patch for it anyway.

And as we all know, installing things when you don't need to simply ups the chances that you will have problems for no good reason.

I think it's premature to be happy about MS automatically pushing updates when they're still cluttered in this manner. It's also somewhat confusing for Joe User that Outlook Express and Windows Media Player are updated by the main Windows Update, but that other MS programs are not... one might assume that, since those apps are included, all MS apps are included and you can one-stop shop for your updates.

And then there's the fact that more advanced users may not wish to install critical updates for services that they have disabled anyway, so automatic pushing is a detractor and not an enticement for them.

Re:Let's be honest

[Ironica]

>> MS's software is only used on desktops because everyone knows it.
> Um, a majority of enterprise environments that I work in all use Win2k servers to a good degree of success. (Some of the logic to use Win2k is pretty lame...most could easily be replaced with Linux based systems. )

I think you misinterpreted the parent's meaning: try "The only reason MS's software is used on so many desktops is because everyone knows it." I don't think he was trying to comment on server use at all in that statement.

Re:Let's be honest

[Afrosheen]

FreeBSD or OpenBSD? But we're talking about stuff that's still alive right? ;0

Re:Let's be honest

[hauer]

the lack of verbal agreement on your part (not even the slightest - "those are good points, but...") made you seem nitpicky, and rude

I did not feel that way. If it was so then I apologize to the original poster, but I find it counterproductive that you are trying to balance it with your intentionally insulting reply. At my age, you are unlikely to change me, especially that we do not know each other, thus you might want to save me from your further lessons, please.

And if as you say that he meant indeed that The whole performance thing and computers being idle are simply to show that "you can afford to waste a couple cycles if you can save a manhour". (which I do not think he did) then the reason for not seeing the slightest verbal agreement on my part would be that I simply do not agree with that. And I think that disagreeing is far from being rude.

The way I interpreted his argument was this: programs are written in C traditionally, because of performance. Because programs are written in C, they are inherently less safe thus have shorter lifecycle, resulting in frequent updates costing man-hours. This I agree with and indeed you cannot just migrate from C to something else when you already have almost everything written. But IMHO it has nothing to do with the association he makes between computers being idle 99% of the time and the compromise on performance.

Tamas

Re:Let's be honest

[Brandybuck]

I'm starting to come to the opinion that no software over a certain level of complexity will ever be secure. And that level of complexity is pretty low.

The state of software engineering is starting to collide with the real world. Taking a look at the real world, I see that a simple sledgehammer will force entry into my home, regardless of the number of locks on my door. Unauthorized entry into my automobile is similarly trivial. I have IT managers screaming at me that their security audit managed to crack my login password in only 46 hours, but I have never had any landlord advise me to put steel plating on my front door. What's the difference?

Software over the complexity level of a simple command shell is going to have bugs. It will have undiscovered exploits. It will not be perfect. Yet we still rely on testing to discover an eliminate bugs, even though testing cannot possibly find more than a fraction of them. If you've ever done any commercial software development, you know that the most insidious and intractable bugs are those found by the customer out in the field two years after the software was released.

Can high level languages solve this problem? No! High level languages have complex, buggy, and insecure interpreters. Is Free Software and a thousand eyes the answer? No. It may be the answer to some problems, but not this one.

One solution is to stop demanding new software and new features on existing software, and accept the current state of the art, in hopes that in ten or twenty years today's software will get all the wrinkles out. But that's extremely unrealistic.

The only solution I can see is to accept the fact that all software is buggy, unstable and insecure. I can accept the fact that anyone with a sledgehammer can break down my wooden door in spite of the deadbolt. I also need to accept the fact that anyone determined enough can break into my system despite all the work I've done to secure it.

That doesn't mean I give up, however! It means I have to change the way I think about things. Even as recently as this Tuesday I almost got burned by failing to backup my data. I wasn't thinking in terms of "I could lose it all". My behavior would have been very different if I had. What I need to also do is start thinking "my security could be breached."

Once the general public understands that all software is crap, the industry (and hobbyists) will start releasing software of a different nature. It won't be more secure or less buggy, but it will take into account that it isn't.

Re:Let's be honest

[I_am_the_man]

Man you are way off regarding automatic update and Linux. I use apt-rpm and can set it up to do many kinds of automatic updating. I can deploy updates from one machine to the entires company either automagically or manually. I *never* have to visit a *NIX box. In fact if you do *have* to go visit a *NIX box for anything but a complete hardware failure then you are a shitty admin. Windows boxes are the only boxes that I ever had to go visit. What you laud MS for being able to do I have been able to do in *NIX for years, with or without deployment tools such as apt. *NIX environments are fully automatable out of the box and have always been that way. Don't come here telling us about some new Microsoft automation feature and expect any *NIX admin worth a shit to even be mildly impressed.

In fact I am calling for a ban of any comments that have to do anything with Microsoft automation tools. Especially any which must be payed for. Mentioning such things is like going to the Detroit Auto show and talking about how your favorite brand of cars now have windshield wipers.

Re:Let's be honest

[Anonymous Coward]

2: Blaster.
The most popular platform, ran by the most people in the world

If only there was an open-source project that was the most popular of its kind in the world, so we could compare apples-to-apples..

Re:Let's be honest

[Robert The Coward]

The RPC fix once MSblaster is tring to rip thought your network.

Re:Let's be honest

[Anonymous Coward]

Jeeez, what a troll!

All the things you praise MS for moving ahead on are things that MS caused in the first place!

The reason they need updates pushed to clients is that there are so many damned updates that up to 50% of large companies' network traffic is just MS updates. The only reason they need server tools to cache updates is because they NEVER test enough to make sure the updates won't break things. And their software design is soooo convoluted that changes are just bound to break other, seemingly unconnected things.

Only the smallest part of .net has anything to do with buffer overflows. If you insist that is otherwise, I refer you to the many conflicting articles on .net that prove that MS doesn't know what the hell .net is; how could you? A .net architecture wasn't needed to secure various linuxes; why is it required for MS? Answer: it isn't.

Code signing at every level of the system is a solution to MS's problems exclusively. Their poor design is the only reason that so many exploits have had free reign on every Windows system, NOT a lack of code signing.

This is all nonsense. MS created all of these problems, setting computer development back by how many years. Now you want to praise them for fixing their own mess and proclaim it as progress! At the same time, you claim that Linux, beacuse it didn't create these problems in the first place, is sliding behind because it isn't working on problems it doesn't suffer from!

Re:Let's be honest

[mvdwege]

Exactly what kind of patches are you applying that it makes a difference whether it's applied now, or 15 minutes from now?

Given the propagation speeds of most worms on the Windows platform, I'd think just about all patches?

Mart

Re:Let's be honest

[Anonymous Coward]

There was evidence to prove that Overly Critical Guy is a lying cocksucker, but he deleted it. Think independently.

Re:Let's be honest

[AbbyNormal]

Um. Sorry, should have been more clear. In general, I've found, if the servers are NT, then the clients are too.

Re:Let's be honest

[Robert The Coward]

Small? What planet are you updates coming from. It seems like all of them are 10 Megs in size. Most apears to be around 1 Meg. but unless you have broadband access that will make a major dent in you bandwidth.

Re:Let's be honest

[Anonymous Coward]

Personally, in the year or so I've been using XP, I've found no reason not to have it set to automatically install updates. Nothing has broken, and if any unpleasant features have been installed for me, I certainly haven't noticed. (And given the way sites like /. and the Register jump all over anything MS does, I assume that nothing has been)

After an update a couple months ago my development environment produced programs that would always immediately crash. I lost a lot of productivity trying to reverse what the updates had done, but they had quietly changed something that uninstalling every update ever installed wouldn't fix. Eventually I found the visual c++ CDs and tried reinstalling them and that got it working.

I'm now a lot more wary of updating critical machines.

Re:Let's be honest

[Ironica]

Um. Sorry, should have been more clear. In general, I've found, if the servers are NT, then the clients are too.

Still don't think that's relevant to the poster's comment. There may be a correlation, but that doesn't imply causality. If most clients are Windows-based because that's what people are familiar with, then most clients will be Windows-based whether the server is NT or *nix or something else. [Insert stupid analogy here.]

Re:Let's be honest

[Anonymous Coward]

The point that amazed me while reading the article is the fact that only 6 critical updates have been released for windows 2003. I would venture to guess that >90% of the code in 2003 is the same as 2000, whereas 2000 was a major upgrade to NT. I find that point brought up by news.com very irrelevant. I think we are compairing apples and oranges here.

Re:Let's be honest

[Anonymous Coward]

Yes, lets be honest....

Microsoft has a miserable track record on security... null shares... say hack me because I am friendly.

Well the fact of the mater is this industry is growing up fasster than Microsoft. Security MUST be a player up front in design, before marketing and PR. Otherwise, it will just catch up to Microsoft...and others that look for the quick buck.

Careless computing charges are coming, as careless driving came to automobiles. And drunken Microsoft deserves a DWI.

Re:Let's be honest

[AbbyNormal]

Linux, netware, and other operating systems are still used for servers more often than Microsoft's software. MS's software is only used on desktops because everyone knows it.

I was saying the poster's point was flawed and are based on sweeping claims.

There is a direct correlation, and it has nothing to do with what "people are familiar with". If a a special agreement is extended by Microsoft and a company, than that company is most likely going to use Microsoft products. Its all run by politics and the end "client" user is forced to use whatever his/her company dictates. Look at IBM and their forthcoming effort to switch completely to Linux. I'm sure there are a lot of people working at IBM not familiar with Linux (admin staff etc)

Re:Let's be honest

[ssstraub]

2: Blaster.
The most popular platform, ran by the most people in the world, etc. is bound to have security holes that get exploited

Apache: 67% of web servers.
IIS: 21% of web servers.

Which web server has had CodeRed, CodeRed II, and nimbda worms wreaking havoc? Was it the most popular software or the Microsoft software?

Re:Let's be honest

[TyrranzzX]

Linux was designed for people who know what they are doing, and eventually it'll evolve into something any idiot can use. I believe in the next year that'll happen even more than it has. We'll see some standardized linux distro's coming out that are better than windows xp.

Re:Let's be honest

[aztracker1]

> What Windows IDE will do syntax highlighting for Python
> How about PERL?
> or PHP?
> or Ruby?
> or any of the other numerous languages that are not only supported, but are afforded real,
> working tools natively supported by the environment.

Not an IDE, but supports syntax highlighting, and is a great editor for windows, in general, I use it for pretty much any text based editing... crimson editor

Re:Let's be honest

[sql*kitten]

you will have to rely on reghacks, and stopping and starting services,

Oh please. On Windows it's a "reghack", on Linux it's editing /etc/whatever.conf (which is probably a different format from everything else in /etc, at least the Registry is more-or-less consistent). On Windows it's stopping and starting services, on Linux it's kill -HUP pid.

The Microsoft way is no less inelegant that the Linux way, yet still you fault them for it. By all means bash MS if you have a valid complaint, but that niggling over irrelevant details just shows you're out to bash them whatever they do.

Re:Let's be honest

[Anonymous Coward]

7: Linux is known for it's efficiency. On a server, efficiency > ease of use. Ms's software was designed for idiots, Linux was designed for people who know what they are doing. Linux is for the person who says "my powersupply blew out last storm, I'll replace the fuse and see if it works" whereas microsoft is for people that say "computer doesn't work = replace computer".

Look who's talking.
The very reason why F/L/Oss is what it is, is because we know what we're doing and using.

I don't like to bash MS without reason, but bashing idiots is a different story...

Improved marks?

[Anonymous Coward]

Stephen O'Grady, agrees that he would give Microsoft 'improved marks,...

Going from an F- to an F+ isn't something to get excited about.

Bring back the GOATSE!

[Anonymous Coward]

Now look at that domain, it's been suspended
They pulled the plug on the goatse
It ain't workin', someone must've screwed it
Domain points to nothin' no more goatse
It ain't workin', someone must've screwed it
Lemme tell ya, this sucks big bum
Guess I'll have to troll to tubgirl
Guess my ASCII goatse will seem quite dumb

We gotta install a new domain
We want our civil liberties
We gotta have our big ol' anus
We gotta have our goatseeeeee.

See the little faggot with the big old wang
Yeah buddy that's just the giver
That little faggot got his own man sausage
That little faggot he's a goatse queer

We gotta install a new domain
We want our civil liberties
We gotta have our big ol' anus
We gotta have our goatseeeeee.

I shoulda learned to stretch my anus
I shoulda learned to stretch my bum
Look at that gaper, he got it stickin' in the camera
Man we had some fun ...

I want my, I want my, I want my GOATSE!

new differnce

[Hes Nikke]

now that i'm an MCP (sucks huh?) i'll be trying to get as many people away from the Microsoft platform to something more secure at every opportunity i can get :)

i'm calling myself a trojan horse :)

Re:new differnce

[tankdilla]

Convert other MCPs like you so that you in essence self-replicate and become updated to a virus.

Re:new differnce

[kevcol]

He cant do anything that would violate DMCA

Re:new differnce

[Hes Nikke]

wasn't that the plot in tron?

*ducks*

Re:new differnce

[steveha]

i'm an MCP

Do you have some guy named Tron throwing a glowing frisbee at you now?

Sorry, couldn't resist. :-)

steveha

Re:new differnce

[Anonymous Coward]

that made me laugh.

mod up.

Re:new differnce

[Zwets]

Wouldn't that be a prion? A little bit of protein that restructures other proteins in its own image?

You would be a virus if you have kids and teach them not to use MS. :-)

Re:new differnce

[Anonymous Coward]

I've been a MCSE for years and have been trying to get the brain-dead MS people to switch to Linux or BSD. The biggest problem I have is getting them past all the MS FUD about opensource.

Re:new differnce

[kevcol]

Overrated? But it wasn't rated at all- it had +1 karma posted as default! Listen you fuckin' pantywaist mod- howzabout I take a rusted can opener and remove that brain from your skull with a dirty litter box scooper? You sure ain't using it! Painful, horrible death to useless idiots like you!

There. I feel better now.

Let's Compare

[Anonymous Coward]

I would like to see some comparisons to Red Hat version 7.2 (since O1) compared to XP (in terms of security patches, not bug fixes).

Heck Red Hat doesn't even support it anymore! 9.0 is coming up too!

Re:Let's Compare

[Anonymous Coward]

9.0 is been here and gone, bitch.

Depending on five year old software is so 90's. Get with the program.

Learn how to use package managers to keep your system up to date with the latest releases. It's not like it costs anything or takes more then a half hour of work a week.

Oh. Wait. You can only do that with Linux or a BSD. hmm. I guess all you windows users ARE stuck with 3 year old software...

Well at least until 2007 when the next "longhorn" OS gets released. Save your pennies till then!

CYA

Re:Let's Compare

[Anonymous Coward]

Ah, package managers.. in practice the very essence of vendor-tie-in from the people who nominally claim to despise it the most!

And I suppose that you're one of those people who slams microsoft for stopping support for win95.

updating my copy of windows takes about 3 mouse clicks. 1/2 hour a week vs 3 mouse clicks.

Re:Let's Compare

[Penguinshit]

I'll see your three mouse clicks and raise you a two-line shell script.

Re:Let's Compare

[inode_buddha]

"I'll see your three mouse clicks and raise you a two-line shell script."

Which could even be stuffed into a cron job if you're not paranoid. Therefore, zero mouse clicks, and CLI only 1x.

Re:Let's Compare

[hdparm]

Plus no reboots (kernel excluded).

I seriously doubt in Microsoft's ability to gain back some degree of trust after years of total neglect. They'll have to do much better for much longer.

Re:Let's Compare

[inode_buddha]

True about the reboots, though I believe that MS has the UI nailed. The thing that boggles my mind is that despite having what I consider a very favorable UI, most end-users that I know never update, even if they've heard of updating. Geez, if people want toasters, maybe they should get toasters.

Re:Let's Compare

[MattMan741]

being up to date with the latest release is very different the installing the latest security patches. you guys are comparing apples and oranges. unless, of course, you can go from win2k to winxp in 3 mouse clicks....

No news isn't good news

[eamonman]

Funny, it seems to imply in the news.com article that less advisories are better than more... hell, I think my ol' comp running win98 went for many months last year without a single advisory notice when I clicking into the Windows update site. Pfft. So therefore win98 is safer than Server 2003... :P

Re:No news isn't good news

[AntiOrganic]

These criteria really shouldn't concern themselves with the amount of advisories, and instead should focus with the damage caused by worms and virii taking advantage of these security holes. 2003 brought us Slammer/Sapphire, which brought down South Korea's entire Internet infrastructure for days and did serious damage everywhere else, and the various RPC worms. You can't put a Windows machine on a broadband connection long enough to even download the RPC patch without getting infected on most ISPs unless your ISP blocks port 135, like most are beginning to.

I think this was pretty damn poor compared to a few years ago.

Re:No news isn't good news

[RESPAWN]

Funny, it seems to imply in the news.com article that less advisories are better than more... hell, I think my ol' comp running win98 went for many months last year without a single advisory notice when I clicking into the Windows update site. Pfft. So therefore win98 is safer than Server 2003...

That's more or less what one of my clients said when I visited him to help get rid of the RPC virus. Granted, since most of is computing infrastructure is Windows 98 based, his site wasn't as hard to repair as some others, but I'm still not sure if using an outdated OS is a real solution for security.

Re:No news isn't good news

[laugau]

Just do what my mechanic does (and what microsoft made a business of). Leave something broken so they call you back. Or, if nothing is broken, plant a time bomb

Nor really

[Cipster]

I thought an Incomplete actually counted as an F.

I think the appropriate grade for this would be an IP (in progress).

Re:Nor really

[servognome]

It just means MS isn't eligible to play sports this semester.

Re:Nor really

[prockcore]

IIRC, an incomplete doesn't count as anything.. it's the same as if you had never taken the course at all.

Which is also, oddly appropriate.

Re:Nor really

[Anonymous Coward]

or possibly,
Security: n/a

Re:Nor really

[Red Pointy Tail]

Probably was a typo.

What they meant was 'Incompetent' :)

Re:Nor really

[Cipster]

For GPA purposes it counts as 0 points earned (same as an F). Once you take the class over you replace the 0 points with whatever you earned the second timr around.
Still very appropriate.

Re:Nor really

[74nova]

just so long as it's not a W for "withdraw"

Re:Nor really

[Ironica]

I thought an Incomplete actually counted as an F.

I think the appropriate grade for this would be an IP (in progress).

At UCLA (at least for the School of Public Policy and Social Research graduate programs) an In Progress is the grade during the term. An Incomplete is the grade you receive after the term has ended if you haven't finished the coursework and the professor feels like being nice. The Incomplete counts the same as an In Progress as far as GPA is concerned, which means not at all. After the following term, it reverts to an F if the professor hasn't submitted a new grade (which means that even if you turn in the work, you better follow up and make sure they do the paperwork...)

Wait a minute...

[AstrumPreliator]

Does anybody remember the article where old Microsoft basically said it was the end consumers responsibility to keep things secure and not the developers? I'll have to find the article, but it's only a couple months old or so. I think the "report card" should be re-evaluated knowing that Microsoft really doesn't care about security like they claim to.

Re:Wait a minute...

[JanusFury]

It is a responsibility of the end-user to keep a computer secure. If you are in control of your PC, it is your responsibility.

If the end user was to grant full control over his computer to Microsoft, then it wouldn't be his responsibility to keep it up to date.

'Secure' technlologies like the DRM used in iTunes' M4P and WMP's WMA files are exactly that - granting some of your control over your computer to those companies in exchange for being able to get music files.

In this case, by granting some of your control over your PC to Microsoft (allowing them to automatically update your PC with new fixes) you can gain more security.

But do you really want to leave your security and privacy in the hands of a corporation? Or would you rather spend the time to do it yourself? You can't have it both ways. Either you keep your PC secure (either by updating Windows often and using a firewall and not visiting random sites and opening random attachments, etc., or by switching to a more secure operating system), or you let someone else do it for you.

Re:Wait a minute...

[AstrumPreliator]

Okay, here is the article.

ITB: Security starts with the developer. What do you think that developers can do to harden their apps and how is Microsoft helping with tools?
BG: You don't need perfect code to avoid security problems. There are things we're doing that are making code closer to perfect, in terms of tools and security audits and things like that. But there are two other techniques: one is called firewalling and the other is called keeping the software up to date. None of these problems (viruses and worms) happened to people who did either one of those things.

So why are we grading Microsoft on security when it is apparently the consumers responsibility. I'm not saying I disagree with taking responsibility as a consumer, but I don't think Microsoft is adequetly doing their job.

Re:Wait a minute...

[Anonymous Coward]

End Consumer?

You mean the one who buys his or hers at Walmart?

"HA HA HA" said the mighty Bill Gatez as he loudly stated "sucks being you, you silly digital illiterate"...

Next?

Re:Wait a minute...

[poot_rootbeer]

I don't think Microsoft is adequetly doing their job.

I don't think they're at 100% yet, but they're moving in the right direction.

Are you adequately doing YOUR job to keep your system(s) secure? It's a shared responsibility.

Re:Wait a minute...

[owlstead]

I think you are confusing the responsabilities of keeping a computer secure. First of all, it's the developers responsability. They should create secure programs and release updates if the software is found to be broken asap (thus not after a month of possible mayhem).

Obviously the end user has to do his part too. Install a firewall (which should at least be included), watch which mail attachments to click, and which programs to install. And obviously, keep up to date.

I don't see how your description of DRM has anything to do with security. It doesn't, not in this sense. Do you keep updated with fixes automatically if you use DRM? Or are you concerned about malicious music files?

And yes, both developers, corporations _and_ end users are responsible for security. You should implement security on every level. Can an end user do anything about harmfull word attachments? Outlook (Express) scripting? IE holes? (fill in rest of list).

Just saying to users that they should use another product is not feasible. Corporations should make sure that a product is reasonably secure from the start. Microsoft definately does not have an advantage on that point.

I must say that they are getting slightly better over time. Ending buffer overruns is a good thing. Now they just have to get the idea of sandboxes and firewalls (starting up IN TIME, hah) and they are getting somewhere.

Re:Wait a minute...

[happyfrogcow]

I agree, and to add to that, relying on a piece of software that was developed to be the target of a marketing campaign is a sketchy at best. It's like believing the product labels for greasy potato chips that say "Less Fat!" then wondering why you have all this fat attached to your body all of the sudden, or you're grasping your heart in pain. Government regulations were made to clarify such labels. Which isn't to say everything needs government regulations, but i think the above was a good use for them.

As for email attachments, there is no sane reason why clicking on one should run it. the only thing an email program should allow a person to do with an attachment is save it, and make the user assign a program to open it up with (making the default action of "double clicking" to be "open with X program" instead of "try to run this program"). That way if you try to "double click" what you thought was a .gif but it's really an executable, your image viewer start up and will try to open an image and fail, instead of executing arbitrary code.

I can't forget about fact that a spreadsheet or word processing document can harm my system. It's redamndiculous. why would Joe User ever think that it could happen and be relied upon to make sure it doesn't? Software companies need to take so much more responsibility.

MS improving

[Esteanil]

That MS is actually improving security is good for all of us.
It's about time, and they still have a long way to go, but increasing security gives less room for E-mail viruses, worms and other network-hogging exploits.

Hmm... Any chance of a class-action suit from people who do NOT use Microsoft, addressing the way their lack of security has wrecked important services for non-MS users?
After all, those of us who don't use MS have never accepted their EULAs, but they've still wreaked havoc for our systems.
Could at least lead to an even further increased MS focus on security, which would help everyone...

Re:MS improving

[Flingles]

Ever heard of someone being punished for being attacked? I'm no Microsoft lover but they didn't make the viruses.

Re:MS improving

[mingot]

Amazing how stupid litigation (eolas, your idea) is praised when the business end is aimed firmly at Microsoft, but "other" stupid litigation (riaa suits, sco) is decried when its business end is pointed at the "average Slashdotter's" belly.

Re:MS improving

[CAIMLAS]

That's nonsense.

Less security problems in MS products now is ultimately worse for us. Here's why:

If MS products become good, more people will want to use them, and there will be less interest in linux as an alternative. MS's behavior is constantly reminiscent of an emire, trying to usurp the rights of others for their own good.

So how exactly is the profitability of someone/thing that wants to take my money, my propery, and most importantly, my rights, a good thing for anyone, let alone everyone?

It's not.

Software is now becoming a thing of utility instead of a commodity. Would you like the cell phone service you pay for to come with a stipulation that they can sell any/all of your information, or that they legally own anything you might say on their service, and have them be your only option - while paying 3x what you are currently? That's what it amounts to.

Re:MS improving

[Anonymous Coward]

It's now a foregone conclusions that Microsoft's security record will massively improve. They have they resources and they are spending the money to make it happen.

Better get a new sales pitch.

Re:MS improving

[Anonymous Coward]

MS improving? What a joke! The ONLY way that Windows would be secure is if they ditch the worthless NT kernel and go with a real kernel like Linux or BSD. But that will never happen for several reasons.

1. With a more stable kernel, comes a more stable system. If the system is stable and nobody needs to upgrade, then how can MS make money tricking people into buying a "more stable" version.

2. If MS actually used one of those stable kernels, then they would have to follow their licenses and release the appropriate source code. Doing this would mean that all developers, not a chosen few, would have full knowledge of the inner workings of the OS. What does this mean? It means that things such as Mozilla and Open Office can be intergraded into the OS as well as IE and MS Office is today.

3. They would be admitting that Linux and BSD was a better product than Windows. Bill Gates is still living down statements such as "Who needs more than 640K?" and "The internet is only a fad." Do you think he wants "Windows is better than Linux" to be added to that?

Re:MS improving

[aztracker1]

Sorry to inform you, but the NT kernel is probably at least as stable as current builds of the linux kernel... It is several layers of drivers that run at the kernel level, and software above it that make it unstable... Beyond this, I have seen plenty of buggy drivers in linux in the past few years, that cause as many issues as a buggy driver in NT based windows... at least in windows, I will usually get a dump screen... in Linux, I don't even always see a panic...

sorry, but your post was a pretty obvious troll... and severely uninformed.

The NT kernel has many similarities to the *nix kernels, since MS owns Xenix, in addition to creating OS2 originally, which is what NT was based on... OS2 being, imho, one of the best OSes ever invented.. not withstanding some better interfaces than the PM that os2 used.... As for the mis-spoken estimations of importance, there are several that have plagued linux... personally, I don't see 2004 as the year of the linux desktop, I think, maybe late 2005, early 2006.. this will be the case, which should be around the time ms's whidbey comes out.. and should be pretty interesting to see what happens... I would love to see the mono project have a full release with a polished #WT based #develop by then.. with some support for XAML under *nix... that could come out to an interesting proposition... especially if they can beat MS to the punch. With the current emphasis on MySQL 5's SP's, perhaps a generic engine similar to the next ms-sql to store native objects (serialized) would work to push java and the mono (.net) framework... and offer a comparable solution to ms.

the issue with windows, is that for developers, it is pretty easy to create an application for internal use.. distribute it, and expect it to work... with the broader range of dependancies for various softwares, it isn't as easy for corporate use... that is where mono, although fairly immature as a platform currently, is imo one of the keys towards linux adoption on the desktop.

Can't get into Yale with this...

[dominion]

And so we have a report card that wouldn't get you accepted to a state university, by the largest, most economically endowed entity in the world.

I'm sorry, Microsoft, but you have to be held to higher standards, not lower. Open source is able to do better with infinitely less.

If a bunch of hobbiests were able to colonize the moon, would we hold back any criticism of NASA?

Or maybe we've just figured out a better way of doing things. In which case, maybe the soft spot for the dinosaurs is somewhat warranted.

Re:Can't get into Yale with this...

[mumblestheclown]

And the sad thing is, your gratuitous cheerleading will probably be modded "insightful."

Look, I have on my desk a rock. It has never been broken into by hackers. It rejects all spam sent to it. It was free.

And yet, somehow, I don't think the world will soon use rocks instead of computers to connect to the Internet. If we go with the premise that OSS is 100% secure, this doesn't mean that it's any better a computer system than this rock per se. The tiny end-user market pentetration of OSS despite its free-as-in-beerness suggests that the moon is not yet close to being colonized by hobbyists.

Re:Can't get into Yale with this...

[Anonymous Coward]

Wow. I think we found our textbook definition of a strawman argument. I'm gonna use this for future reference.

Re:Can't get into Yale with this...

[JanusFury]

Millions of users all over the world, and hundreds of thousands of developers all over the world, is 'infinitely less'? Apparently we're operating under different standards of value here.

Re:Can't get into Yale with this...

[Anonymous Coward]

it's not like there are any security problems with linux...

http://linux.oreillynet.com/pub/ct/20

Re:Can't get into Yale with this...

[Vengie]

You'd be surprised what you can get into Yale with. Trust me, I TA CS 201/223/323 at yale.

Re:Can't get into Yale with this...

[Penguinshit]

Almost all of whom contribute their work for free, as in unpaid.

I don't know about your math, but last time I checked, "free" was considerably less than "~$38 Billion".

Re:Can't get into Yale with this...

[Malor]

I don't know what planet you're from, but on EARTH, we Linux admins have been scrambling just as desperately as Microsoft admins for the last year or so.

I've had a hypothesis for some time that the security flaw rate in Linux would decline over time and eventually approach zero, where Microsoft's would stay essentially constant. I believed this would happen because the Linux source was open and all the security holes would gradually be found and squashed, where the Microsoft source, being closed, wouldn't be as closely examined and would remain a fertile field for new exploits forever.

Well, in 2003, my pretty little hypothesis sure wasn't looking too good. I haven't actually compared numbers, but I felt like there were just as many bad critical bugs on Linux as there were on Microsoft. From my perception, the Linux rate rose, while the Microsoft rate dropped, which is exactly opposite what I was expecting.

I still believe that closed source is "fake" security, and that the only way to get REAL security is for everything to be open, but in terms of actual number of published exploits, both systems appear to be about equal at the moment.

And the standards to which Microsoft needs to be held are pretty much immaterial; only Microsoft can fix that code, where anyone can, in theory, fix bugs in OSS. Personally, I think we can use them as a yardstick, but we shouldn't be flinging mud.... very many more years like 2003, and they'll be flinging lots more of it back at us.

In 2003, OSS security sucked. I hope 2004 is better.

Re:Can't get into Yale with this...

[Anonymous Coward]

I literally hear an infinite number of people using words like "literally" and "infinitely" incorrectly.

Re:Can't get into Yale with this...

[Anonymous Coward]

Hobbyists, and I suspect that an less than dominant market share doesn't warrant the analogy to moon colonization. Save the tedious laudations until victory is achieved.

Re:Can't get into Yale with this...

[Fr33z0r]

The tiny end-user market pentetration of OSS despite its free-as-in-beerness suggests that the moon is not yet close to being colonized by hobbyists.

Actually, the "hobbyist moon mission/widely accepted linux desktop" analogy is quite a good one, we can probably do it, we just need better hardware support :D

Re:Can't get into Yale with this...

[Anonymous Coward]

No, I think we found a textbook definition of a zealot having his ass handed to him.

Re:Can't get into Yale with this...

[kmichels]

I must agree with you regarding the number of linux related security alerts there have been in the last 12 months, but, unless I'm gravely mistaken, 99% of them were POTENTIAL security flaws, and of this 99%. many of them were only theoretical and only exploited in lab situations. A lot of the "flaws" as you call them, were also going to be farking difficult to exploit, as many of them involved "standard" packages being run in "not-so-standard" configurations.

In M$'s case, most of the flaws were highly exploitable, and most of the time were exploited. And even worse was that the flaws appeared in apps/products/whatever in their standard default configs, which means that your average Winblows system was extremely vulnerable. I must agree that M$ seems to have finally cottoned onto the fact that your apps/server/whatever should be shipped in what I call "firewall mode" - ie, block EVERYTHING by default, but they've still got a lot of legacy impairing their efforts.

THe other factor to consider is that writing and fixing open source code is a matter of pride for most coders, whereas with the Beast, security, pride, accuracy and all those good things come a distant second to commercial considerations. This is the single biggest threat to M$'s security: as long as comercial concerns take precedence over writing proper code and actually implimenting proper software design, the whole "Trustworthy Computing" initiative is nothing but smoke and mirrors.

Re:Can't get into Yale with this...

[Libor Vanek]

I think that lot of bugs in Linux in the last year is caused BECAUSE exactly MANY more eyes look at the kernel. I think that this rate will go down by the end of this year (we have to "fix enough" 2.6 series) and will be very low. I'm now talking about CRITICAL SECURITY bugs (local/remote root exploit). Bugs in OSS will be always found more. There will never be any SW without security/other bugs but since kernel security won't change a lot in future most of critical bugs should all belong to us ;)

Re:Can't get into Yale with this...

[Anonymous Coward]

You know, back in the 90s when "hackers" were mainly attacking Unix systems, Microsoft used to put out a lot of guff about how security holes were only "POTENTIAL" or "theoretical".

Then the black hats turned their attention towards Redmond...

Now everyone knows that "Potential Security Hole" + Determined Hacker + Large User Base = A new worm flooding the Internet within a week.

It's not hard to imagine as Linux gets installed in more small businesses and on more desktops that the exact same thing would happen.

Re:Can't get into Yale with this...

[arcanumas]

The tiny end-user market pentetration of OSS despite its free-as-in-beerness suggests that the moon is not yet close to being colonized by hobbyists.

No, it just means they didn't turn it into Las Vegas when they got there.

Re:Can't get into Yale with this...

[CGP314]

If a bunch of hobbiests were able to colonize the moon...

Don't you mean terrorists? I think we all know who the moon belongs to :/


--
In London? Need a Physics Tutor?

American Weblog in London

Re:Can't get into Yale with this...

[Anonymous Coward]

I always wondered what would happen if these mass email worms had a little bit of extra code that said "fdisk" at the end after forwarding itself to everyone else. I'm thinking a few more people would finally make MS responsible for the security holes, or not as there'd be a lot fewer MS OSes out there...

Re:Can't get into Yale with this...

[moranar]

You aren't considering that the only way for the security flaw rate of any program to approach 0 is if the software source is not touched for anything other than security updates. Linux et al are constantly improving, enlarging, adding new features (after all, we want those features, don't we?), so new bugs are bound to appear.

Of course, some of the bugs discovered weren't new, but that doesn't detract, I think, from my main point.

Re:Can't get into Yale with this...

[Jerf]

Yeah, I remembe scrambling on security updates on my box.

But quite a lot of them were "No known exploits", and even more of them were "Exploit created by security researcher who found it, no known exploits in the wild."

Whereas Microsoft seems to get a lot of "You know how the network's been flaky the last couple of days? It's another bug in Microsoft code."

The theoretical severities have been somewhat similar but the practical ones have not. A lot of those Linux bugs are ferreted out in advance of it mattering.

Will that stay permenent? I don't know. But it's a hell of a lot easier to audit Linux software then Microsoft software, so it just may remain the case that the good guys stay reasonably ahead of the bad guys.

I'd say this is the characteristic to watch, that and the development of Real Apps in languages other then C and C++.

(People, Python, seriously. Unless you're doing heavy numerical computations, don't use C, and even then, wrap it. Or use Perl or Ruby a number of other good languages; I recommend Python because I know it best but it's not the only choice. There's a lot of them that are more then ready for real applications; in fact you'll find them much easier to write in these languages. If you're writing new programs in C, you are part of the security problem .)

Re:Can't get into Yale with this...

[Ironica]

I don't know what planet you're from, but on EARTH, we Linux admins have been scrambling just as desperately as Microsoft admins for the last year or so.

Scrambling to... what?

- Restore internet service after a massive virus attack basically DDOSed you?

- Repair applications that stopped functioning after you applied a patch?

- Test and roll out a critical security patch, recommended by the Homeland Security Office, before a major exploit hit the 'net (which happened three and a half weeks later)?

You may have had as many patches to administer, but I'm wondering if the issues were as pressing as those faced by MS admins. It doesn't mean it was any less work, but it might mean that you spent less time cleaning up or that your general work environment wasn't quite as hairy.

Sounds like governmental security

[CrazyJim0]

They're pouring billions into it, and what do we get?

24/7 CSI shows

Terrorist weather forecasting

A dog and pony show

I'm too depressed...

[Anonymous Coward]

...over the loss of goatse.cx to even make fun of Microsoft. Microsoft? Their evil is nothing compared to the evil that which destroyed the almighty goatse. This is truly a sad day for the Internet. /me cries

Once yuo pop...

[Anonymous Coward]

teh fun never stops!!!1 You pore, pore bastards.

Show me the security...

[Dark Coder]

And I'll show Microsoft a bigger market!

Until then, I'll stick with BSD, Solaris and Linux.

Re:Show me the security...

[TrancePhreak]

I'm sure BSD's market is really big, too. ;)

They've still got a ways to go.

[Anonymous Coward]

If you don't use Windows Update to handle your security patching, it's quite a bit of work to patch a system.

Just trying to figure out what needs to be updated is a pain in itself, unless you figure out that you need the MBSE. Then you need to wade through the security bulletins, which sometimes contain the patch (in varying locations of the document and with no fewer than two pages to go through to get to the patch) and sometimes tell you to go to Windows Update. Not an option when you're trying to cut a disc for a client, or are dealing with an environment that doesn't allow Windows Update for security reasons.

Grabbing MBSE and every available patch from the website and applying said patches to a fresh Windows XP installation took about two and a half hours, and was incomplete (MBSE reported four patches that weren't applied). Windows Update isn't appropriate for a fresh install because of things like Blaster that will automatically infect the system upon connection to the Internet.

Then, there's all the defaults they've got to have their system phone home, such as sa.windows.com for searches, IE automated updates, WMP automated updates (including DRM), ntp.windows.com, Automated Windows Update. Locking down a Windows XP system is an exercise in frustration.

Trustworthy computing? Methinks not. Linux/BSD/OSX may have their myriad security and design flaws (except OpenBSD, which has yet to have a remote root compromise), but Windows XP holds a special place in my heart. Microsoft has admitted they've got an issue with security, which is a good thing, but now they should really address it -- they should be doing everything possible for the user to take control of his/her system, instead of heading the other way.

Re:They've still got a ways to go.

[Clovert Agent]

If you don't use Windows Update to handle your security patching, it's quite a bit of work to patch a system.

Uh-huh. And you use what to update your Linux systems? Do you manually visit every relevant website and download updates, compile and reinstall everything, resolving dependencies by hand?

Or do you use apt, up2date, emerge...? I'm not clear on how this differs from Windows Update, with the obvious exception of altered EULAs and similar nastiness. There's no excusing that.

My point is that updating any OS without some sort of frontend to do the legwork is horrible. Bash MS, sure, but bash fairly. They've got a decent-and-improving frontend to their patching, a variety of tools to check your network for patch levels, and so on. Good enough? Depends on your environment, but it's a LOT better than nothing.

Re:They've still got a ways to go.

[AOL_STEVE]

Uh-huh. And you use what to update your Linux systems? Do you manually visit every relevant website and download updates, compile and reinstall everything, resolving dependencies by hand?

Of course practical Linux systems use front-ends to keep the sytem up to date, but the differnnce is, that if M$ decide to make a patch availiable only through MS Update, then thats the only way to get it. With FOSS, you can patch your systems in whatever retarded way you like - or you can use one of teh many excellent tools provided for this.

With proprietory software, you only get one choice for updates.

Re:They've still got a ways to go.

[Anonymous Coward]

I read the advisories, and go to the relevant web pages and download the updated versions. ./configure
make
make install

Re:They've still got a ways to go.

[iantri]

I think you missed the point the parent was making -- if I was distributing, say, Mandrake Linux 9.2 on computers I sold at my fictitious computer store, I could update a batch of them like this:

(on machine with CD burner)

wget ftp://ftp.mandrake.com/pub/mandrake/linux/9.2/i386 /updates/*.rpm

then burn it, go to the other machines and do:

rpm -Uvh *.rpm

And it's done. If you want to collect all of the Microsoft patches together, well, you can't. They don't make them available on their FTP server; you have to wade through individual security bulletins to find each patch.

Re:They've still got a ways to go.

[kosmosik]

Or do you use apt, up2date, emerge...? I'm not clear on how this differs from Windows Update
That means you can go to an FTP mirror site containing directory with updates. Download everything and update a fresh instalation (let's say - RHL9) within few minutes. By hand.

Also names of updates are not criptic - f.e. "MSK472194-adsa;lslkfdMSIE.exe" - but they are simply package-version, and if you see that version is different you just update and forget. Also no need for reboots (to be honest - ONE reboot when you update kernel and that is it).

There are even more options - with RHL you can make custom instalation CD (with everything patched OOTB) very simply.

Now do that with Windows. Patching should be easy - that doesn't mean it should be easy to an idiot but technologicaly complicated. It should be simple, as simple as files in directory, grab patch, install it with one command and you're done. Now do that in Windows.

Re:They've still got a ways to go.

[Ironica]

Do you manually visit every relevant website and download updates, compile and reinstall everything, resolving dependencies by hand? Or do you use apt, up2date, emerge...? I'm not clear on how this differs from Windows Update, with the obvious exception of altered EULAs and similar nastiness.

To my mind, the worst thing about Windows Update is that it requires IE and ActiveX, two things that (for SECURITY reasons) I never want to run on my computer.

Re:They've still got a ways to go.

[Ironica]

Then you need to wade through the security bulletins, which sometimes contain the patch (in varying locations of the document and with no fewer than two pages to go through to get to the patch) and sometimes tell you to go to Windows Update.

What's wrong with using this?

I agree that Windows Update, manually downloading patches, and especially locking down stupid services in Windows XP is a ridiculous pain, but maybe you're making the process of finding the patches just slightly harder than necessary...

Re:They've still got a ways to go.

[Anonymous Coward]

The problem is completeness.

In theory, by installing Windows XP, SP1, then reading every bulletin since then and applying the suggested patches, I should wind up with a fully-patched system. I don't. Now, it's possible a search turns up every necessary patch (forgive me if I have my doubts) but it shouldn't be necessary when they've got an entire area of the website (and I suppose their staff) dedicated to security. At least, if they're taking this whole 'Trustworthy' thing to heart.

I do appreciate your suggestion, but it's added to about five security-patch mining techniques I've had to develop just to get most of the security patches I've needed from Microsoft's website. Is there some reason I've got to dig five or six buried links when they could provide a form where I could check the software I own (and their SP levels) and get a list of bulletin/date/severity/patch links back all in one go? Heck, maybe even with the option to combine the results into a self-installing .EXE so I don't have to click eighty times?

Re:They've still got a ways to go.

[aztracker1]

Although not free, IIRC a technet subscription gives you all the updates on cd with regular updates...

given this isn't free, and updates can be a pita, if you want to download them for install on new pc's without repeated downloads... in nt based windows, each service pack contains all the system patches before the SP, which helps... it's more a matter of packaging vs. the actual ability to do one or the other imo.

Microsoft and Security

[Tuxedo Jack]

It's about as big an oxymoron as Microsoft Works.

Re:Microsoft and Security

[Anonymous Coward]

I like "Ctrl+Alt+Delete helps keep your computer more secure"

That's like saying lettuce helps keep a McDonald's burger more healthy.

Re:Microsoft and Security

[BenBenBen]

It's about as big an oxymoron as Microsoft Works.

Microsoft Excel.

Re:Microsoft and Security

[Anonymous Coward]

that rocked.

Re:Microsoft and Security

[Anonymous Coward]

Microsoft Money... oh wait your naming oxymorons!? i thought we were listing our favorite software..

Re:Microsoft and Security

[CGP314]

Not to nitpick, but that's not an oxymoron


--
In London? Need a Physics Tutor?

American Weblog in London

Re:Microsoft and Security

[Anonymous Coward]

ZING! Never heard that one before, you stung Bill Gates good!!!

Please redundant this shit into oblivion.

Re:Microsoft and Security

[spruce]

Dude, that joke has only been used about 12,400 times. Hilarious.

SAD NEWS - GOATSE.CX FOUND DEAD

[Anonymous Coward]

I just heard some sad news on talk radio - Internet shock site goatse.cx was found dead in its Christmas Island domain entry this morning. There weren't any more details. I'm sure we'll all miss it - even if you didn't see the gaping anus, you've probably enjoyed one of the trolls. Truly an American icon.

Re:SAD NEWS - GOATSE.CX FOUND DEAD

[Anonymous Coward]

Actually it's Truly a Christmas Island icon. Perhaps he will be reincarnated on Easter Island.

Microsoft doesn't have an excuse.

[DAldredge]

They have 10-30 BILLION USD in cash/cash like assest s. Why don't the spend some of that to make their products more secure?

OK, I'm VERY sorry but...

[TheMMaster]

I am not quite sure if this is off-topic, but I'm going to take a gamble here :)

""There is an order of magnitude--more people using Automatic Update and downloading patches," Microsoft's Kean said."

This would be the system that gave the world the "DRM or be unpatched" situation, right? how trustworthy.... changing functionality along with a "security" patch

I know that bashing microsoft is a favorite past-time here :) but I'm really bothered that this "report card" doesn't include anything from the myrad of unpatched internet explorer holes and the way microsoft relicenses PATCHES... I mean, really EULA's for PATCHES? what if I DON'T agree???

really HOW is this "trustworthy" ??

I am REALLY impressed by the stupidity of these "reviewers" and how easily people forget these sorts of things... cudos to microsoft PR... AGAIN :)

I REALLY needed to get this of off my chest :)

Re:OK, I'm VERY sorry but...

[Captain McCrank]

Digital Rights Management means that you can lock files without using a file specific password. DRM authentication mechanisms are far superior to the password approach for a locked file. DRM, is a security solution- It's something you are (an account with specific privledges) and something you know (your username and password at login). If you weren't so beligerant about your inability to share Mp3's, you'd be able to see the blindingly obvious reason that it was a mandatory patch.

Re:OK, I'm VERY sorry but...

[TheMMaster]

I do not even *have* any MP3's/OGG's I haven't paid for. The problem that I have lies more in the fact that this alters system functionality and pushes something down the throat of customers they might not want.

Consider this: You own a mp3/ogg player that does not support DRM. Microsoft finially pushes the final patch that makes it impossible for your windows system to play ANYTHING not WMA AND signed. Suddenly, and without warning you couldn't use your MP3/OGG player anymore... considering (from my point of view) where you *have* paid for everything you listen to...

I really wouldn't put it past them to bundle some software that deletes/converts all mp3/ogg files on your PC to OGG... in fact in the eula you had to agree to get the patch I mentioned before, even says they have the "right" to do such a thing.

Re:OK, I'm VERY sorry but...

[Tim C]

Microsoft finially pushes the final patch that makes it impossible for your windows system to play ANYTHING not WMA AND signed.

And you know as well as I do that there would be an absolute uproar should that ever happen. MS are big, but they've been swayed by public outcry before - just look at the extension of support for Win98 as one example.

Besides which, as soon as the story hit, people would simply stop applying that patch - while some would almost certainly reinstall the OS to rid themselves of it if need be. I really can't imagine such a thing lasting very long, were it to happen.

in fact in the eula you had to agree to get the patch I mentioned before, even says they have the "right" to do such a thing.

I can't imagine that sort of thing standing up in court though. Sure, perhaps the EULA could be interpreted as allowing MS to do it, but that doesn't necessarily make it binding. EULAs aren't contracts, but here in the UK at least, you can't get away with putting just anything in a contract, and I would imagine that an EULA is the same. For example, just because I sign an employment contract with a clause in it that states that should I ever leave, I have to give them my firstborn, doesn't mean that I'd have to honour it.

In fact, if you read most EULAs thoroughly, you'll see something to the effect that should any clause be found to be unenforceable, that won't render the entire agreement void. That would imply to me that a court has the power to throw out terms it deems unreasonable. I would very much expect that enforced manipulation or deletion of software and data would be found to be unreasonable, whether the EULA allowed for it or not.

Re:OK, I'm VERY sorry but...

[TheMMaster]

While I fully agree with you, and I do, :) them winning or losing a court case isn't going to get your files back :)

plus: backed by riaa and friends they might even get away with it in the USA. :)

that's one of the main reasons I don't use microsoft software, plus I find if appaling that people just hit the "I agree" button without even READING WHAT thay are agreeing to. The last eula agreement actually stated something along the lines of "Microsoft has the right to install updates on your system without notification to the user" I find that harrasment, especially if it's bundled with a security patch that you NEED to install to keep your system secure...

I just don't like that pattern... really

and I really think most people won't care because they don't know the difference between a mp3, ogg or wma file anyway

maybe I'm full of shit in your opinion (which would probably be a valid opinion ;)) I just don't like the arrogance of something like this... and ESPECIALLY calling it "trustworthy computing" I begin to wonder for whom it's supposed to be trustworthy... to microsoft/riaa/and friend or for the end-user who PAYS for their system...

my 3ct

Re:OK, I'm VERY sorry but...

[Anonymous Coward]

So, you're saying that MS DRM is not really what the RIAA calls DRM, but more like what unix-people have called user-id's since before 1970.

About time Microsoft found out about that invention, I would believe that the VMS guys would have told them about it at least when they started writing NT.

Secure Means

[Anonymous Coward]

when they can read anybodies mind.

all rights elimated.

total slaves

totally secure

Re:Secure Means

[Daengbo]

There's this old military joke about the word secure, and I'll try to remember it correctly:

• Tell the Air Force to secure a building, and they'll lock the doors and windows.
• tell the Army to secure the same building, and they'll post and roam guards.
• Tell the Marines to secure it, and they'll run in shooting and kill all the AF and USA guys.

Where does MS fall on that scale?

Re:Secure Means

[Oscar_Wilde]

Where does MS fall on that scale?

They'll move the building to an entirely different location, that they will call by a "hi-tech" acronym, and change the design without letting anyone see the blueprints. The new delivery bay will be the wrong size for current trucks. They will set about making all vehicle plants change to the new size trucks and will tell everyone the new trucks are better as they can't interact with old "insecure" buildings.

People will continue to break into the building by using the huge number of gaps left in the walls where Microsoft assumed no one would look. Microsoft will claim these gaps were left for ventilation and that it is exactly the sort of thing the market wants built in by default.

Once people work out what the new building's delivery bay looks like Microsoft will alter its width by 10cm and force everyone to buy vehicle upgrades (scratch resistant paint, wing mirrors closer to the vehicle body, etc).

Eventually they be forced to move the building again...

Re:Secure Means

[Tim C]

Total troll.

Re:Secure Means

[dazed-n-confused]

Not quite:

• Tell the Navy to secure a building, and they'll lock the doors and windows when they leave.
  
• Tell the Army personnel to secure a building, and they'll post guards on the doors and patrol the perimeter.
  
• Tell the Marines to secure a building, and they'll assault and capture it, killing everybody inside.
  
• Tell the Air Force to secure a building, and they'll take out a twenty-year lease with an option to buy.

Re:Secure Means

[Daengbo]

Thanks. As I said, "I'll try..."

Re:Secure Means

[alexpage]

Tell Microsoft to secure a building, and they'll station a PR flack to stand there doing his Information Minister routine.

"This building is the most secure building in the world. The open doors and lack of alarms are a feature, not a problem. Nobody can break into this building. Stop looking at that guy in the stripey jumper with the swag bag! Nothing can break into this building!"

That is why you will never be Bill Gates.

[Anonymous Coward]

Why work on the Model-T, when you can build the next generation automobile. They have to be competitive to stay in the market place. If they kept patching Windows 3.1, where would we be?

This happens because of competition. If people were looking for more secure systems, then M$ would invest in it.

Regards,

Re:That is why you will never be Bill Gates.

[Penguinshit]

You're shitting us, right? Windows ME came out in, what, 2001? That was basically the last bit of kludged-up, fucked-up, windowed DOS.

DOS.. remember that one? Created in the late 70s and presented to IBM by Microsoft as its own work in the early 80s.

So.. to answer you question, no Microsoft didn't continue patching Windows 3.1; they continued patching DOS. Look where we are.

Re:That is why you will never be Bill Gates.

[Anonymous Coward]

After using windows for some time, I went over to use an Apple. I noticed the interface and said it looked just like Windows. (Think about it) I don't know why Apple didn't take off, marketing I suppose. Most products fail because of this. I like the new Linux Commercial.

Sure, Version 1 sucks, compared to Version 2, but it is a continual process of updating to the next Latest and Greatest Version, of which will fix and introduce bugs, cost alot, etc.

Maybe if Linux or Unix was the FIRST to "Correctly" market their product, we would be bitching about them in support of some other OS. The one thing I do know, is that people are always looking for the "Latest and Greatest". Not like we will wait for a few years for a stable release. So, as it happens, M$ is constantly releasing the "Latest and Greatest", but there is competition. Maybe it could be compared like a Ferrari Testerosa and a Ford Taurus. Sure, their is a market for a Ferrari, but the main market is for the Ford Taurus. But their is also, Dodge, Honda, Toyota.

Re:That is why you will never be Bill Gates.

[Penguinshit]

Hmm.. the AC gets a +1 Insightful for completely inaccurate nonsense, and *I* get the flamebait for calling "bullshit" where "bullshit" needed to be called?

Looks like the Microsoft astroturfers are at work with their mod points.

Uh oh an article on security

[Anonymous Coward]

It's a danger to national integrity, so I'm reposted it to thwart Carnivore's and Echelon's filters:

S3cuRITy A wORK In PRo9r3SS fOr |\/|1cRoSoFt
l4ST M0d1FI3d: JANUary 15, 2004, 1:16 pm PS7
by roBERt 13Mo5
5TaFf wr1tER, C|\|37 neWS.c0|\/|

Two Y3ars AfTEr (HAirmaN bilL G4T35 CAL|eD ON |\/|1(rOSOft 7wO R3dOuB|E 1t's EFF0Rts T0 sECURe it'5 SOFTwArE, 7eh (OmPa|\|Y a|\/| BE91n|\|in9 twO ma|

pert5 wH0 peN|\|ED a Rep0rT w4rn1NG Th4T m1(R050f7'5 D0|\/|inanCE 1|\| t3h iT |\/|4RKe7 CArRieS A riS| of c4t4StrOPHi( FAI|URE.

7h3 risks 7oO 7he 1t i|\|FRasTRuc7uRE hav3 eVeN MiCR0sOfT'S c0mP37iT0r5 H0pi|\|G thAT 7HE (0Mp4|\|y 9ets 17 Right.

"ON t3h MaCR0 1eVel, Yo|_| \/\/aN7 E\/eRY v3ndOR Tw0 dO a beT7ER JOB 0F sEC|_|r1TY," SAiD |\/|ARy anN DAv1d50N, 7he Ch1ef SECUr17Y 0ffiC3R aT datABAse |\/|4kEr oR4(|E.

Dav1dsON 5EES m1Cr050FT'5 fOcU5 oN 5EC|_|rI7Y, pa1R3d \/\/I7h T3H f4c7 thA7 7eH cOmpa|\|Y aDm175 T0 L0SI|\|g s41ES BEcaUSE Of 5ECur1tY 1SsUe5, aS pRoof 7h4t cUst0merS c4N dEma|\|d b3t7er prOd|_|cts. "yoU HA\/e th3 |\/|ORa| LIAb1lI7y 7w0 y0|_|r CusTOm3rs--th3y B3t Th3yrE buSi|\|E55 o|\| JoOR soFTWAre," SHE 54iD. "7Hey eXp3CT 1T No7 T0o BR3a|, aNd 7HeY SH0|_|1d 9et THa7."

foR i7's pAr7, miCros0F7 is REpEAT1NG a |\/|4|\|Tra of a YE4r a9O: PaTIEnc3--5EC|_|R17y i5 4 J0URNey.

"Yo|_| C4N't T|_|r|\| arO|_|nd The iNFr45TRuCT|_|re In 24 MO|\|7HS," s4id sC0T7 cH4r|\|Ey, a mi(roSoFt 5E(|_|riTY 57R4TE9Is7 WHO ha5 r3p3A73DLY l1KeneD tH3 1NiT14TiVE to NAsa'S 10-y3AR |\/|aRcH TWo The MOOn.

"Y0u NeEd Bett3r eDuC4TI0n, J00 NeED b3773r tOo|5, B3t73R teChnO1OGY," h3 sA1D. "AR3 wE (om|\/|It7Ed tW0 pRoV1D1|\|G tho5e 7hI|\|gs? YEs. R We maK1nG pR0gresS? YE5. bUT Am W3 A|\|y\/\/her3 neAR D0N3? |\|o."

a|\|4|yS7 O'GrAdY saiD he'D G1ve mi(rO5of7 "1|\/|PR0\/3d |\/|ARkS." "bu7 Am They \/\/h3re 7H3Y |\|Eed TO be? n0, THEY IS NOt. tEh nu|\/|berS Ind1(ATe thAt tHEy am 4T Lea5t 7A|1NG I7 5ERIo|_|s|y."

cnet NEWS.c0M'S MIke riCc1|_|7I CON7R1B|_|tED 70O tHIS RePoR7.

Windows is at that point

[commodoresloat]

Oh - I thought you said "at that point where we can throw it away and forget about it."

Anyone notice how poorly this article was written?

[SharkDiver]

Are Web Tech News sites exempted from good english? There were so many incomplete sentences in the C/Net article that I was shocked. This a 'News' outlet? "Customers are better off today than they were a year ago, and they will be even better off in the future," said Kevin Kean, a group manager at Microsoft's Security Response Center. Run in sentences (look for ' , and '). "The problem is, there is still a wide base of products,". Poorly quoted. There should have been a more complete quote or a '...' at the end of the quote (instead of a comma) to allow readers to complete the sentence on their own. "Security has overshadowed things at the moment," 'things'? How about 'Security has become the priority issue in software upgrades' ? "Security is only one of the four pieces of the Trustworthy Computing". Drop the 'only'. W"hile Slammer affected a product that had been developed prior to the Trustworthy Computing push, MSBlast--also called Blaster--exploited errors missed by the Microsoft reviews." This paragraph is complete trash. It seems to be hinting at improvements, but never says it. How about: The virus 'Slammer' affected all MS products. But those deployed after the Trustworthy Initiative were least impacted and the easiest to patch.

80::20 rule applied to Microsft Security

[leoaugust]

"Customers are better off today than they were a year ago, and they will be even better off in the future," said Kevin Kean, a group manager at Microsoft's Security Response Center.

What a well worded articulation - almost Greenspan-ish like in a sense that it looks like he is saying something, but you can never hold him upto for "whatever he is saying." And I think this quote summarises the whole article well.

It is 80:20 rule or in Microsoft's case 40:60 rule. In the first year you move 40 % of the distance towards the the Security Goal-Post. So, "Customers are better off today than they were a year ago, . In the next year you move another 40 % towards the goal. So, "Customers are better off two years from today than they will be a year from today. . An so on and on ...

Now if the security Goal Post moves and you find yourself heading in the wrong direction, as it always does in Real life, you can frame your message as follows. You are now 60 % away from the old place. So, "Customers are better off today than they were a year ago, . In the next year you move another 60 % away from the old place. So, "Customers are better off two years from today than they will be a year from today. . An so on and on ...

So,

• "Customers are better off today than they were a year ago,
• and
• they will be even better off in the future,"

And how can you be wrong when you say it the way it is said. What a well worded articulation.

Re:80::20 rule applied to Microsft Security

[FooAtWFU]

"Customers are better off today than they were a year ago, and they will be even better off in the future," said Kevin Kean, a group manager at Microsoft's Security Response Center.

In related news, the chocolate ration has been increased to 5 grams.

complaints

[MrSpiff]

people complain that MS hasn't lived up to their promises, but was anyone really expecting all products to automagically become secure? the initiative has to be consistent from the design table to customer installation, meaning the product base has to be renewed from the bottom up before there's a chance they'll have a chance at delivering "Trustworty Computing". patching current products can only get you so far.

What do you mean?

[graveyardduckx]

What do you mean incomplete on the report card? I thought it was incomplete everywhere.

Microsoft's Report Card

[vought]

SCHOOL OF CAPITOLISM

SEMESTER 2, 2003

PRODUCTIVITY 101 3 HRS 80% C
ECONOMICS 307 3 HRS 100% A
CREATIVITY 92 3 HRS 67% D
GOV'T STUDIES 203 3 HRS 100% A
COSC 507 ADVANCED 3 HRS 78% C
MONO 302 3 HRS 100% A
BORE 405 3 HRS 100% A
THFT 305 3 HRS 100% A
LIES 205 3 HRS 100% A
SCUR 101 3 HRS 20% F
MONO 400 3 HRS 100% A
CONV 101 3 HRS 10% F
HID 205 3 HRS 70% C
OVERALL AVG. 78% C

This explains why mediocre rules the market.

Re:Microsoft's Report Card

[lxs]

SCHOOL OF CAPITOLISM

Is that next-door to the Skool ov Speling?

Re:Microsoft's Report Card

[vought]

Whoops. I made an oopsy.

"School of Capitalism"

Thanks for pointing that out. It's late at night in this part of the world. I guess I get a B for speling.

(Yes, that was intentional.)

Improved marks!?

[MasterSLATE]

I'm sorry, but after such large-scale security issues like Blaster and Klez, I don't think it's appropriate to give them any sort of improved marks. Sure, the patch might have been out.. But security is also about education.

Give them an "F" on the report card

[QuantGuy]

Three observations.

• First, Microsoft gets no points for "taking security more seriously," because that's a DUH! instinct. Consider that large parts of the public sectors in Israel, the UK, India, China and Germany have decided to go the open source route -- in part because of security fears. Consider also that Microsoft's deferred revenues (new contracts!) were off by ~$600M last quarter; Connors specifically pointed out that this was because "salespeople were helping customers deal with security." Ballmer must be crapping himself. So what we're seeing is a survival instinct, not shrewdness, on Microsoft's part. So, no points for that.
• Second, the scourge that is the Windows security problem has reached the level of pandemic in 80-90% of all companies. The patch-and-pray vicious cycle is overwhelming everything else. For IT staffs, it's Love in the Time of Cholera out there. As we speak, the spreadsheet monks at Gartner and IDC are probably flailing wildly as they attempt to update their TCO models.
• Third, I resent the fact that Microsoft has commingled the need to fix a serious quality and customer satisfaction issue (shoddy code) with the implementation of market-preserving technologies (e.g., Palladium^H^H^H^H^H^H^H^H^H er, the "Next Generation Trusted Computing Base"). Business model enforcement through cryptography should not be confused with security.

Re-writing Windows from the ground up seems to me to be the best remedy. Forcibly breaking backwards compatibility should be a design goal.

Re:Give them an "F" on the report card

[TrancePhreak]

e.g., Palladium^H^H^H^H^H^H^H^H^H

HAHAHAHAHA, you're one to speak. Now on the issue of breaking compatibility, that would decrease the number of people using any system. One thing large companies want is to be able to use all their old software from the 80's so that they don't have to buy anything new or get used to something different.

Re:Give them an "F" on the report card

[chthon]

One thing large companies want is to be able to use all their old software from the 80's so that they don't have to buy anything new or get used to something different

The only platforms on which you can do that are mainframes, AS/400, VAX, and POSIX compatible Unix platforms.

On Windows, most people which started using VB way back in time, had to solve issues each time a new version of VB came out.

Re:Give them an "F" on the report card

[Anonymous Coward]

"Re-writing Windows from the ground up seems to me to be the best remedy. Forcibly breaking backwards compatibility should be a design goal." +5? Insightful? Have you moderators gone mad? The question of re-writing from scratch is so stupid I wont even address it, and the second point is that QuantGuy obviously knows nothing about those magic people "Users". You know, the people who use the software and want thier old programs to work? Yeh, YOU.

Re:Give them an "F" on the report card

[QuantGuy]

Re-writing from scratch is eminently feasible... just ask Apple.

As for breaking backwards compatibility, I don't see why this is so objectionable. Microsoft wants this to happen anyway, since the company is encouraging customers to write code in languages that use the .NET CLR ("managed code"). Most of today's most critical business applications will almost certainly need to be re-written for Longhorn.

If Apple can create a virtual "Classic" OS 9 environment that runs under OS X, why can't Microsoft create an OS with a virtual Win32 environment, sort of like the way VMWare does it but with a (much) stricter security sandbox around it? All new code would run in the "new" environment (presumably CLR-based).

As for breakage, frankly I don't see how on earth you're going to get better security for without breaking something. When Gates stated that "when we have a choice between functionality and security, we must choose security," do you really think he meant it would be painless? Far better, I say, to rip the Band-Aid off quickly then r-e-a-l s-l-o-w-l-y, which is what we're doing now.

Nullum prandium gratuitum.

Re:Give them an "F" on the report card

[TrancePhreak]

VB is a programming language and not a program itself... If you compiled the VB script into an application, it still works today as long as you have the appropriate DLL's.

Is

[katalyst]

Microsoft BS7799 certified?

Re:Is

[Justin205]

Microsoft BS7799 certified?

I don't know about the 7799 part, but Microsoft is certainly BS certified.

Re:Is

[katalyst]

and BS would be bull****?

Re:Is

[Anonymous Coward]

Well done Mr. Jokemiester. Your funny bone is well tuned I see!

You must be a riot-laugh at parties.

Confusing figures...

[Polkyb]

It says here, Mr Gates, that you released 32 security advisories and 21 vulnerability fixes for Windoze 2000 Server in the first six months, yet for Windoze 2003 server you 14 flaw fixes and 6 critical issues...

Would this be because W2K3 server is based on Windoze XP code and that the majority of bugs had been ironed out already in the months between the releases?

hmmmm....

I think a fairer summary is...

[darnok]

that they've discovered their security problem is much bigger than they thought it was.

Sure they've progressed in terms of there's more known security holes fixed now than there was 1-2 years back, but there's also far more security holes that have been identified and at (seemingly) a much faster rate than 1-2 years ago.

In other words, 2 years ago, they rated a 4/10 in terms of security. Today, I'd say they probably rate 20/50. Overall, my impression is that they've essentially stayed in place in terms of removing security holes from their products.

If you think that I'm being unfair, consider how long it's taking new security holes to get fixed now versus 2 years ago - it seems to be generally longer.

Also, consider that MS has now taken the step of bundling security updates into big bunches, to ease the pain of applying them - that they've had to resort to this is a reasonable indication (IMHO) that the quantity of security holes being *fixed* has gone up significantly.

Finally, consider the rate at which security holes are being uncovered - it would have to start dropping off dramatically if MS was being successful in fixing their problems. That certainly doesn't seem to have happened.

Re:I think a fairer summary is...

[inode_buddha]

"... they've discovered their security problem is much bigger than they thought it was."

I wonder if they'd answer with a straight face that the resulting end-user/customer pain was worth the market share. (Assuming flawed design WRT executable stack, browser added to OS, strange mail defaults, etc. etc.)
In other words, a question of ethics and ethical design.

agree

[Tom]

O'Grady, agrees that he would give Microsoft 'improved marks,'

Have to agree there. Two years ago, it would have been a solid F (us) or 6 (de). Today it's an E (us) or 5 (de).

Re:agree

[rritterson]

E?

I've never seen an E on this side of the Atlantic (west). Normally it goes A,B,C,D,F. In europe I've seen E which is the american F, with E meaning elementary.

(with one exception in the US- in grade school E was the best and meant 'excellent')

Or maybe you were trying to be ironic... it's late and I lose my mind.

Re:agree

[Tom]

Nah, I just didn't go to school in the US. Didn't know there is no E. So they get a D instead. Or whatever else you have that means "you passed. barely. And only because I had a good day".

Re:agree

[DragonMagic]

Some schools in the US use "E" to remark an Excused class; that is, the student did not pass the course but is excused of his grade.

Re:Anyone notice how poorly this article was writt

[woohoodonuts]

There were so many incomplete sentences in the C/Net article that I was shocked. This a 'News' outlet?

Shaddup

"F"

[zcat_NZ]

Below expectation. Needs to try harder

Re:"F"

[prockcore]

Don't forget the other Teacher's notes:

Does not work well with others.
Disruptive in class.
Fails to finish assignments.
Attendance problems.

Re:"F"

[The One KEA]

OT: That doesn't work on Firebird, y'know...

Re:"F"

[zcat_NZ]

Yeah, fixed. Non-IE users can see a screenshot now, although the screenshot is already out of date. I fixed a problem with the charset and changed MS's Knowledge Base reference to the CERT vulnerability the page exploits (as a clickable link).

3500 hits since I posted it. I'm so proud :)

Re:"F"

[oddfox]

Very, very nice. I remember hearing about and examining that exploit. Great to see it's finally being put to excellent use. :D

Re:Anyone notice how poorly this article was writt

[Anonymous Coward]

Complaints from someone who hasn't mastered the paragraph?

Security improved to just CRAP

[Anonymous Coward]

instead of MAJOR CRAP!

Not quite

[paxcirca]

At least at the institution of higher learning I attend, an Incomplete is not immediately counted into either total credits or GPA. The student must complete the course by either 1) finishing up the necessary work, or 2) retaking the course at the soonest possible semester (excluding summer semesters). The choice of the two is up to the professor. The Incomplete is replaced by the grade earned by 1) or 2).

Re:Microsoft Security, additional measures

[Anonymous Coward]

You forgot some things for good security.

1. Don't run most programs.
2. Watch out for chat files sent to you.
3. Don't fall for email spams.
4. don't send out bank account info to web sites received by email.
5. don't go to nigeria
6. cut the network connection
7. reboot and reboot often
8. save and save often
9. don't let teens administer the family computer

WhatMeWorry!

Do Slashdotters over analyze?

[xswl0931]

Seems like there's three possible sentences that could have been used: 1. Customers are better off today than they were a year ago 2. Customers are no better off today than they were a year ago 3. Customers were better off a year ago If things have improved (as the article explains), then #1 seems appropriate. Even Freud said, sometimes a banana is just a banana.

aut0tr0ll is teh sp0kE!?

[CHECKTHEGOATS]

Hello master.

sid=93059
formkey=yQYklEYu1f

This is a joint venture that will be mutually advantageous to both parties involved.

As my teacher said

[vpscolo]

"Getting there, must try harder and must stop looking up girls skirts." Of course I don't think Microsoft does that and I finally kicked the habit last week :)

rus

Commander Kean?

[Licensed2Hack]

Kevin Kean, a group manager at Microsoft's Security Response Center

Did Commander Keen grow up to be a Microsoftie? That would explain a few things...

Microsoft Culture

[gen2002]

Although Microsoft is knowen for its security problem the individual microsoft programmist is a good one . Microsoft don't make secure products because the programmers are directed from the menegment to prefer nice Shiny GUI instead on security.

Yeah, right...

[pjrc]

If Microsoft were really taking security seriously, why would they not yet fix the IE phishing (URL obfuscation) bug. This is such a simple thing to fix, and it has been public knowledge since at least December 9.

For an indication of just how seriously Microsoft is taking security, rather than quickly fixing the bug, Microsoft is advising users to manually type URLs rather than click on hyperlinks. Well, of course, only malicious hyperlinks... but because of this bug, a scammer's link appears to be to the genuine website. Of course, they offer other gems, such as a chuck of javascript you can run to tell you the URL of the website you're actually viewing, since their software can't be bothered with giving you a correct indication. Or you can launch notepad and copy a shortcut. Yeah, everyone should have to go to the trouble of doing these steps, because they couldn't manage to get a fix out quickly (within the 1 week between the disclosure and scam artists starting to use it to trick end users to disclose sensitive indo). Microsoft also suggest viewing email at text-only... effectively reading all the html source, and changing to the high security profile )turning off all the dangerous technologies they have "innovated" over the years: ActiveX, scripting, etc...) not because they will help you avoid being tricked, but because it will limit the damage.

All because they couldn't fix this simple problem quickly.

Yeah, that's taking security seriously!

Re:Yeah, right...

[t_allardyce]

Microsoft + Browsers is not a good combination, they never fix security holes, and given that they cant even get the most basic CSS box model implemented to the W3C rec. can you blame them? There are so many improvements to IE they could have made, it would have taken less than a week to patch in an option to 'block' pop-ups, or an option to turn off all the extra things scripts can access - such as browser controls. But since they didn't fix Outlooks similar problem for god-knows how long (have they even fixed it yet?) it seems unlikely that they would waste their precious time on something so minor. It all seems a bit phishy to me, what scares me the most is that the logical explanation for all this is that Microsoft is either totally incompetent, or, they're corrupt and are doing this on purpose for some business reason.

Re:Yeah, right...

[Fr33z0r]

If Microsoft were really taking security seriously

Because they're not taking security seriously, they're trying to put their customer's minds at rest and stop them jumping ship.

If they were taking security seriously, they wouldn't prevent pirated copies of XP from downloading critical updates, this is perhaps a poor analogy but it's the first one that springs to mind, let's look at the automotive industry...

Imagine 95% of the cars on the road are Fords, and every time a problem is found with a Ford, your car is upgraded at the nearest garage for no cost... Now imagine that Ford made a big design oversight and didn't provide headlights for any of their cars - big problems, lots of people crash their cars at night and have to get it fixed at a great personal expense... Of course, even the vigilant are at risk as their cars can be hit by less vigilant drivers at any time of night, even while parked.

So Ford says "oops, ok guys, take your cars to the garage and we'll fit headlights", problem solved, right? Wrong, because they then follow it up with "if you can provide proof of purchase". Fair enough, right? Well, yes and no, yes the people driving stolen cars shouldn't deserve any special favours at cost to Ford, but then there are people who just plain don't have proof of purchase who are made to suffer too, other than that though, it's all good, right?

No, because now we have legitimate Ford owners getting smashed into by all those cars that (for whatever reason) don't have headlights, these people are punished for (assumed) theft of the vehicle in a rather extreme manner - they are punished with insecurity and far greater risks. Risks which also put all drivers, pedestrians and buildings at risk by extension - people who crash have got to crash into something... right?

We have the same problem here, I sympathise with Microsoft and am in no way advocating piracy here, but to suggest that they are focussed on security while quite literally making it impossible for a vast number of machines on the net to be made secure is a fallacy, and it puts the rest of us at risk as a direct result.

What percentage of your daily spam intake comes from XP boxes that have fallen prey to a trojan remailer for the simple reason that the owner *cannot* patch his machine? Sure, he's a theif, but for fuck's sake, his machine is a direct threat to the entirety of the internet as a direct result of Microsoft's anti-piracy actions.

Don't be fooled, that line on the profits chart means infinitely more to Microsoft than security *ever* will.

Re:Yeah, right...

[Tim C]

All because they couldn't fix this simple problem quickly.

Interesting; I take it that you've seen the IE source code, then? I mean, you have to have, to know that it's a simple problem that can be fixed quickly, rather than something buried deep in the bowels of the code in a module that has hundreds of dependencies - or even something buried deep in the bowels of the OS/MFC, with thousands of dependencies.

No, I don't think it's likely - but you're spouting supposition as though it were gospel. Unless, of course, you've seen the source.

Yeah, that's taking security seriously!

Well, rushing a patch out as fast as possible isn't taking security seriously either, if that patch introduces another exploitable bug.

Re:Yeah, right...

[man_ls]

How, then, do you propose they keep pirated copies of XP from downloading updates?

They blocked the number one pirate CD key from downloading them even before SP1. And, with SP1, they blocked around 150 other "commonly used" pirate CD keys.

That doesn't mean there aren't other corporate keys that are valid...corporate keys bypass activation so there's no validity checks. If it's a corporate key leaked from a large company, it's feasible that it could go unnoticed for a long period of time before being caught and invalidated.

I, personally, advocate Windows Update sending a 'destroy installation' command that will cause Windows to boot to some kind of anti-piracy screen, and destroy all other files on the hard drive. And, I think that's perfectly reasonable -- you steal the software, you run the risk of the software you're not using legitimately destroying your data.

You just run into the problem of detecting pirate copies then.

Re:Yeah, right...

[Fr33z0r]

Actually, that's not too bad an idea. Well, TBH it *is* a pretty bad idea, but you're on the right track.

Destroying peoples data is the bad part of the idea, the code would probably be buggy and exploitable to remote-destroy any XP machine you wanted, granted I could say the same about "format", but then format isn't that complicated. Basically, it could all go horribly wrong, isn't such a good move PR-wise, and when you're destroying people's data you have to think of the worth, you're basically insta-destroying billions of dollars worth of data and work, some of which could be extremely beneficial to humanity for all we know.

No, a better idea would be to irreperably destroy the networking side of things and pop up an error message, "Hi there! We realise you're using a piraetd copy of XP and we don't like it! If you buy a legit copy and insert the CD you will be asked for your legitimate activation key and your network will work again, until then... you're shit outta luck kid!".

It's a real dilemma to be sure, and as I said I do not envy their situation, it costs them to patch these machines running pirated copies of their products (the windows update site's bandwidth usage must be insane) so they're right to do something about it, what they did however was fix it in the dumbest way possible. Hell, I prefer your "blow up their PCs" approach to having countless virus/trojan infested open proxies sitting on the internet.

Re:Yeah, right...

[c4ffeine]

Seriously, that would be awesome for us. The main reason people choose various OS's is cost. As of now, *nix AND windows are free for end users. If M$ software suddenly costs shitloads of cash, who's going to use it when there's a free alternative? In other words, a clampdown on piracy would result in a mass exodus to *nix.

Re:Yeah, right...

[0x1337]

Sorry, Colton, but the reason I use Linux (a not-so-but-kinsa *nix) is not because I'd have to pay for MS.

You couldn't pay me to use Windows. :-D

Score : -1 Redundant

[DrSkwid]

because really, who cares?

this was the original plan

[CAIMLAS]

I wonder if their original plan was to extend Win98 support anway, for "positive PR".

Seems that MS is trying to undertake PR in a very SCO-like fashion lately.

Seeing it in another perspective

[euggie]

I am reading a lot of MS-bashing here. But let's take a look at some facts here:

Consider a pretty standard setup--the OS, plus ftpd and httpd--here's the count of errata advisory between M$ Win2k Server and RedHat 9:

Microsoft: 1, for the botched FrontPage Extension patch released in November.
RedHat: 4, for the following:
1. Dec 2nd: Updated 2.4 kernel fixes privilege escalation security vulnerability RHSA-2003:392-05
2. Dec 16th: Updated lftp packages fix security vulnerability RHSA-2003:403-07
3. Dec 17th: Updated httpd packages fix Apache security vulnerabilities RHSA-2003:320-09
4. Dec 24th: Updated 2.4 kernel fixes various bugs RHBA-2003:394-08

Not to mention I will need to think about what to do when RH9 becomes EOL in April.

Interesting.

I am by no means by pro-MS here. If I have my way it'd be all qmail and publicfile. In fact, I don't have the balls to put my company's Exchange server directly on the 'net; I put it behind a RedHat box running perdition, and have qmail as the MX, behind an IOS IDS/FW.

Trust needs to be earned, and MS is slowly earning mine in the security front. I don't trust MS software enough to stick them directly on the Internet yet, but they did earn my trust to let Windows Update automatically sort things out: Not a glitch in the last 18 months.

The fact of a matter is, with a little clue as a admin, Windows can be made pretty secure. Being clueless, Linux can be made to be a big wad of swiss cheese.

We Linux and /. crowds--me included--can be an arrogant and blinded bunch. Sure, we can sit around bashing MS and fool ourselves on how insecure Windows is, but that doesn't accomplish anything. MS is catching up /fast/; that's fact. If we remain complacent, we can fall behind sooner than you think.

Now that you have the facts... Go ahead, mod me down.

Re:Seeing it in another perspective

[tr0llb4rt0]

This comparison has nothing to do with Microsoft only announcing bugs/patches once a month then?

Re:Seeing it in another perspective

[Oriumpor]

Well when Microsquish made the switch to akamai recently for their software update hosting they broke many users ability to update and gave no release on how to fix it. Yes sure, it was just an issue of changing the default url to httpS instead of http and accepting the new certificate, but how many joe blows are going to know that? And no, an obscure technet article referenced by a letter and a number does not count as a release, especially in a service as important as software update has become for M$.

Even if SUS works properly, what is the purpose of needing to reboot every system that is updated. Can't this be taken care of with minimal (3-6 seconds) downtime while a service resets?

We all know by it's very nature Linux is more secure than microsoft. The sheer number of vulnerabilities available is not neccessarily a good measure of the actual security of the system. The measure is properly the number of vulnerabilities successfully taken advantage of easily and massively.

Let me sound off for a second here on the major issues I personally have with MS:
CODERED
NIMDA
MIMAIL
BUGBEAR
KLEZ
NACHI
BLASTER

Good security practices, updating regularly and keeping up to date virus protection is an important part of stopping the above garbage from getting on your network. EVEN then, the affects of the above will still cause you downtime since your provider will have to scramble to deal with all the there-after DDoS.

The following is reason enough to be extra wary of any microsoft product security wise. Believe it or not, Nachi apparently SAVED M$ ass when it came to MS-Blaster. The number of source addresses scanning for 135 dropped by nearly 80% in these first weeks of 2004. AND there are STILL code red systems out there attaching to my Apache server occasionally. I sure don't see a massive SSH/Apache Code Red/Nimda style worm topping the bandwidth charts.

The duece you say, imagine that the web browser with 70% market share doesn't have a massive network-screeching-to-a-halt worm spreading with free reign?

Who cares anymore, it's been 8 years GNU/Linux+Apache+SSH has proven itself the most secure and reliable system for Web-Serving and MySQL+PHP is fast overtaking MsSQL+ASP as the most popular method of dynamic content distribution.

Once I start seeing massive changes to the netcraft survey, then I'll believe Microsoft has done enough to curb their Virus problems. The proof is in the puddin so to speak.

Re:Seeing it in another perspective

[Oriumpor]

Ugh 80% is innacurate I appologize, 50% is a more accurate number for the source addresses which vanished from the ISC survey.

Re:Seeing it in another perspective

[gregarican]

My company has an Exchange 5.5 box on the Internet, directly behind a small Flowpoint router/firewall. I've had to apply about 5 Exchange Server patches since 5/2000 (not counting the NT 4.0 Server patches) but I haven't had a single successful intrustion since original product installation.

Any organization that has a decent firewall in place can block unnecessary ports. That, applying NT/Exchange patches, disabling anonymous/guest accounts, and disabling the mail relay option is about all the maintenance I've had to do on the box.

The server hasn't hit a BSOD, required a mandatory reboot due to software issues, etc. in well over a year and a half. As much as folks bash Microsoft perhaps they should focus their attacks more. Home users on Windows XP Home Edition with an out of the box DSL ISP connection, yeah. Poor schmucks trying to get Windows ME to work with all of their legacy PC games, sure. Some smaller companies still trying to get Windows 95 to keep a session up for more than 2 hours at a time due to memory leaks, definitely.

But as long as IT business staff simply join the Microsoft Security Bulletin mailing list and patch their boxes the Microsoft server line isn't as bad as folks make out. Back when I supported a call center and had a good number of Sun Solaris boxes I recall some instability there for sure. As a matter of fact a lot more instability than Windows NT 4.0 Servers patched at SP6a running parallel.

I'm curious as to those who are bashing the server product line. Have y'all had to actually support these products? If so if you have had PITA experiences with intrusions, exploits, and stability most likely these are due to your own ineptitudes.

Re:Seeing it in another perspective

[kosmosik]

RedHat: 4, for the following: 1. Dec 2nd: Updated 2.4 kernel fixes privilege escalation security vulnerability RHSA-2003:392-05 2. Dec 16th: Updated lftp packages fix security vulnerability RHSA-2003:403-07 3. Dec 17th: Updated httpd packages fix Apache security vulnerabilities RHSA-2003:320-09 4. Dec 24th: Updated 2.4 kernel fixes various bugs RHBA-2003:394-08

2. - ltfp is a CLIENT not server.
3. - this fix very uncommon situation when you're using mod_rewrite with 8 or more regexp pattern.
4. - this not an security patch (it may cause kernel crash under some rare circumstances (specific hardware) but not remotely exploitable, not sec bug).

Everything else u mention is plain bullshit to me. Security is not about counting how many flaws were FIXED. Security is a constant process of applying patches, etc. Applying patches on Windows is still (bit less then before but still) a serious pain in the ass.

Re:Seeing it in another perspective

[dema]

Consider a pretty standard setup--the OS, plus ftpd and httpd--here's the count of errata advisory between M$ Win2k Server and RedHat 9

Microsoft's OS includes IE, which can't simply be "removed." So you would have to also count the patches for IE that have come out.

Also be reminded that RedHat is by no means the only open-source OS under the sun. It's rather unfair to pit it against MS just because it's an easy target.

Re:Seeing it in another perspective

[molo]

1. not remotely exploitable
2. lftp is a client
3. if you want a stable webserver, I'd suggest apache 1.3 instead of 2.0.
4. not remotely exploitable

-molo

Re:Seeing it in another perspective

[mabu]

There's a difference between bugs and glaring, exploitable security holes.

Microsoft has bugs in their OS that go unfixed for years at a time, if ever.

There are also differences between operating system anomolies and application anomolies. You can't take into account Windows Update patches and then compare them to security fixes for individual unix applications -- if you want to do that, you'll find that there is also a plethora of security patches and updates for various Microsoft products like Office/Word/Excel, etc. that are not being counted in the tally.

Re:Seeing it in another perspective

[shadow_slicer]

I agree that Microsoft has gotten better in the past couple of years, but after a bit of research you're arguments don't support your thesis.

Look at the issues that you mention:

The "one"Microsoft's patch You mentioned was actually three Windows fixes (and one Office fix) bundled together
"The updates fix at least eight security issues," one of which "could allow an attacker to gain control of a person's PC via the Internet"

The three linux patches and the bugfix (which mostly just optimized some things and fixed a memory leak):

The first issue was a local priviledge escalation issue. Local meaning you already have to have access to the box. Although local priviledge escalation exploits can be used with other techniques to gain control PCs, they're nothing compared what microsoft was patching.

The second issue was with lftp. Uh....lftp is an ftp client so I at least wouldn't really count it as part of a server patch..but...This vulnerability does allow a remote site to execute arbitrary code on the local machine (it didn't say as what user, but probably as the current user).

The third issue (was actually to minor issues) were with apache. These fixed a vulnerability that would allow a user to execute arbitrary code as the user apache if they have the ability to edit the apache configuration files. The other issue was a vulnerability in a module with a non-default setup that "can result in CGI script output being sent to the wrong client".

I'm not going to say which is better, but at least be honest with your arguments. Only zealots feel the need to hide facts in order to convince others of the truth.

lipstick on a pig

[Anonymous Coward]

Security at MS is a marketing thing not a cultural thing. They're putting a lot of effort into patching Windows (because they want the worlds data centres to start running it and .NET so that their future is a bit safer), but they're putting very little effort into other products - for instance IE's most recent phishing bug which prevents it displaying anything after a ""%01" in the address bar (a gift for spammers after your credit card details everywhere) was picked up well over a month ago and yet no patch exists. And don't get me started on its awful SSL implementation. IE is a good example of a relatively small product that needs re-writing from the ground up and has done ever since it was first cobbled together several versions ago. MS hasn't done anything to it, and won't, because it looses money for them anyway. They might sort out Windows with Longhaul or whatever its called, but my guess is that they won't. With a bit of luck it will be too late for them by then anyway and Penguins will rule the world.

Re:lipstick on a pig

[mborland]

And don't get me started on its awful SSL implementation.

Hear, hear. Although MS does come out with a regular stream of patches for IE, it's quite obvious that the browser itself has some serious (system) design flaws, particularly with respect to its SSL implementation. I've been still wrangling with header tweaks and such to make IE behave in relatively normal situations (Pragma: no-cache header in IE on an SSL download page--sorry, no dice).

Why does this indicate a security problem? Because generally bad system design in an implementation leads directly to more flaws. And I can see the design problems with IE just from using it, so I can only guess there are a treasure trove of security bugs.

Compare this with Mozilla. I am certain Mozilla is loaded with security bugs. However, it seems to be more standards-capable than IE, and less prone to the sort of 'D-oh' design flaws (in the last two years, have not had ANY fiddling with headers, etc. to get Mozilla to work). As a result I guess that it's less likely to fail (and create a security hole) in normal operation.

aut0tr0ll is teh sp0kE!?

[Jack Froidalbungle]

Hello master.

sid=93059
formkey=4otbka09km

This is a joint venture that will be mutually advantageous to both parties involved.

incomplete after a while becomes...

[MoFoQ]

An incomplete after a while becomes an F at most colleges....and since it's been going on for more than two years.

Whois Lunis Torballs?

[Anonymous Coward]

Let's get this straight: You copy and paste a few hundred lines of legitimate SCO code into notepad, compile it with Dick Stallmin's half-assed compiler, change the name, and you're a fucking hero.

Please, someone deport that communist nigger back to Scandinavia.

More information

[lintux]

You can find more information about the "Trustworthy Computing" initiative on this site. Quite cool that it still exists, actually. :-)

Re:Anyone notice how poorly this article was writt

[oddfox]

Learn to format your /. posts and they'll learn to appease ultra-grammar-freaks like yourself.

NOOOOO WHY GOD WHY???????

[Anonymous Coward]

This is truly the saddest day in the history of the Interweb.

It's worse then 9/11. We must bring goatse.cx back, or the terrorists will have won.

BTW, in the meantime, here's a mirror.

Re:NOOOOO WHY GOD WHY???????

[k0d0]

yea it's sad but you'll get over it...

Delay tactic

[Anonymous Coward]

Delaying OSS development via law suites and
other means (babes@personal.osdn) is likely to
increase the national security :-)

Yours In Jesus,

Bribe Doors

I dunno about that....

[geminidomino]

I was able to implement DHCP-updated DNS entries with BIND 8, several years back. It wasn't as EASY as it is with BIND9 (and possibly DJB. I don't use it) but the capability was definitely there.

MCP Club

[Skreech]

The first rule of MCP club is you do not talk about MCP club.

Now go set up franchises all over the country.

Same goes for Apple

[Tune]

>Microsoft don't make secure products because the programmers are directed from the menegment to prefer nice Shiny GUI instead on security.

Apple has some good programmers
Apple management has a GUI focus

Still Apple doesn't make conceptual security flaws like requiring root privilege for any user to perform even the most basic tasks.

--
Every program has two purposes -- one for which it was written and another for which it wasn't.

Re:Same goes for Apple

[gen2002]

Yes, But apple seperates thr kernel space from application space thus improving security and also they uses BSD kernel that because its open nature has less security issues Vs. windows. Or so i think

Re:Same goes for Apple

[Anonymous Coward]

requiring root privilege for any user to perform even the most basic tasks.

What tasks can't you do with a "user" account that you think you should be able to in Windows XP? I run as User all day. It works for all basic tasks I've ever thought of.

Complexity and Responsibility...

[danielrm26]

cp is rock solid for me -- it just doesn't do much more than copy... As we add features and systems become more powerful, problems will come up regardless of the vendor.

The question isn't one of whether or not there are problems, the question is how they are dealt with, and *that* is where the focus should be for a report card like this.

Yes, for god's sake

[RMH101]

You don't see critical updates for OpenOffice, do you?

trustworthycomputing.com still just pr hypenosys?

[Anonymous Coward]

looks that way.

we haven't bought any virotic BugWear(tm) in years, but some of our customers are still hostages of the felonious kingdumb, & spend A LOT (time/money) trying to keep the infactdead softwar gangsters' bogus spyware kode working. seems like a fool's errand that never ends?

we give them a F for still FUDged.

[Somewhat OT] Re:Let's be honest

[cubic6]

The way I see it, the argument that programs "need not be fast" is saying that most things we do with our computers (web browsing, listening to music, writing email and word processing) aren't terribly processor intensive. The bottlenecks are usually storage speed and user response. Even the newest and greatest DDR3000 memory can't send data anywhere nearly as fast as a 500mhz PIII can execute it. Same thing with hard drives and network. It's also true that most user interaction is the slowest part of most operations. If you're typing in MS Word (or OpenOffice.org ;), your processor is sitting there going "OK, type another letter!" about 2 billion times a second.

That said, our requirements (I assume you're with me, cause you're compiling stuff...) are a little different than the average user. I manage to hit 100% CPU utilization pretty regularly due to compiling, POV-Ray, starting Mozilla, etc.

Just the fact that it doesn't have to be fast doesn't mean it can't be, but I figure the less time the developers spend making Windows 0.0000001 second faster at popping up the start menu the more time they spend fixing bugs and security holes.

Re:[Somewhat OT] Re:Let's be honest

[hauer]

The bottlenecks are usually storage speed and user response.

Indeed. You are highlighting the first principle of optimization: only do it where it makes a difference - something I completely agree with.

It's also true that most user interaction is the slowest part of most operations. If you're typing in MS Word (or OpenOffice.org ;), your processor is sitting there going "OK, type another letter!" about 2 billion times a second.

Agreed. But just because most of the time you do not notice it, if some of the time you do, that can make quite a difference in convenience. In a multiuser environment, where you log in daily, maybe more often, it does matter whether your programs fire up in a second or in two minutes. When your browser needs to start a helper application, ditto. After you have typed twenty pages in Word (with 99% idle CPU), with figures and tables and you want to tweak with the layout, fonts, styles, etc., the faster your document is rerendered, the more convenient/fast/versatile your design effort will be.

And if you want to do image manipulation on your photo album at some point...

I wholeheartedly agree with you that the needs of different types of users are quite different. But I do not think that speed requirement is only that of programmers/geeks.

This could also be viewed as...

[Ghengis]

RedHat taking action to fix bugs in short order, while Microsoft drags their feet and doesn't even fix some holes deemed "low-risk." I'll take the OS from the company which has shown the commitment to supporting their customers over the one from the company that *says* they will.

C|Net is Microsoft's BITCH

[Anonymous Coward]

What the hell? Not far to go?!?!?!?!?!?! Who the fuck is paying the morons at C|Net to lie about this shit? MS got hit with more worms last year alone than it ever has. So, how is it now more secure???? C|Net is a bunch of MS whores!

Glass Houses?

[gregarican]

This honestly isn't intended to be a troll, but I'm sure it will probably be modded as such. Microsoft has had a slew of issues trying to patch apparently flawed reused code (since all Windows versions are built on top of each other's code, with reportedly Longhorn being the first "from scratch" Windows version). The fact that the same buffer overflows are so pervasive in their product line is inexcusable. Input validation and boundary checks are basics most folks learn in CS101 - Introduction to Programming. You wouldn't expect such flaws in each and every version of Windows software.

All of that being said, no technology area is devoid of security flaws. Look at the recent attention given to H.323 standard vulnerabilities due to default ASN.1 parsing. That affects many vendors and product lines. Today I read an ISC diary entry detailing a couple of exploits that affect non-Windows environments. Apache, OpenSSH, QMail, Sendmail, etc. have all had their share of recently announced flaws.

Of course Open Source Software *should* be more secure since many eyes can review the code as it is maintained and updated. But the fact that nevertheless there are significant flaws and exploits in this area further proves my point. Microsoft is the largest software company on the planet so of course they have a target on their back. There are no doubt many third party organizations dedicated to doing nothing but trying to break Windows in order to submit security reports. Of course there are anonymous black hats doing the same but for other obvious reasons.

If the same manpower and effort was dedicated to breaking Linux and OSS applications (which currently have much less exposure and market share) I am sure that even more holes would be poked into what most folks on this board defend as being the silver bullet against corporate greed, monopolistic tyranny, and gaping security holes.

Yeah, wait a minute!

[$ASANY]

Just when was it that "visiting random sites" or "opening random attachments" became sufficient explanations for a system going kablooie? "Well, Joe, you surfed www.turnips.net and you know it's a bad site! What were you thinking?" "Oh, my bad. Next time I'll consult the list of 'safe' sites before I go someplace unfamiliar."

We're not going to hold a software company responsible for selling a product that risks the data on your system by leaving itself vulnerable to normal user actions? What next, advisories that you shouldn't drive north because cold weather might make the wheels fall off your car at speeds in excess of 40 mph?

If I surf to a site, or open a random attachment in a viewer, and my system dies as a result, that software is defective by design. Any company that tells me I can't do either of these things with their products is admitting that they are knowingly selling defective software.

Really, though, it's the users who shell out significant coin buying products that are known to be defective that needs to change. If users won't hold a vendor accountable for their miserably defective garbage by not buying it, I guess the user community deserves all the pain that bad decisions cause. At least they could be rephrasing their complaints as "I bought a piece of crap and it exploded when I used it. I made a stupid decision." rather than "I surfed this site and my PC blew up. Bad site! Bad, bad site!"

Metrics, not quantity, have changed

[SgtChaireBourne]

Only the metrics have changed. This was an easy call when they first started bundling multiple issues into a single advisory. Notice also how the change to once a month reporting (spin) is also claimed as a security breakthrough. The issues still pile upt, it's just that they're only mentioned once a month. Also, for the last few years, issues are now counted from the time MS announces they will have a patch not the time that the problem is actually reported. It still takes months and, in some cases, years before a patch is issued. Even then, the patches have a high failure rate -- failing to fix the problem or introducing further problems -- and thats not even counting problems caused for 3rd party apps.

Also, last fall a few more former security companies knuckled under and now no longer engage in disclosure. Without some semblance of public disclosure, there is now way for sysadmins to verify that their systems are/aren't vulnerable or to verify if the patch worked or not. Talk about putting one's head in the sand.

The problems from that company are as severe as before, perhaps worse. For those still stuck with that company's products, 2004 will be a hard year, especially if its customers run afoul of privacy and other regulations as a result of the product.

2 years later and still finding unchecked buffers

[Anonymous Coward]

I think that would be an "F".

You'd think if they were truly serious M$ would root out and correct these as the #1 security priority....

But what do I know, I'm just a coward...

I don't know what Linux you're using...

[autechre]

Well OK, I guess it's probably Red Hat. But I haven't been "scrambling" at all, and I don't think the difference really comes down to me using Debian instead (in the long run).

You can't compare total number of security advisories between Red Hat and Microsoft and get any kind of reasonable data. Microsoft sells an operating system and a few applications, several of which are integrated into said operating system. Red Hat sells an operating system and hundreds of applications. All but the most basic, core tools are installed because you decided they should be. Most of the Debian Security Advisories that hit BUGTRAQ don't apply to any of my machines. With Microsoft, nearly all of the advisories that hit BUGTRAQ apply to my machines (with the exception of IIS and SQL Server, but gee! if I want to use SUS, I'll need IIS too, because we MUST use a full Web browser/server for software updates! Oh, and that's OUR Web browser and server, thanks.)

Don't use Media Player, Outlook Express, or Internet Explorer? Sorry, but we've decided that it's really important that your machines have all of those, including your servers. I don't have to install Mozilla and MPlayer on my Linux servers. I just install what I need. MS has added support for partial "uninstallation" of some software, but it seems to get put back after certain updates, and you can't get rid of IE.

I don't need the pretty point-and-drool GUIs on my servers, and Linux gives me that choice. I choose to install less software and be more secure. Microsoft doesn't offer choice, and doesn't want choices to be offered. That's the difference, and I don't think it's going to change any time soon. All of the security initiatives in the world won't change their corporate culture.

Give them another "F" on the report card

[SgtChaireBourne]

It got an "F" before, as well. Par for the course. However, their financial crisis is more interesting.

Of course Ballmer's upset, even late comers like HP are raking in sums like $2.5bn on Linux. That's not even counting the extra productivity from having a more secure design.

Even the regular employees know the gig is up and more than half have cashed in their options, even Uncle Fester himself cashed in. I'm sure the fact that the options come out of your U.S. taxes (in the form of a write off) has something to do with the accounting as well.

Parmalat, Enron, Worldcom, Microsoft.

It's going to be a long, difficult march

[mwood]

Many of the problems have been embedded in their corporate culture from Day 1. It's gonna take a long time to train *everybody* to think first about how some new whizzy feature might work against the security of the system as a whole, especially in a place where (apparently) whizzy features are the medium of exchange, and the more you can coin the richer you are.

So What they're saying is...

[Sfing_ter]

They liken securing their code to NASA's 10 years to get to the moon...

So that must mean it will take Open Sorcerors 20 to 30 years to make secure code because the Open Sorceror model is "ALL WRONG"...

Can I make you some sandwhiches?

"Standard" setup?

[autechre]

As someone else already pointed out, lftp is a client. That aside, I almost never run FTP on any of my servers. SCP clients are freely available for any operating system I can imagine someone using as a desktop. Perhaps there is a need for you to run anonymous FTP, but in that case you can select a secure product like publicfile.

Also, you can't have a Microsoft server with just an HTTP and FTP server. You must have a full GUI and fully featured Web browser with a _terrible_ security history in order to get security updates. You simply can't strip out features you don't need to the degree you can in Linux.

Why is it an important feature for _servers_ to be able to be set up with "a minimum amount of clue"? Aren't there hundreds of unemployed IT folks out there? Your company should at least be able to bring in a consultant to do the initial setup and show someone how to maintain it. You don't have Bob from accounting install the real-world security system. Why are computers supposed to be different?

Yes, Microsoft is getting better. But the diagnostic tools for figuring out why something is going wrong suck (though third parties help out here as much as they can). They still have EULAs for security updates, and their service packs don't offer an option to install all the security updates without the new "features". They still want to be the ones in control of the computer, and that's not what I want. Pivx have proven via their QwikFix tool that the default settings could certainly be locked down tighter while having no effect on most people (Windows admins: check this tool out. It would have stopped Blaster even on unpatched machines.)

As for RH9 making an early trip to the gulag, I've heard that Progeny will be offering support for some Red Hat versions. This also illustrates that commercial Linux distributions are vulnerable to the some of the same hazards as commercial proprietary software. The difference is that if you were REALLY inclined, you could create your own updates for Red Hat 9, which is why companies like Progeny can do it too. Or with something like Debian's apt-get source -b [package], you could keep even an unsupported version of the OS going. And yes, for the people who still need it, the 2.0 kernel is still having new releases. As it is in many other areas, the difference is the availability of choices.

Linux secure with common end-user?

[Anonymous Coward]

I'd like to see 90% of end-users using Linux and then see how secure it actually is... Note that these 90% will do _every_ possible stupid thing which will compromise security. Similarly, all the script kiddies, virus writers etc. would know that there is this huge bunch of potentially stupid guys (who do not know anything about security) using Linux. Now that would be a good security test (remember that many of these guys would also be admins by themselves...) for Linux (actually it would simply prove that Linux could not be used by these guys...).

Re:Linux secure with common end-user?

[_Sprocket_]

I'd like to see 90% of end-users using Linux and then see how secure it actually is... Note that these 90% will do _every_ possible stupid thing which will compromise security. Similarly, all the script kiddies, virus writers etc. would know that there is this huge bunch of potentially stupid guys (who do not know anything about security) using Linux.

That's a fair point. I'm also eager to see how Linux handles the desktop environment - a wasteland of unmanaged potential victims.

After all, Linux is not bulletproof. To take advantages of its strengths, someone has to manage it. In one form or another.

Having said that - its not a given that Linux would fall in the same manner as Windows. Keep in mind that many of the more successfull malware examples take advantage of fundimental design flaws in Windows or key Microsoft applications. In many ways, Microsoft has created its own problems.

To be fair, there are examples of Windows vulnerabilities that could be seen in Linux. Linux has had its fair share of worms too (although why they are shortlived is another conversation). And if a user is hell-bent on installing or executing some piece of dangerous code, then they're going to do it (and at the least lose their data).

But again - just because things happen in one environment, it doesn't mean they're going to happen in the new environment. Especially when those two environments have considerable differences.

0.0000000004 infected machines

[Anonymous Coward]

(Total number of infected machines) divided by (Total number of windows machines) = 0.0000000004

A pretty damn good record

Totally off-topic, but...

[IANAAC]

I have to ask:
If you think being an MCP sucks (I'm not one, nor do I plan on being one, so I wouldn't know), why did you even bother taking the exam? Was it for employment possibilities? Job requirement? If that's the case - and I'm assuming that you would prefer to do other (perhaps Linux) systems work - why not market that instead? If you're strong in other systems, you're definitely employable.

Re:Totally off-topic, but...

[Hes Nikke]

If you think being an MCP sucks (I'm not one, nor do I plan on being one, so I wouldn't know), why did you even bother taking the exam? Was it for employment possibilities? Job requirement? If that's the case - and I'm assuming that you would prefer to do other (perhaps Linux) systems work - why not market that instead? If you're strong in other systems, you're definitely employable.


i took it for employment possibilities. I'm marketing myself as a jack of all trades for computers, as it were. i can passably administer a linux box (but must have IRC open while doing it) and i can stumble about a windows system. my advantage is that i do Mac too. my future employer can throw any OS at me, and i'll (eventually) make it work.

there are a few other certs i'm going to get when i have practice and/or funds, such as A+, apples technician thing, linux certs, the list goes on and on.

as far as my personal preferences go, let me put it this way. I'm a Mac Zealot.

any more questions?

pigs feel insulted?

[Anonymous Coward]

being .compared to georgewellian fuddite corepirate nazi softwar gangster felons/execrable.

How come we never see an OSS report card?

[Overly Critical Guy]

Come on, this was a bad year, though everybody seems to pretend that nothing happened.

In the span of six months, GNU was hacked twice, and GNOME, Gentoo, and Debian were all breached. And according to Linux's dirty little secret, LinuxSecurity.com, dozens of new holes in OSS software are discovered every week.

Where is the Slashdot article on that?

Re:How come we never see an OSS report card?

[MattMan741]

as much as its a good thing to see someone who doesnt blithly follow the "if i install linux the box will magically become secure" myth, there are a few reasons that OSS isnt getting this kind of attention. first off, theres the process. someone reports the problem to ms, ms denies it, someone else reports it, ms denys it, but starts looking at it. it gets validated and the maintenance guys start looking at it. eventually they find the bug and make the patch. the patch goes to qa. the qa people make sure nothing gets broken by the patch, and then it makes its way to ms update. as opposed to (worst case) someone posting the problem to the mailing list of the app, (best case) someone posts the problem and a fix to the mailing list of the app. the turnaround in OSS is much faster, patches are issued all the time, usually within hours of the vulnerability being found. compare that with the microsoft turnaround.... the second thing is that, as much as people here hate to admit it, linux related stuff doesnt matter as much. when the overwhelming majority of computers on the internet can be harnesed for DDoS attacks, the scruteny falls on the people who allow this to happen. last point, do a comparison between the number of microsoft CERT warnings compared to those of other operating systems and tell me that the scruteny is unwarrented

Re:How come we never see an OSS report card?

[Anonymous Coward]

There was evidence to prove that Overly Critical Guy is a lying cocksucker, but he deleted it. Think independently.

Not bad, but check out these babies..

[Anonymous Coward]

bignutz@linux [~/work/bin] $ locate .vim|grep syntax
|wc -l
345
bignutz@linux [~/work/bin] $

Published...

[sLaSh_N_bUrN_(.Y.)]

exploits is the key. OSS encourages people to point out their bug and flaws. Because they care about the product they release to the world. M$ discourages people to mention their short commings. The site that listed all the unfixed IE bugs was taken down due to a request from M$. DCMA prevents people from mentioning anything they learn from decompiling programs. (You don't think that stopped do you?)

So, I makes sense that M$ has had below average exploits published last year.

the security is great if . . . .

[kraksmoka]

you look at the programs that NO ENTERPRISE WANTS TO ADOPT early. windoze 2k didn't gain wide acceptance until 2002 and 2003 server and its cohorts probably won't grab the same market share that 2k has overall, because of its massive security and compatibility issues.

What a warped perspective

[bogie]

You thought ALL bugs in opensource software would be eliminted? Sorry to sound flip but like are you new to the world of computers and software or something? The point isn't that both Linux and Microsoft software have security problems, that will ALWAYS be the case. The point is with Linux and OSS software security problems are fixed quicker and can't be covered up and ignored like in the commercial world. Shit they have the freaking code to OSS and even according to you the amount of crictical bugs was the same as MS's? Is there any more daming evidence against closed source software? I mean if all of the holes are in the open and isn't in a 100 to 1 ratio against OSS doesn't that say a shitload about the quality of OSS software?

Most linux admins I know were not scrambling just as much as MS ones. In fact talk to anybody in the industry and that is just par for the course. Linux admins as a whole enjoy better uptime and less security problems. If you feel differently be assured that you are in fact in the minority.

So No, OSS security Didn't "suck" in 2003 as you Trollishly put it. It sounds like the security practices and linux experience level at your company sure does though.

Admin privlidges to blame

[Imazalil]

I think alot of the crap problems that happen on a windows box stem from the fact that just about everyone using xp/2000 at home is running admin privlidges.

This is obciously not a good idea, but it's necessary. Games particularly are bad about this, half of them won't run with out admin rights. I don't know who to blame for this, microsoft should make it easy to operate as a regular user, not an admin. But software should be written to work with regular users, not just admins.

Yeah, outlook is still shiat. but hey, people want a pink background on their email, there's no way around it. maybe we should send pdf's back and forth. The days of plain text email is long gone, face it.

Imz.

To Paraphrase...

[MonkeyGone2Heaven]

That's not a bug, that's our business plan!

Try editplus

[Anonymous Coward]

http://www.editplus.com/

It can upload/download entire projects via FTP.
{You can do SFTP via tunnelling a self-hosted
FTP server forward to an SSH server,
until there is native support.}

It remembers files that were opened when you exit.

It supports all language, and defining
new syntax highlight is a piece of cake.

Syntax: C:\Program Files\EditPlus 2\perl.stx
AutoComplete: C:\Program Files\EditPlus 2\perl.acp

It can compile stuff in the output window
using CTRL-1,2,3,4,5,6,7,8,9,0 (for group 1-10)
[up to 100 commands possible via keyboard]

Tools->Configure User Tools...
Add Tool->Program
Menu Text: Perl 5.6 compiler
Command: c:\Perl5.6\perl.exe
Argument: $(FileName)
Init Dir: $(FileDir)
Capture Output [x]

Do the same for any other tools.

Click [OK]

[You can also configure for other
debug mode console tools if you want
via cygwin]

Type CTRL-N,
type some perl,
print "\n\nHello World\n\n";
hit CTRL-1
Have fun! =)

Re:Linux SecWindows Sec: NOT, my linux was rooted

[aaron_pet]

dude, windows has EASY security updates.

I use Gentoo Linux.. and had my box rooted right out in front of me.

and more often the linux security updates cause the computer not to boot!
(I updated some stuff on Suse with their updater... and blam, my boss was pissed at me, cause he told me NOT to update the boxes, and I was being paranoid about outsiders... but the suse update (kernel update) caused the computer not to boot even!

anyway, my gentoo was rooted, and I've had viruses on my windows... er.. dos on my 286 from a floppy... and from letting other people use my windows with infected floppies...

IMNSHO Linux is more difficult/mystic to keep secure... however it is getting better, and it's free... and I don't have to keep track of stupid serial numbers or pay for it.

security emulator

[zlel]

Why don't we just forget about making windows secure? Indulge me in my imagination -

IMHO, Windows made pretty bad choices as much as it earnestly strives to be a Network OS. I think the networking layer doesn't come up till pretty late in the bootup for one...

But anyway, if that's the case, since processors are getting more powerful, linux is our emblem for stability and security, and emulators are becoming so available, couldn't we just have a linux without GNOME nor KDE, but just run a fullscreen emulator on top of that and serve windows (or any OS) to the current logged in user?

In this way, we can run "baby" SCALED DOWN (yes, not bloated...) single-user OSs for users - and users get to customise their computing experience beyond choosing their favourite WM or desktop manager.

Yes, linux will become pretty invisible/invincible - but for most non un*x users out there, i think they don't really care what's running below.

Ah well, but that's just my imagination. but i think it'd be cool for instutitions to have such distros installed, then there wouldn't need to be "unix" labs different from "windows" labs. But I guess we need to wait for machines to be miraculously twice as powerful as software needs them to be for this to be less of an imagination.