Microsoft Security Patch Fixes URL Security Flaw

loteck writes "Microsoft has just released Security Update 832894. According to their official information, it affects all NT kernel versions of Windows and most versions of Internet Explorer. Here's a rundown of the important fixes, notably 'A vulnerability that involves the incorrect parsing of URLs that contain special characters' in Internet Explorer, as previously discussed on Slashdot."

Comments

Does this mean

[AuMatar]

I can stop typing in all my links by hand?

Oh wait- I use Mozilla. I didn't need to do that anyway.

Re:Does this mean

[SultanCemil]

Wait mozilla supports HYPERLINKS? wow. I do need to upgrade my browser.

Seriously, though - I think one of the bigger changes in this release is that IE no longer support username/password in the URL (http://me:you@whatever.com). No more easy pr0n surfing.

Re:Does this mean

[koh]

Yes indeed. Actually, if they did implement the workaround as initially designed, IE users will be unable to navigate such links when using SSL.

Of course, Moz/Fb/Opera will continue to operate as usual ;)

As an aside, there are many other fixes in this update that may be "hidden" under this obvious one... time to RTFA again at subsonic speed.

Re:Does this mean

[Sick Boy]

from the no-more-typing-URLs dept.

Based on the dept. line, I'd guess so.

Reading comprehension --

Re:Does this mean

[interiot]

Huh. I had kind of assumed that the username/password was part of the official URI spec, but apparently not:

• httpaddress
• • h t t p : / / hostport [ / path ] [ ? search ]
  
  ftpaddress
  • f t p : / / login / path [ ftptype ]
  
  login
  • [ user [ : password ] @ ] hostport
  
  hostport
  • host [ : port ]

Re:Does this mean

[mickwd]

Yes, I'm a little surprised there hasn't been more of a fuss over this.

Is this really the best Microsoft can do ?

Whenever a URL with an "xxx[:yyy]@" prefix is clicked or entered, why couldn't they pop up a login dialog box, specifying the name of the site (WITHOUT the xxx[:yyy]@ prefix), filling in the user name and password (i.e. the "xxx" and "yyy" in the appropriate fields), and asking for confirmation of the site to be visited ?

Or at least allow a configurable option such as "Disallow username/password in URLs / Prompt with Dialog Box / Allow" (with the default set to Disallow). That way, advanced users would still be able to use the username:password@ syntax if they enable the option. It's actually pretty useful as a quick way to transfer files by FTP, so I hope it's still supported over FTP.

Re:Does this mean

[the_mad_poster]

Not sure what you were looking for specifically, but the user:pass@host scheme is defined in RFC 1738.

And, no, they're not breaking the spec. It's optional:

Some or all of the parts ":@", ":", ":", and "/" may be excluded.

They're just being dumb. As usual.

Re:Does this mean

[pen]

Exactly what Opera does

Re:Does this mean

[iabervon]

To be more specific, "user[:password]@" *is* part of the official URI spec (both the one you cite and the RFC), but the "http" schema doesn't include it (again in both specs). The RFC actually explicitly states "No user name or password is allowed." The RFCs for both versions of HTTP exclude username and password as well.

So the correct answer is that "[username[:password]@]host[:port]" is part of URIs, but a "http:" URL is invalid if it includes either a username or a password. (On the other hand, "mailto:" is invalid without a username.)

So, in a very unusual turn of events, IE has become the first browser to conform to a particular specification, by making a non-standard change that happens to fit a bit of the specification that nobody who's written a browser actually read correctly. Makes you wonder if they looked at the spec to see if anyone was likely to care.

Re:Does this mean

[Holi]

No for http requests the username and password are NOT allowed.

RFC 1738 - Page 8
3.3. HTTP

The HTTP URL scheme is used to designate Internet resources accessible using HTTP (HyperText Transfer Protocol).

The HTTP protocol is specified elsewhere. This specification only describes the syntax of HTTP URLs. An HTTP URL takes the form:

http://(host>):(port)/(path)?(searchpart)

where and are as described in Section 3.1. If : is omitted, the port defaults to 80. No user name or password is allowed.

Re:Does this mean

[lintux]

Because most people are stupid enough to click Yes/OK without reading the message at all. That's what they usually do, right?...

But then again, they should've read the message. It's their own fault that evil guys get their credit card numbers.

Re:Does this mean

[gunpowder]

I love people referencing to some RFC, but then not reading it themselves :-P

You said "the user:pass@host" scheme is optional. This is right and wrong. This is described in Section 3.1 of RFC 1738, which describes the Common Internet Scheme Syntax, or the general form that URL can take.

The user:pass@host scheme is described as "optional" in the meaning that specific URL schemes can make use of them or not. A URL scheme can decide not to adopt/allow the 'user:pass@host' scheme at all.
Specific URL schemes for FTP, HTTP, MAILTO etc. are defined in Sections 3.2 - 3.11. These Sections describe what is allowed for each URL scheme (protocol ) and not.

Let's look at HTTP (excerpt from the RFC):


An HTTP URL takes the form:

http://<host>:<port>/<path>?<searchpart>

where and are as described in Section 3.1. If :<port>
is omitted, the port defaults to 80. No user name or password is
allowed.


Also your remark "They're just being dumb. As usual." is wrong.
Actually they finally conform to a open specification!

Re:Does this mean

[tunah]

I think "may be excluded" means "may be excluded by the user/in the link", so I would say they are breaking the spec.

Re:Does this mean

[spitzak]

No, because anybody that stupid can be fooled by simply having the URL go directly to the evil site.

The basic problem is that IE displays the URL "http://www.good.com/foo%00@www.evil.com/bar" as "http://www.good.com/foo" and thus completely hides the fact that it actually goes to "www.evil.com", even for an expert user. This is the bug in IE that needs to be fixed.

Even if fixed, the above URL would certainly fool a lot of people that it goes to "good.com". All browsers today seem vulnerable to this. So some solution is necessary.

My recommended solution is to preview starting with the '@' sign so the user sees "@www.evil.com/bar". This also has the nice effect of hiding the username & password for (obviously extremely weak) security.

I do think Microsoft's solution is about the stupidest thing they can do after the "do nothing" solution. I find it hard to believe they cannot fix their status bar preview, this would indicate the innards are such a horrible mess of spagetti that they cannot make even simple changes and they had to attack the only single point of entry which is where the http get command is processed.

Of course the '@' is not a standard, but neither is ActiveX and Microsoft does not seem to be removing that. Saying that it is ok because it is not an official standard is stupid. It will break plenty of sites.

Re:Does this mean

[mlefevre]

You may think that, but (as various other comments have already pointed out) it's not what RFC 1738 says:

"3.3. HTTP

... An HTTP URL takes the form:
http://<host>:<port>/<path>?<searchpart>
.. . No user name or password is allowed."

Any URLs broken by this change weren't RFC-compliant.

Re:Does this mean

[irix]

I love it when someone quotes an RFC, but doesn't realize that it has been superceded by a more recent RFC.

The practice of sending a username and password is not reccomended, but it is defined in relevant RFC and is explicitly allowed in the URL syntax. Microsoft will be breaking the standard if they disallow this format.

Re:Does this mean

[Anonymous Coward]

Some URL schemes use the format "user:password" in the userinfo field. This practice is NOT RECOMMENDED, because the passing of authentication information in clear text (such as URI) has proven to be a security risk in almost every case where it has been used.

"Some URL schemes". That doesn't explicitly allow it in HTTP as it was already disallowed in RFC 1738. To me that's saying some URL schemes (like FTP for instance) allow it, but it's not recommended. I have only seen one instance where some has tried to use http://username@password:hostname format at work, but it obviously didn't work because our security proxy closely follows the RFC and doesn't allow it. It wasn't a huge deal as they just needed to type in their basic authentication information into a popup box. This is a good thing that IE doesn't support such an obviously broken syntax. For what it's worth, it really doesn't matter if it's in the RFC or not... If IE supports it then people will use it. If it doesn't then people won't. IE is the top browser these days boys and it can write it's own rules.

Re:Does this mean

[gunpowder]

1. I responded to a post that claimed that according to RFC 1738 the user:pass@host scheme is allowed in combination with http://-URLs. The RFC 1738 doen't allow the use of user:pass@host.

2. You say that RFC 2396 supercedes RFC 1738, but you fail to mention whether this RFC is considered mandatory or not.

3. Even though RFC 2396 supercedes RFC 1738, it still doesn't allow the user:pass@host scheme for http://-URLs. Excerpt from RFC 2396:

Some URL schemes use the format "user:password" in the userinfo field. This practice is NOT RECOMMENDED, because the passing of authentication information in clear text (such as URI) has proven to be a security risk in almost every case where it has been used.

The "some URL schemes" are those defined in RFC 1738 (since there are no definitions of specific URL schemes in this RFC 2396). So user:pass@host is STILL NOT ALLOWED or even mandatory by RFC 2396.

Re:Does this mean

[Richard_at_work]

Uhm, read that RFC, and no where in there does it contradict the earlier RFC with regards to the username password conventions. THis is the passage that comes closest:

Some URL schemes use the format "user:password" in the userinfo field. This practice is NOT RECOMMENDED, because the passing of authentication information in clear text (such as URI) has proven to be a security risk in almost every case where it has been used.

Note it says "Some URL schemes" but doesnt specificy ALL URL schemes, so i guess the earlier RFC stands.

Re:Does this mean

[Haeleth]

I love it when someone quotes an RFC, but doesn't realize that it has been superceded by a more recent RFC. (link to RFC 2396)

Ditto.

Re:Does this mean

[rixstep]

this would indicate the innards are such a horrible mess of spagetti that they cannot make even simple changes

You really thought otherwise?

Re:Does this mean

[andy landy]

The whole thing is a bit of a moot point anyway. The quick rundown for those who weren't paying attention:

IE doesn't print anything after a ^A (0x01 in ASCII)
so scamsters were using

www.microsoft.com^A@myhaxorwebsite.com/

the result being that only www.microsoft.com would show up and people would think the link is genuine

Removing the user@domainname feature does *nothing* to stop the scammers. Instead, you just have a long domain name, e.g.

www.microsoft.com.myhaxordomain.com and put the ^A in the obvious place! Guess what... Same problem.

At least they've finally patched the thing altogether, but as for that CLSID exploit, well, I guess you'd better keep typing those URLs by hand!

Re:Does this mean

[irix]

Even though RFC 2396 supercedes RFC 1738, it still doesn't allow the user:pass@host scheme for http://-URLs. Excerpt from RFC 2396

Wrong. Not recommended for security reasons is not the same as not allowed. Try reading the BNF for the userinfo portion of the URL definition (it doesn't pass the lameness filter so I can't post it), along with:

URL schemes that involve the direct use of an IP-based protocol to a specified server on the Internet use a common syntax for the server component of the URI's scheme-specific data: <userinfo>@<host>:<port> where <userinfo> may consist of a user name and, optionally, scheme-specific information about how to gain authorization to access the server. The parts "<userinfo>@" and ":<port>" may be omitted.

The user:pass@host scheme is explicitly defined and absoluteley allowed in the URL syntax. Whether you want to transmit this information in the clear is the issue taken up the paragraph you quoted, not whether the form is allowed. Nice wordsmithing though - apparently the Microsoft apologists amongst the moderators bought it.

Re:Does this mean

[irix]

LOL. Did you even read that RFC? Try the preceeding section:

For definitive information on URL syntax and semantics, see "Uniform Resource Identifiers (URI): Generic Syntax and Semantics," RFC 2396 [42] (which replaces RFCs 1738 [4] and RFC 1808 [11])

Thanks for making my point for me. RFC 2616 describes HTTP 1.1, not URL syntax. Is explicitly defers to RFC 2396 for that - it does not obsolete RFC 2396 in any way.

Re:Does this mean

[scrytch]

Whenever a URL with an "xxx[:yyy]@" prefix is clicked or entered, why couldn't they pop up a login dialog box, specifying the name of the site (WITHOUT the xxx[:yyy]@ prefix), filling in the user name and password (i.e. the "xxx" and "yyy" in the appropriate fields), and asking for confirmation of the site to be visited ?

Because that wouldn't protect very well against domains that look similar, nor would it matter to the legions of users that click "yes" on every dialog that comes about.

Of course I don't know of any technical fix that protects against attacks from similar looking domains.

Or at least allow a configurable option such as "Disallow username/password in URLs / Prompt with Dialog Box / Allow" (with the default set to Disallow).

Because that would be sensible, and in line with the rest of the "Advanced" security options, which would let home users set policy, allow policy to be pushed (and locked) from a domain controller, and allow per-zone exceptions so you could specifically trust some sites with the full url scheme. In other words, it would make too much sense, and Microsoft is ever quick to ensure that no good underlying technology of theirs escapes being crippled by dumb, insecure, and inconsistent shells.

Re:Does this mean

[spitzak]

Get rid of this and any ability to hide the destination of a URL. The status bar should show the URL (it can show the javascript status when you are *not* pointing at a URL).

If sites are relying on this information being visible, show it in the tooltip for the URL instead.

Have any browsers addressed this?

Re:Does this mean

[gunpowder]

RFC 2396 allows URIs in the form of @:

... I never denied that! However you missed entirely what I was saying in my last post.


The user:pass@host scheme is explicitly defined and absoluteley allowed in the URL syntax.

... to be used by the URL schemes. Try learning to read RFCs. I know it can be a little bit confusing...
From my previous posts:


1. RFC 1783 says the HTTP URL scheme doesn't allow "user:password".

2. RFC 2396 replaces the parts that also defined in RFC 1783, but the definition of specific URL schemes aren't specified in RFC 2396 (BUT makes references to them!), so obvioulsy the RFC 1783 still covers the definition of specific URL schemes.

3. RFC 2396 now allows all URI schemes to use <userinfo>@<host>:<port>.

4. Furthermore is says: "Some URL schemes use the format "user:password" in the userinfo field. This practice is NOT RECOMMENDED, [...]".


Now think. Why does it say "Some URL schemes"?
Well, 2.) tells us that RFC 2396 doesn't say which ones do use them and which ones don't. Thats specified in RFC 1738!
We also know from 1.) that e.g. HTTP URL scheme doesn't allow the user:password format!
So in 4.) the words "NOT RECOMMENDED" doesn't apply to HTTP URL in the first place.
And I never denied 3.)


Nice wordsmithing though - apparently the Microsoft apologists amongst the moderators bought it

Actually you are much better in wordsmithing than I am!

Re:Does this mean

[gunpowder]

1. Learn to read RFCs.
2. If you are too stupid, try to read and understand my explanation for dummies
3. Yes, I'm indeed in software development.

Re:Does this mean

[gunpowder]

No, you missed my point. Maybe this is a little bit easier to understand.

Re:Does this mean

[gunpowder]

Again you missed the point!
It is not clear to me whether you are a troll or just stubborn.

His link points to a RFC that makes references to your beloved RFC 2396, but STILL MENTIONS that "user:password" is not allowed for HTTP URLs. Why would it do that if it was allowed in RFC 2396 (according to you)?

Re:Does this mean

[gunpowder]

Sorry for being to rude in my previous post, you actually have a point here.
He said ditto and implied that RFC 2396 was superceded by RFC 2616, but this is not the case.

However the description of HTTP URLs in RFC 2616 is another hint for you that you might be wrong ...

Re:Does this mean

[SharpFang]

I have only seen one instance where some has tried to use http://username@password:hostname format at work, but it obviously didn't work because our security proxy closely follows the RFC and doesn't allow it.

And maybe because it took username as username, password as host (after @) and host as port number (: following host) ?
The format would be
username:password@hostname
not
username@pass word:hostname

the needed patch

[vargul]

hm... they should patch IE up to be mozilla for example... that could be called a patch...

Re:the needed patch

[jonfromspace]

No offense... but this is getting old.

Yes, Mozilla is better than IE in alot of cases... but don't forget, the average user still uses the internet for email, online banking, and news sites.

And guess where you are more than likely to run into an "I.E. reccomended" site? Online banking.

Yes, "developers should...", but Developers should do a lot of stuff that they never will. Reality is, Mozilla is a far way from replacing I.E.

Re:the needed patch

[vargul]

u obviously got the point. that is why i wrote: patch it up to be mozilla

i shall add: keep calling it IE if u want...

Re:the needed patch

[roystgnr]

Yes, Mozilla is better than IE in alot of cases... but don't forget, the average user still uses the internet for email, online banking, and news sites.

So do I.

And guess where you are more than likely to run into an "I.E. reccomended" site? Online banking.

Not at my little bank.

Reality is, Mozilla is a far way from replacing I.E.

Well, if your bank sucks, I suppose so. I'd be curious about which bank it is, though; the only place I still see "You should have Internet Explorer!" pages is zone.msn.com.

Re:the needed patch

[Trinition]

Franly, the last time I checked Mozilla, the UI sucked. My apologies if they've changed the fundamentally flawed UI since I've last checked.

But seriously, I've actually taken advantage of the IE/Windows integration, the fact that your FAvorites are acutally files in folders, the way I can embed HTML in my OS taskbar to provide useful functions, and I can REMOVE and COMBINE (not just collapse to fewer pixels) the toolbars to make the best use of my high resolution screen.

Despite the security problems which to date haven't actually affected be, I am not willign to give up IE because I would lose the convenience of everythign I've been able to do with IE.

And before anyone tries to call me lazy, I challenge any mouse-wheel addicted user to disable the wheel.

Re:the needed patch

[slimme]

I do my online banking with the biggest bank in Belgium (Fortis) and it works just fine using Mozilla running on knoppix.

Re:the needed patch

[Trogre]

Reality is, Mozilla is a far way from replacing I.E.

Perhaps so, but I use the web for business and recreation on average 6 hours a day, and have never in the last three years had to resort to IE.

Except, that is, for ensuring that web pages I write render correctly on the lowest common denominator.

Re:the needed patch

[slash-tard]

Not to be redundant, But I use Etrade for banking and stocks and it works fine in Safari and Mozilla. I have also used Ameritrade, and I uses several financial sites for work.

I use several different email and news sites regularly and havent found any that dont work right.

Some will occasionally have very minor display issues.

MSN/MSNBC will have features that dont support other browsers but thats to be expected from MS.

*BTW Explorer is my preferred browser on my XP machine.

Re:the needed patch

[hayds]

I dont see the problem with it Mozilla. I use Safari and Camino on a Mac and Ive never had a problem with my webmail, banking, webbased server admin tools, etc. I dont even have a computer with IE on it! The only site ive ever had trouble with was one dodgy one done in a really early version of Frontpage and the links didnt work. Aside from that other browsers seem more than up for the taks.

Re:the needed patch

[Anonymous Coward]

Considering IE is less secure than Mozilla it's alarming to me that any bank would "require" it.

Re:the needed patch

[ejdmoo]

Think Firebird. I hated Mozilla, loved Firebird. :)

Re:the needed patch

[Quantum Jim]

the average user still uses the internet for email, online banking, and news sites. (emphasis mine)

Um, I don't think the average user uses the internet for online banking. Nobody else that I know of does, and a statistic site claims that only 17% of Americans use online banking. Furthermore - although I only use those sites sparingly - I never had any problems banking with Mozilla. Thus, I feel that your concerns are overblown.

Re:the needed patch

[gyratedotorg]

"Mozilla is a far way from replacing I.E."

well, maybe we should try to fix that. dont forget, netscape was once the dominant browser, and it was never came preinstalled with windows. this leads me to believe that the typical user will install a new browser if they have a compelling reason to do so. i suspect the problem is that the typical user just isnt aware of the alternatives. we need to change that. remember a few years ago how every site had a little "best viewed with x" button in the corner? what ever happened to that? maybe we should consider using these again, simply to promote some of the lesser known, but far superior alternatives.

Re:the needed patch

[LordKazan]

Except, that is, for ensuring that web pages I write render correctly on the lowest common denominator

Same here - i work for Ames Lab (not NASA AMES, Dept of Energy Ames Lab in Ames, IA) - im the new webmonkey for the condensed matter physics page (http://cmp.ameslab.gov -- the current version of the page is NOT my work) I switch between Opera, IE and Mozilla for testing - but for my browsing needs it's been straight netscape/mozilla since the internet was invented -- not _once_ have i had a problem accessing banks, etc using Mozilla -- funny thing is my own community CC had more problems with IE users than netscape/mozilla users - N/M always comes with 128bit crypto, that wasn't true for IE until relatively recently, they'd have users locked out how having lame [sub-par] crypto.

I occasionally run into sites that are IE-only - they're typically M$ cronies sites, etc -- and when they're not and it's just surely ignorance I give the webmaster a [polite] earful and generally the problem get's fixed.

BTW: Hurray for IE actually conforming to the DOM2 standard finally - i don't have to write seperate drop menu JS code for IE, NS/Moz and Opera

Re:the needed patch

[tupps]

Grab Mozilla/Opera/Whatever and use Tabs for a little while. I cannot use any browser now without tabs. Having 10 pages open is no problem, and it is great when you come to a site and need to look at 10 different articles that might interest you (eg Slashdot front page). Also Mozilla has a pretty extensive scripting language behind it. I beleive that the Calendar module is written purely in that scripting language. Thanks Luke

Re:the needed patch

[Bombcar]

Just pointing out that My Bank also works just fine with mozilla and Opera.

Re:the needed patch

[adamofgreyskull]

Firebird works fine at my little bank too.

The only problems I've had is with websites who think they know best, telling me I *need* internet explorer this, or netscape that, and send me on my way. Of course, using the ol' user agent switcher solves this "problem". Why do they insist on simply blocking the other browsers?

Re:the needed patch

[Mr_Matt]

And before anyone tries to call me lazy, I challenge any mouse-wheel addicted user to disable the wheel.

Challenge met, sir, let me get my hammer...

*whomp* *whomp* *WHOMP* ...yeah, that ought to do it. :)

And while I appreciate that you enjoy the features you list above (fav's in folders, taskbar access, toolbar mobility) they're not for everyone. Me, for example - I tend to struggle with Microsoft's 'You Must Double-Click A Lot To Get Your File Structure Sorted' hierarchy, and all those damn toolbars just eat space on my not-so-high resolution screen. To each their own, I suppose.

Anyways, if you haven't already, try Firebird - you lose some of the things you like, but the UI is about as intuitive as any I've used, especially in Linux. Cut-n-pasting URLs into new tabs with four mouse clicks and a whammy on the NumPad key just looks cool.

Re:the needed patch

[owlstead]

Yes, the Rabobank in the Netherlands nowadays (not previously) runs fine in Mozilla as well. You need to enable resizing in Javascript and popups (for that particular site) as well. Most important sites in the Netherlands are Mozilla friendly.

Unfortunately you still need a windows computer to fill in your tax papers. This application is Windows only. Strange for a government to require a monopolistic operating system to run their software.

Oh well...

Re:the needed patch

[amaprotu]

When Netscape was the dominant browser there was no preinstalled capable browser

As soon as the pre-installed IE was actually capable or rendering webpages with anything resembling accuracy/ability then Netscape lost its share.

Re:the needed patch

[Ephemeriis]

I do plenty of online banking...with Mozilla. My bank, my credit cards, my car insurance, most of the bills I pay...all online, and all with Mozilla. The only websites I have encountered in the last year that didn't work with Mozilla were Microsoft's own Windows Update site, and Blizzard's WoW beta signup page. That's it. Absolutely everything else has worked fine with Mozilla.

yrs,
Ephemeriis

Re:the needed patch

[IthnkImParanoid]

I have visited very few sites in the last couple years that couldn't handle alternate browsers, and most of them were small-business sites or MS sites. The most notable is the USPS package tracking page, which doesn't recognize Opera 7.11 as being higher than Opera 5.0 (which it says it supports).

Wells Fargo online banking works just fine with either Opera or Mozilla.

Re:the needed patch

[BillyBlaze]

And for any banks that don't work with other browsers, the solution is to email them a nastygram, then either switch banks (if you're idealistic to a fault) or use IE for that site (if you're practical). There's no reason to use an inferior browser when you don't have to. (There's a plugin that makes it easy to switch to IE on the fly.)

Re:the needed patch

[caino59]

ok, a lot of people posted about how there -small- banks work with mozilla/firebird...

my reasonably sized bank works great with Firebird. I haven't encountered one problem yet. Onlinebanking and all.

Re:the needed patch

[next1]

And guess where you are more than likely to run into an "I.E. reccomended" site? Online banking.

this is changing - i use 3 online banking sites and 2 of them support mozilla. the one that doesn't will soon be losing me as a customer.

Yes, "developers should...", but Developers should do a lot of stuff that they never will.

i develop mozilla compatible applications and so should everyone else. everyone i know does.

Re:the needed patch

[BoneFlower]

Get a real bank. Both banks I've used have been perfectly compatible with Mozilla.

Re:the needed patch

[ptbarnett]

my reasonably sized bank works great with Firebird. I haven't encountered one problem yet. Onlinebanking and all.

I've also had no problems with Firebird at Wells Fargo and Fidelity Investments.

Re:the needed patch

[the_mad_poster]

I just canceled a credit card with MBNA because they added a browser sniffer that kept telling me I had "an older version of Netscape" and I needed to upgrade. Wouldn't let me into the site on FB 0.7 on Linux, so I sent them a nice little "fuck you too" cancel request explaining that their site is broken and that's why I'm canceling.

And yes, the site worked just fine in FB 0.7 once I sent an IE 6.0 UA.

I make it a point to relentlessly hound businesses that pull that little stunt. I also post their links on Open Source boards so everyone can get a shot at them. And don't tell me it's childish or rude or anything else - if they hadn't intentionally broken the site in the first place I wouldn't be obligated to tell everyone that the site is crippled. If they can't even hire half-competent web designers (or, more likely, if their management weren't typically incompetent and it actually listened to the web designers) why should I assume that they're capable of handling something as complex as my banking? They're cutting corners there, where else might they be?

Re:the needed patch

[cscx]

That's not the only reason Netscape lost its share. Maybe you don't remember the early to mid days of the WWW, but I do. I remember using Mosaic to download IE from Microsoft. Why? Because Netscape cost $50 a copy. IE was free, and thought to be "almost as good." Sure, Netscape was a better browser at the time, but it wasn't $50 worth of better. I stuck with IE ever since... but I use Firebird now.

Re:the needed patch

[Curtman]

can't open more than like 20 pages without deciding not to refresh its window anymore

That's not a problem because Moz has popup blocking, so pages can't throw 25 windows at you unless you allow it. And I just tried opening 30 windows, it worked fine. What are you talking about?

Re:the needed patch

[the_mad_poster]

Slashdot is the best use of tabs I've found to date. I LOVE being able to open a new tab with the "Reply to This" links. Another awesome use is when spillover occurs and I can't see all the comments I want to. I can just hit the "x comments below..." links to open them in new tabs, then close the tabs down as I read up through the "hidden" posts in a long thread. Since the tabs open chronologically (unlike windows which just sort of scatter), this works REALLY well.

Re:the needed patch

[Sylver Dragon]

Firebird/Mozilla (I use both, diffent computers) is just fine with my bank as well, Downey Savings.
Though, even with user agent switching, I have yet to get Yahoo's Launchcast to work in Firebird. So, some sites are still broken.

Re:the needed patch

[joebok]

I had pretty much the same thoughts for quite a while - until last week. I installed the latest Mozilla, spent a little time playing with it and now am in the process of switching. The tabbed browsing is awesome. The UI still isn't as good (not as flexible on the task bar as IE), but the tabs make up for it for me.

Change the skin first thing - the old Netscape look really rubbed me the wrong way. Spend a little time on the preferences. I think it's worth another look!

Re:the needed patch

[Curtman]

And how about "Bookmark This Group of Tabs". That feature just rules. You can make a bookmark that opens a bunch of tabs at once.

Re:the needed patch

[Zack]

I told my copy of Mozilla to identify itself as IE and that site worked fine for me. Made me angry that I had to go through that.

Re:the needed patch

[Jaysyn]

www.qvc.com wouldn't load on Safari, so I told mom to crank up IE. Lo & behold it worked.

Jaysyn

Re:the needed patch

[Lehk228]

I have to agree with your sig... but seriously I have fleet and they don't ask me to use IE for online banking

Re:the needed patch

[Curtman]

twice as much more

Probably because you then have two browsers open. If you had some way of unloading IE, maybe your computer would feel doubly faster much more. Hah. Even with a modest amount of RAM, 128M on an old PII 300 Mozilla seems much quicker than IE, when was the last time you tried Mozilla? v0.9?

Re:the needed patch

[smittyoneeach]

What's fun is when you set your global prefs to 'Non-Microsoft' in XP in the Set Program Access and Defaults section.
IE goes away, which is a Good Thing most of the time, except for when you really do need to do something on a Redmond websits.
Clearly, they aren't testing their site against Foreign Browsers, nor do I think they should have to. However, it's now a right PITA to reset everything to use IE.
But wait!
Even though C:\Program Files\Internet Explorer\iexplore.exe isn't exactly visibile in either the explorer or at a command prompt, that critter is still there!
Lighting off cygwin,
cd cygdrive/c/Program\ Files/Internet\ Explorer
ls -ali still has the subtlety of Cassius Clay
You can set a shortcut to IExplore.exe, and still use it to get to Mr. Softy's content.
I guess this is Mr. Softy complying with the anti-trust suit, so, in the main, it's a Good Thing.
However, what troubles me is the blurry line between the OS and the applications.
It is so refreshing to know that, in a linux environment, there is no ambiguitiy about what files are where, and what processes are running. All hail the text-based configuration file. w00t.

Re:the needed patch

[axelseaa]

While most places do recommend you use internet explorer, it seems that browsers in general are getting more leniant as far as browser specific details that would cause it to not function in a different browser. Also with the aiding of style sheets, it helps the process of pages appearing more similiar throughout different browsers.

Re:the needed patch

[Lehk228]

How do you switch user agents in Firebird?

Re:the needed patch

[Trinition]

Like I said, I haven't checked it in a while. I periodically read headlines about new milestones and none of teh new features impress me.

Please remember, my criticisms was intended to attack the parent poster's suggestion that everyone shoudl drop IE because of its security flaws and move to Mozilla. I simply listed many of the reaons I don't.

Now, that said, the biggest reason I hear people suggesting is tabbed windows. Personally, I think they're overrated. I don't need tabbed windows. ALT-TAB and the taskbar work perfectly fine for me. I used tabbed browsing in Opera and didn't like it in all cases. If I have several related web pages open, it's nice. BUt other than that, I have no reason to have unrelated sites open in the same window. Id' rather let my task switcher manage teh switching of my tasks.

What I did like from Opera was the mouse gestures. But, now I use Stroke It and that works not just in IE, but in any application. The only function it doesn't perform is opening a link in a new window by dragging it "down".

Now, as you mentioned dumbing things down, perhaps you should spend some time looking into cusotmizing IE before you imply that it is dumbed down. What it is is a simple, OS-consistent experience out-of-the-box. But it is easy to extend and use in ways that most people don't ever touch upon.

Re:the needed patch

[pantycrickets]

u obviously got the point. that is why i wrote: patch it up to be mozilla

u r the kind of peeps i wud take advice from.

Re:the needed patch

[scragz]

Install User Agent Toolbar Widget or User Agent Switcher.

Re:the needed patch

[Lehk228]

thanks

Re:the needed patch

[westlake]

Yes, Mozilla is better than IE in alot of cases... but don't forget, the average user still uses the internet for email, online banking, and news sites.

The Internet is also media. Think of radio services like Live365.com., Windows only, painlessly installed and easily launched from within Internet Explorer.

The enhancements in Moz appeal to Geeks, but other users of the 'net may have different priorities.

Re:the needed patch

[Curtman]

I'll assume he meant Firebird then, because I've never seen Mozilla do that.

Re:the needed patch

[DarkSarin]

Better Bank and Trust is my bank. You CANNOT log in withou IE. Mozilla fails to display correctly. I mailed them, and got a BS answer about the "wrong" type of java being used since greater than netscape 4.x! As near as I can tell, it is related to the good ol' layer tag, but I am not certain. If you want to, take a look!

Re:the needed patch

[catscan2000]

I'm in the middle of phasing out my MBNA card for the same reason (plus, I now want to earn miles instead of benefitting my alma mater).

I called them about a month ago to complain. The tech guy on the phone recommended using Internet Explorer, even though I'm on a Mac. I have IE, but that thing is a slow dog on Panther :-(. On the next billing cycle, I installed the UAbar, but am waiting for my new card with air miles from another bank that I know works with Mozilla :-).

Funny thing is that MBNA doesn't work in Safari, either, giving the exact same error message of it being an old version of Netscape. Bah! And the "new" Checkfree system tries to trick you up by making the default payment date equal to the payment due date rather than the old system's more-sensible first available date. Grace periods don't apply if you're carrying a balance forward, so every day counts! (and they know it, too)

Re:the needed patch

[Cutriss]

Funny. I've got FB 0.7 on Windows 2000 and it works fine for me. I just logged in, checked my balance, and set up a payment in the Payment Center. And my UserAgent isn't set to IE either.

Perhaps you cancelled your account a bit prematurely...

Re:the needed patch

[petabyte]

Yeah, I just really wish there was a user agent switcher tool for epiphany or galeon. I get irritated about having to close my browser and switch to mozilla in order to browse a site. Oh well.

Re:the needed patch

[bonch]

Me, for example - I tend to struggle with Microsoft's 'You Must Double-Click A Lot To Get Your File Structure Sorted' hierarchy, and all those damn toolbars just eat space on my not-so-high resolution screen. To each their own, I suppose.

So set Explorer to single-click folders, and remove toolbars or size their graphics to Small.

Re:the needed patch

[MS_is_the_best]

The tax program runs fine in Wine (only the select fields must be navigated with the keyboard). No, that is not a good alternative, but just pointing it out to help you ;-).

Re:the needed patch

[essdodson]

Just the Facts here.

Bank of America | Online Banking | Technical and Security FAQs

What kind of computer equipment and software do I need for Online Banking?

You need a computer, modem, Internet access and one of the following recommended Internet browsers: Netscape 6.2 and higher or Microsoft Internet Explorer 5.5 and higher. You can use either a Macintosh or a Windows computer.

Looks like they don't want to deal with Linux users.

Re:the needed patch

[jadavis]

I don't like wamu. The logoff requires confirmation, which goes against all de facto standards and could leave you logged in when you thought you were clear.

There were a few other things that bothered me about the online experience and the bank itself.

And I DID switch banks. A bank needs to be seamless. If I want to move money, I want it NOW and without difficulty.

Wells Fargo has actually worked quite well for me for a long time. They made a big mistake though, and for that I will never forgive them (it didn't cost me anything, but it could have, and it was very time-sensitive).

Re:the needed patch

[TiggsPanther]

Actually, the bank I use (both off-and on-line) is the Halifax, and their online banking works pefectly under Mozilla.

However, at work I am forced to use IE for one or two things. Nothing to do with "Policy" in the slightest. It's that our e-mail is through OWA (I'm off main-site, so there is no alternative - gits!). And not only is the slimmed-down non-IE interface really really bad, but something in the way the techies over at mainsite (mis-)configured Exchange Server means that unless you use IE, it constantly asks for your password every damn time you even change panel.
Hell, even under IE on my family laptop (only machine of "mine" that doesn't use Moz), it still does it this way.

But yeah, there's the simple fact that many web-developers only ever support IE. And a lot of things MS-based just don't seem to work under Mozilla.

Tiggs

Re:the needed patch

[vandel405]

I bet you'd also flip out if they didn't test it with FB 0.7 on Linux and then it ate your data.

Re:the needed patch

[the_mad_poster]

You're the second person who said it works in Windows, but if I switch my UA back to "Default" from "IE 6.0 Windows XP" it still drops me. Are you accessing it from mbnanetaccess.com ? Also, note that it's that new 3rd party payment center they use that's causing problems. I can still do everything I always could with the actual mbna site until I get into handling payments, then it flops.

If we're both looking at the same thing, my bet is it's some sort of regex that's crapping out when it sees that Linux is being used (maybe has 'Windows' literal hardwired into it somewhere). Equally annoying. I will test that theory later.

Re:the needed patch

[fraudrogic]

When this security flaw was announced, everyone in slashdot was "firebird firebird firebird", so I went and downloaded, installed, and am now using it.

Great browser, cool themes thing goin on here. I like the tabs, really cleans up my bar down there with all of the programs. With IE I could have 15 IE windows open and they would all be represented at the start bar.

The biggest gripe I have (and this gripe will cause me to switch back to IE with this patch or goto netscape or something) is that it is soooo freaking slow when switching between programs and switching between tabs. When clicking on the toolbar, the menus take a full second to appear, or right clicking to save a link or something, takes a long time. It feels like this thing was written in java and there is that JVM latency you get when running java programs, where buttons take a second to pop-in, the window stays blank a second until the contents pops-in. I have a pretty fast laptop (p4 2.2 ghz, 1gb ram, geforce togo) so this isn't the problem (especially when other programs do not exhibit this kind of behavior, except for java programs). I loathe this...i can't stand that it behaves like this.

I really like Firebird, but I think its going to have to go. Is netscape still a good browser? I haven't used it since I switched to XP a couple of years ago.

Re:the needed patch

[Fr33z0r]

Anyways, if you haven't already, try Firebird - you lose some of the things you like, but the UI is about as intuitive as any I've used, especially in Linux. Cut-n-pasting URLs into new tabs with four mouse clicks and a whammy on the NumPad key just looks cool.

4? Numpad?

I'm on windows just now (ick) with a two-button mouse (double-ick) but I'm not sure what you're doing there, maybe you're right (I can't remember, and can't test it here) but if you've got the other tab open you can click the address bar (to highlight the address) click the target tab's tab, then middle click anywhere in the body - 3 clicks, no numpad.

Re:the needed patch

[the_mad_poster]

Two other people have told me that Fb 0.7 on Windows throws no errors. I think they've hardwired a regex with "Windows" somewhere. I'm going to test that theory with a Perl/LWP script later today.

Re:the needed patch

[Gr8Apes]

Heck, I've used Mozilla since 1.2 for pretty much everything. With the exception of Test Director, which uses Active X and therefore requires IE, and one page at work which has bad JavaScript and works in IE.

Re:the needed patch

[Lanzah]

Here's a swedish bank that's 100% IE.. all I'm getting with moz (and konq) is a blank page, havent tested it with opera though. (I have emailed and complained about it, but they don't seem too eager to fix it.)

Re:the needed patch

[dragonflea]

But, it is *their* site to do with as they please, regardless whether it is from explicit intention or stupidity. The company owning the site does not "owe it" to you or anyone else to ensure compatibility with BubbasSchoolProjectWebBrowser or whatever else you prefer to use. If *your* browser doesn't work on *their* site, then you can either choose another browser, or choose another site. Maybe once you have a real job, repsonsible for ensuring near-flawless operation of a banking website with millions of users, you'll appreciate the need to limit compatitibilty support and testing to the top 98% platforms....

Re:the needed patch

[Bombcar]

The logoff thing could be annoying, but they haven't accidently transferred my money to the wrong account yet, so I'll stick with them. Had too many friends that had big problems with BofA and Fargo to even consider using them.

And they're pretty reasonable, too. But they've been working on the back end database and have had some issues.

Re:the needed patch

[the_mad_poster]

Sure kid. I'll be sure listen to some yappy punk who thinks "standard" means "the way Microsoft does it".

Do us all a favor and don't comment on technical matters again until you understand the difference between customizing your site to broken standards so it only works in one browser and customizing your site to the real standards so it only works in non-broken browsers. While you're at it, why not go grab a copy of Firebird and find out that the only sites that DON'T work are the ones that are so terribly designed that the odds are they're not even compatible between recent versions of IE? Congratulations, your grasp of technical matters makes you a poster child for outsourcing. Of course, maybe I should bow to you, right? I mean, my experience with web design and programming goes back a measly 8 years and I suppose that being the lead developer (client and server side) and only admin of this 2200 page Intranet thingy here in front of me plus the sites I've helped test and develop freelance doesn't qualify me to talk on the subject? I suppose the fact that I've built site parsers capable of parsing everything from the strictest DTD HTML to the most broken garbage FrontPage can spit out means I know nothing about designing sites properly?

Of course, not to sound snide, but if you had a real job, you'd know all this.

But hey, I've got to hand it to you, it's THEIR site all right. Of course, if they intentionally break it and that makes me question where else they might be incapable of doing things right, it's MY money, so I can pull it away from them.

Re:the needed patch

[DarkSarin]

LOL.

Yeah, we don't particularly like BB&T, and we *may* switch to Wachovia soon (My wife has a separate account there, and they have much better banking practices).

Re:the needed patch

[Mr_Matt]

4? Numpad?

Forgot this was slashdot, not fark - I meant to say the numpad enter key (which on my setup is right next to my mouse) but I stupidly used brackets to delineate the key designation, which slashcode rendered as bad HTML. Oops. :)

The fourth click is to 'select' the URL from text - opening a hyperlink in a new tab is only two clicks (right-click URL, left-click on 'open in new tab'.) Still faster than IE, either way. :)

Re:the needed patch

[Mr_Matt]

So set Explorer to single-click folders, and remove toolbars or size their graphics to Small.

Better solution: select 'Linux' from the LILO prompt, boot only to WinXP to play Max Payne 2. :D

What I really should have said was this - I dislike GUI file browsers, period. IE/Explorer is just more loathsome for me with it's (again, to me) extraneous web-browser-like features, which I must manually remove. My main objection is the fact that IE/Explorer is the default file browser in Windows. Some people still like CLI for file management, and Windows' CLI option is a major PITA compared to other OSs.

Anyways, somewhere I may have mentioned the phrase 'to each their own'. ;)

At least better than the KB article :)

[sisukapalli1]

I am sure M$FT will spin it as if this is an innovative feature.

S

Re:At least better than the KB article :)

[Anonymous Coward]

You know, lots of people roll their eyes when they see someone refer to Microsoft as 'M$' or Windows as 'WinBlowz' or something like that. Some people might even go as far as to flame you for it. Personally, I'm all in favour of it! Nothing makes me happier when I see someone make fun of Microsoft in that way! You know why? Because the quicker I see 'M$' or 'WinDOS' in a comment, the quicker I can disregard everything you've wrote, scroll past your post and add you to my 'retarded peon' list, never to take anything you say seriously ever again, even if its something completely unrelated. So, in the future, please try and work your tired shots at microsoft in toward the beginning of your posts. Thanks!

Re:At least better than the KB article :)

[narfbot]

Read the new knowledge base article for more goodies. They say URL's in username:password format are no longer supported -- I read that as they removed the support for the format to fix the bug! And then read how they suggest to switch scripting (ActiveX?) to prompt before running. So with IE, they no longer have the URL parameters other browsers safely support, and you have to wade through a bunch of "Scripts are normally safe? Run anyways?" popups. =/ Don't seem like a solution for me.

Re:At least better than the KB article :)

[Curtman]

How about "Wintendo", that's my personal favorite.

Re:At least better than the KB article :)

[FlyingOrca]

Funny, troll, that's the exact same text you posted in reply when I used "M$". And you apparently missed the point completely. I have no great hate for Microsoft's better products - I'm using two of them right now.

Microsoft IS a for-profit corporation, and that's why the M$ in my writing. As far as bashing them for unfair trade practices like unduly expoiting monopoly positions and FUD, well, when the shoe fits, sniff it, baby!

Re:At least better than the KB article :)

[christopherfinke]

Because the quicker I see 'M$' or 'WinDOS' in a comment, the quicker I can disregard everything you've wrote.

Amen! If you post something like this in the future, do it logged in so I can add you to my friends list.

Re:At least better than the KB article :)

[lucifuge31337]

Exactly the same way I treat Anonymous Coward posts such as yours.

Nice try, but you've disproved your own point by simply responding.

Re:At least better than the KB article :)

[narfbot]

I wouldn't mind a dialog box to handle it better either, but it's obviously not being consider or not ready yet. Considering how long this took, I don't think we'll see it in quite some time.

Re:At least better than the KB article :)

[JahToasted]

Yup... always reminds me of this.

Patches being sent by email

[Anonymous Coward]

Now check your in-boxes and make the InterWeb a Safer Place TM.

Re:Patches being sent by email

[gotr00t]

Oh, right, that "January 2004, Cumulative Patch" that was written with very poor grammar, that I get 50 copies a day sent to my mailbox.

It also says "Thank you for using Microsoft products," something that I have never heard M$ say, ever, and also despite the fact that I don't regularly use "Microsoft products."

HA HA NICE TRY

[Anonymous Coward]

Nice try Microsoft. I'm not clicking links while running IE, as per your instructions!

Wow Security update # 832894

[Anonymous Coward]

I wonder what happened to the other 832893 security updates?

Re:Wow Security update # 832894

[HungWeiLo]

Those are...internal numbers. You don't need to know about those. Microsoft only releases bug patches which are mature and stable enough for discriminating and demanding consumers.

(Takes a sip out of my Earl Grey)

Re:Wow Security update # 832894

[Oroborus]

Just fyi: the update number comes from the number identifying the knowledgebase article where the problem is first identified.

Re:Wow Security update # 832894

[Cyno01]

No, 832,894 patched bugs in Windows. :p

I'm supprised we even post this stuff...

[FuzzyFurB]

I'm supprised we still post this stuff. It's a never-ending saga. People find massive holes in IE. Microsoft ignores problems. People exploit problem. Microsoft, slowly, responds. Why does half of Slashdot's users still use Internet Exploiter? Get the monkey off your back, switch to Mozilla Firebird. :)

Re:I'm supprised we even post this stuff...

[Kierthos]

Some of us are required to us IE at work because the bosses won't let us install anything else. Of course, having said that, I really wonder if the bosses would notice...

Kierthos

Re:I'm supprised we even post this stuff...

[Whyrph]

Regular Mozilla, while a bid slower than Firebird, has an IE theme.

Re:I'm supprised we even post this stuff...

[Nef]

GhostZilla is your friend. I also recommend a secure anonymous proxy (your own, or a hosted one) to prevent your boss from sniffing what you're surfing.

Re:I'm supprised we even post this stuff...

[mrdrivel]

Postings about security updates are always useful, especially to those of us who have to support IE users. It's a lot easier than having to constantly hit F5 on the windowsupdate.microsoft.com page :)

Re:I'm supprised we even post this stuff...

[iminplaya]

The nice thing is that you don't have to "install" mozilla. I always download the zip and copied it to any ol' place and it works(after extracting the archives of course). You probably can run it from a CD.

Re:I'm supprised we even post this stuff...

[eln]

I used Mozilla Firebird for a little while, but the interface is painful, and it doesn't support a lot of what the real Mozilla does, so I switched back. I hear it's faster, but I never saw any speed difference at all (although my 1 GB of RAM may have something to do with that).

All in all, I think I'll wait for Firebird to reach a more mature state before switching to it over regular old Mozilla. Mozilla proper, on the other hand, is already in a more mature and stable state than regular old IE, so if you had said everyone should switch to Mozilla, I'd agree with you completely.

Re:I'm supprised we even post this stuff...

[cptgrudge]

As one of those bosses, I would say,

"Go ahead! I'll even give you Power User privs if you promise never to use IE again!"

Re:I'm supprised we even post this stuff...

[Nintendork]

"Get the monkey off your back, switch to Mozilla Firebird"

I did, but had to switch back because of a security flaw. I posted to Bugzilla and the developers bumped the severity up to "Major". Here I am almost three months later still waiting for a problem the developers consider major to be fixed. It would seem that the only real progress they've made is the vocabulary used when slandering Microsoft.

-Lucas

Re:I'm supprised we even post this stuff...

[bstil]

Some of us are required to us IE at work because the bosses won't let us install anything else.

You don't have to "install" anything in Windows to run Mozilla Firebird. In fact as of version 0.7, Firebird doesn't even have an official Windows installer. Just download, unzip, and double-click!

Re:I'm supprised we even post this stuff...

[Curtman]

Unfortunately though, "There are no versions of this theme for your browser." (Mozilla v1.6) If I have one beef with Mozilla, its that the themes aren't compatible across minor browser revisions. Upgrade your browser, and your themes are toast. I would hope that will change very soon.

Re:I'm supprised we even post this stuff...

[Bios_Hakr]

Firebird does not have to install. It runs fine just by unzipping the archive to your desktop. It also has and IE theme that looks pretty convincing.

Re:I'm supprised we even post this stuff...

[SethJohnson]

Does your keyboard also have a plastic membrane that keeps the grime and such from your oil-changing hands from getting in between the keys?

Re:I'm supprised we even post this stuff...

[MattTC]

Why does half of Slashdot's users still use Internet Exploiter?

How do you know? I use Opera, but it represents itself to servers as IE

Re:I'm supprised we even post this stuff...

[PitaBred]

I've force installed a 1.5 theme on 1.6. It seems to work alright. It's just that the theme hasn't been updated, or the site hasn't been updated. More than likely the site, because the install of the theme didn't complain at all for me.

Re:I'm supprised we even post this stuff...

[Apathetic1]

Some of us are required to us IE at work because the bosses won't let us install anything else. Of course, having said that, I really wonder if the bosses would notice...

Mind didn't. I ran Firebird on my work computer for six months - from the day I started until the day I went back to school full time.

Re:I'm supprised we even post this stuff...

[steve_l]

Maybe we need to tune the Mozilla active X control ( a spare time project by somebody) so that it can be embedded inside IE. Then your browser looks like IE, but its really mozilla.

No, that would just give us the defects of both. Better to have an IE skin for mozilla firebird...

Re:I'm supprised we even post this stuff...

[cerberusss]

Does your keyboard also have a plastic membrane that keeps the grime and such from your oil-changing hands from getting in between the keys?

Is this relevant? Funny how you asking a question tells us a lot about you.

Re:I'm supprised we even post this stuff...

[fraudrogic]

I just submitted comments regarding firebird, I had some problems with it.

Re:I'm supprised we even post this stuff...

[liquidsin]

HA! I tried to check that out, but I got told "Sorry, links to Bugzilla from Slashdot are disabled." Smart admins!

Re:I'm supprised we even post this stuff...

[Tarqwak]

This Mozilla Internet Explorer 5.5 skin works with Mozilla 1.6 like a charm.

Some Mozilla usability improvement info there too.

direct link?

[Anonymous Coward]

is there a direct link to this patch? tnx

It's not the 2nd Tuesday...

[seigniory]

So why is MS posting this? Nothing in this seems like it can't wait 8 days...

Oh and for all of you who don't use Windows SUS - why not? I'm going to patch 350 machines with 5 clicks later this week. Stop your bitchin and get better tools.

Re:It's not the 2nd Tuesday...

[wasabii]

Because SUS requires you to run IIS. :) Nuff said. Not all of us run 100% Windows Domains with Active Directory and IIS and servers.

Re:It's not the 2nd Tuesday...

[nordicfrost]

Stop your bitchin and get better tools.

I totally agree!

Re:It's not the 2nd Tuesday...

[Tony Hoyle]

I asked our MCSE about this and he'd never heard of it... went and had a look around then decided we'd never afford it anyway.

Pity as he runs around like a headless chicken every week updating 50 machines.

Re:It's not the 2nd Tuesday...

[redbeard_ak]

"I asked our MCSE about this and he'd never heard of it... went and had a look around then decided we'd never afford it anyway."

Software Update Services is free. IF (and only if) your domain meets all this, it's great:

Active Directory with group policy
IIS
all clients are Service Pack3

You go to your IIS server's SUS page, login as admin, check for updates, click approve and wait for your scheduled update that you defined in group policy.

If you are already running a domain as described, SUS is a great relief. Your MCSE ... well, enough said.

As many said, IIS is dangerous. I use IIS as internal only. I needed to run it for Exchange, because they wanted outlook calendars and four years ago I didn't like the alternatives.

Re:NOW MAYBE U FUCKING ANTI-MS HOMOSEXUALS WILL ST

[noelo]

Please Mr. Gates, calm down, relax, breath deeply.

Slow But Good News

[osewa77]

As much as I love the mozilla browser, the fact remains that IE is the dominant browser out there and the easiest to install for Windows users hence this is great, important news. Now to start downloading the patch.

Re:Slow But Good News

[Afromelonhead]

I have to wholeheartedly agree with you. The Mozilla line of browsers is definitely the best browser around, but many people don't know about it/take the time to install it. It took MS a while to get it done, but at least they have it installed.

[Slightly OT] Even with my warm recommendation of Mozilla, I use IE constantly on a daily basis. Mozilla just takes a while to load up on this computer of mine, whereas IE starts up in a matter of seconds... speed is a lot more important on a daily basis than adherence to standards.

Re:Slow But Good News

[Platinum Dragon]

[...] the easiest to install for Windows users [...]

I don't know if "easiest to install" is the best way to describe how most people get IE on their computers.

"Found it slapped on with spit and duct tape" may be more accurate.

Re:Slow But Good News

[MikeCapone]

Even with my warm recommendation of Mozilla, I use IE constantly on a daily basis. Mozilla just takes a while to load up on this computer of mine, whereas IE starts up in a matter of seconds... speed is a lot more important on a daily basis than adherence to standards.

IE loads faster because most of it gets loaded into memory when windows boot; can't you just leave Mozilla open at all times?

I'm using Linux (Slackware), but when I was still using windows the differences in loading time were pretty secondary to the difference in quality in favor of Mozilla & sons.

Re:Slow But Good News

[caino59]

im on an athlon xp 2400+, with 768mb and Firebird loads everybit as fast as IE

I think that says something about a browser that's loaded when you tell it to load, vs. a browser that loads at boot...

Re:Slow But Good News

[arkanes]

I'm a recent Firebird convert and it loads (much) faster than Mozilla. It's maybe an extra second at first startup over IE, if that - and thats without a preloader.

Re:Slow But Good News

[woodhouse]

You might want to try Firebird/Thunderbird as an alternative. They're a lot less bloated than the mozilla suite and start up much quicker.

Why is URL parsing code in the kernel?

[Mr. McGibby]

The files that this patch affects reveal a little tidbit of info about how Windows is put together and it makes one ask the question:

Why the hell does this require a kernel patch?

Re:Why is URL parsing code in the kernel?

[Tuxedo Jack]

Because they forced IE to integrate into the shell. Of course, there's IEliminate and similar programs which will shred IE from the system and strip any references to it from various places, and if you install IE6 off the NIS2003 disc, you can edit the install.ini file's ShellIntegration value (set it to 0), and you can use Firebird for everything else.

Re:Why is URL parsing code in the kernel?

[mugnyte]

Because "the browser is part of the Operating System, and cannot be removed". Microsoft deeply ingrained all things "browser" is a desparate move to avoid getting IE booted from the default install package during the anti-trust lawsuit. Silly enough, it can be rendered practically gone through a few simple file access tricks.

Remember, MS's OS is not like Kernel + layer + layer... its more of a giant monstrosity of "modules" which are interdependent.

Re:Why is URL parsing code in the kernel?

[Anonymous Coward]

It doesn't... from the second link in this post, "This issue affects Internet Explorer, a component of Windows".

The poster was somewhat ambiguously referring to the versions of Windows that were affected, not the area of the system that was.

Re:Why is URL parsing code in the kernel?

[koh]

Because they forced IE to integrate into the shell.

Why the hell does this shell require a kernel patch? /bin/bash forever.

Re:Why is URL parsing code in the kernel?

[RussGarrett]

It doesn't. Nothing on the MS page says it's anything to do with the kernel - it's just the usual Slashdot Microsoft-bashing-without-even-reading-the-article sentiment.

"This issue affects Internet Explorer, a component of Windows. You should apply this update if you have Internet Explorer 5.01 or later."

So mod me down, you know it's the truth.

Re:Why is URL parsing code in the kernel?

[Anonymous Coward]

Nothing on the MS page says it's anything to do with the kernel

He never claimed it did. He said he looked at the patch file and it patches the kernel. From what I can tell you didn't bother to check and just had a knee jerk fanboy reaction.

So mod me down, you know it's the truth.

I'd love to know what's true. I don't know how too open Microsoft patch files. I don't even know how to download them anymore. Can someone answer this instead of adding more flames?

Re:Why is URL parsing code in the kernel?

[Anonymous Coward]

Ok, found the facts. It's hidden under Security Update Information then you have to unhide File Information. There find an OS and unhide it to show the list of dlls patched. None look like kernel stuff to me.

Browseui.dll Mshtml.dll Shdocvw.dll Shlwapi.dll Urlmon.dll Wininet.dll

Re:Why is URL parsing code in the kernel?

[Tokerat]

I didn't look in the patch file, I dont' program, administer, or otherwise even use Windows, I have a Mac. Fair warning.

Perhaps it patches system components for URL services? I know Mac OS X (and, IIRC, 9 and perhaps even 8.6) has a URL parsing API (Carbon, docs are currently under construction (wtf?) ) so that if you program requires it you can easily split up a URL and retirieve an IP from the hostname, sepereate the directories into seperate vars if you wish, etc. The Cocca API featrures a URL Loading API, which I haven't examined closely, is apparently a wget (curl -O in a standard Mac shell) equivilent that loads into an object of some sort...talk about potential for abuse!

If Microsoft created such an API for Windows (and I imagine they would), they'd be extra stupid to have IE not use it. As concerned as they are about money, why pay to write the same code twice? (Then again, all those buffer overflows in non-standard string libraries....hmmm.) Anyway, perhaps this is what is being patched to fix IE? I wouldn't consider a .dll to be the kernel, unless is was system32.dll...

Anyone on Slashdot with some Windows know-how care to fill in the big, vague, speculative gap I've left? :-D

Re:Why is URL parsing code in the kernel?

[Tuxedo Jack]

Yes, NIS2K3 is Norton Internet Security. It requires IE6 to install, and it includes it on the CD.

And yes, IE does integrate. If you can view an IFRAME inside IE, or open a web site from My Cmputer, I'd consider that pretty damn integrated.

Re:Why is URL parsing code in the kernel?

[Anonymous Coward]

Go to http://www.microsoft.com/security/security_bulleti ns/20040202_windows.asp.

Expand the section "Security Update Information".

Expand the section corresponding to the version you have.

You will see a table like the following:

Date Time Version Size File Name Platform
22-Jan-2004 00:21 6.00.2800.1400 1,026,048 Browseui.dll X86
22-Jan-2004 00:19 6.00.2800.1400 2,795,520 Mshtml.dll X86
22-Jan-2004 00:15 6.00.2800.1400 1,339,904 Shdocvw.dll X86
21-Jan-2004 23:18 6.00.2800.1400 395,264 Shlwapi.dll X86
22-Jan-2004 00:20 6.00.2800.1400 484,352 Urlmon.dll X86
22-Jan-2004 00:16 6.00.2800.1400 588,288 Wininet.dll X86

Re:Why is URL parsing code in the kernel?

[RussGarrett]

Erm, as the KB article itself says, it patches a few system DLLs. They may be part of Explorer, but they're certainly not part of the kernel. I'm not a knee-jerk fanboy, just someone with just an ounce of common sense. Unlike your good self.

Re:Why is URL parsing code in the kernel?

[bonch]

How did he "look at the patch file" and determine it "patches the kernel?" You're just trolling.

Re:Why is URL parsing code in the kernel?

[essdodson]

Because files in use by the shell are locked and require a reboot to replace them. Don't start bitching about your uptime either, people stopped caring about that dicksize war many years ago. Availability != uptime.

Re:Why is URL parsing code in the kernel?

[Eustace Tilley]

Did you mean IEradicator? Alas, it works with neither Windows 2000 nor Windows XP.

Re:Why is URL parsing code in the kernel?

[Darren Winsper]

Here's a hint; the MacOS URL parsing API is not implemented in the kernel.

Re:Why is URL parsing code in the kernel?

[Tokerat]

Which is my point. I doubt the Windows code is in the "kernel" either?

Deprecating username/password in URLs

[Coryoth]

I was under the impression that their fix was simply make http(s)://user:password@www.address.net invalid. If so, that's not so much a fix, as just deciding to break some functionality. Can someone confirm that this is what the "fix" actually is?

Jedidiah

Re:Deprecating username/password in URLs

[pbur]

It is exactly that. Breaking RFCs. I forget the number, but someone posted it in the last slashdot article about this.

Re:Deprecating username/password in URLs

[UfoZ]

Doesn't this violate some kind of standard, getting rid of the user:pass@ syntax? I mean, I haven't used it a lot but occasionally, yeah.

Arbitrary decisions to alter the working of the internet just like this seem very incorrect to me. Wouldn't some kind of warning suffice?

Like,

"Warning: the link you just clicked contains a username - the website address might be deliberately spoofed!
[ ] Don't show this again."

- or something like that...

Re:Deprecating username/password in URLs

[Squarewav]

I was under the impression that their fix was simply make http(s)://user:password@www.address.net invalid. If so, that's not so much a fix, as just deciding to break some functionality. Can someone confirm that this is what the "fix" actually is?
That method of user/password should have never been alowed in the first place. Sure its easy but come on, yah broadcasting your username and password to every node along the way is such a good idea, saves some trouble of pharseing the html. not to mention any spyware that sends back what you type into the adress bar

Re:Deprecating username/password in URLs

[spydir31]

Opera sez:

Security warning:

You are about to go to an address containing a username.

Username: fubar
Server: slashdot.org

Are you sure you want to go to this address?

OK Cancel

(there is no option to disable)

Re:Deprecating username/password in URLs

[ad0gg]

RFC 1738 - Page 8

3.3. HTTP

The HTTP URL scheme is used to designate Internet resources accessible using HTTP (HyperText Transfer Protocol).

The HTTP protocol is specified elsewhere. This specification only describes the syntax of HTTP URLs. An HTTP URL takes the form:

http://(host>):(port)/(path)?(searchpart)

where and are as described in Section 3.1. If : is omitted, the port defaults to 80. No user name or password is allowed.

Yawn... yeah they are really breaking RFC.

Re:Deprecating username/password in URLs

[Coryoth]

I agree that it is in some senses minor, in that few people would want to use it (over local LANs it might be useful), and it doesn't break the RFC, but it is still dropping functionality rather than actually providing a fix - that is, Opera, Mozilla, etc. all handle such URLs fine, with warnings, or correctly displayed URLs or both. Surely Microsoft could have managed as much?

Jedidiah.

Re:Deprecating username/password in URLs

[dbarclay10]

I was under the impression that their fix was simply make http(s)://user:password@www.address.net invalid. If so, that's not so much a fix, as just deciding to break some functionality. Can someone confirm that this is what the "fix" actually is?

I just fired up Windows, and yes, that's correct - http://foo:bar@foo.bar/ URLs result in a "This page cannot be displayed" error. The standard one, at that, not even indicating why it can't be displayed.

https://foo:bar@foo.bar/ also appears nonfunctional. However, IE just sits there with its little spinner going. I didn't wait for it to time out. It may be that it's unintentionally broken.

For the more technically-minded of you out there, HTTP AUTH is still functional if you omit the username and password from the URL. It will pop up the regular authentication box and you can go in normally. At least over HTTPS. I didn't try HTTP.

Worth noting here that a *LOT* of sites embed the username and password into generated URLs - especially porn sites. This is a pretty major fuckup, and a lot of companies will be real pissed off at Microsoft over this.

Re:Deprecating username/password in URLs

[Holi]

NOOOOOOO.
It does not break RFC's, it actually now follows the RFC as to not allow Http urls to include username and passwords.

Go read then post

Re:Deprecating username/password in URLs

[mosch]

I'm contracted to run an intranet portal for a small-ish (500 employee) company. One of the sections on this site is a series of links to semi-secure external sites. The users all share one login and password, and they work in the http://user@password:www.site.com/ format. Really they only cared about making the information such that the public couldn't accidentally get it since disclosing it woulod provide some information on margin, but nothing earth shattering. This patch (if it works as described) is going to serve to annoy those users, until such time that I can get the other companies to accept GET or POST authentication. Additionally, it won't protect against: http://www.microsoft.com.security.patches.updates. maliciousasshole.com/ which less savvy users will still click happily.

Re:Deprecating username/password in URLs

[wsloand]

broadcasting your username and password to every node along the way is such a good idea

Except for the fact that neither IE nor Mozilla do that. All that the server sees until it requests the user/pass is just the URL. (I tested this with the current IE, so the functionality may be different in the non-patched version).

Here are the respective requests (typed into the address bar as http://user:pass@192.168.1.20:56691/ or :56698/) from Mozilla:

GET / HTTP/1.1
Connection: keep-alive
Accept: text/xml,application/xml,application/xhtml+xml,tex t/html;q=0.9,text/plain;q=0.8,image/png,image/jpeg ,image/gif;q=0.2,*/*;q=0.1
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Accept-Encoding: gzip,deflate
Accept-Language: en-us,en;q=0.5
Host: 192.168.1.20:56691
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113
Keep-Alive: 300

And from IE:

GET / HTTP/1.1
Connection: Keep-Alive
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Encoding: gzip, deflate
Accept-Language: en-us
Host: 192.168.1.20:56698
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)

Re:Deprecating username/password in URLs

[pHDNgell]

That method of user/password should have never been alowed in the first place. Sure its easy but come on, yah broadcasting your username and password to every node along the way is such a good idea, saves some trouble of pharseing the html. not to mention any spyware that sends back what you type into the adress bar

It's a business requirement here...at least it was. We have approximately 1.8 million web servers that each have a distinct username and password and a variable IP address (DHCP) people go to. Basically, you find the thing you're looking for through a management system, and it provides you a URL with the username and password for that device.

The username and password are constant for a device, both are generated at manufacturing time (username is serial, password is random). Since the IP address changes along with it, basically all three are required to authenticate, and only the management system knows all three at any point in time.

Here's an example URL (modified slightly to protect the innocent):

https://838092393582:lMF82SgiMNHWKUORiQ1TbQ%3D%3 D@ 10.11.12.13:1415/path/

Now, as far as I can tell, this patch is marked as ``critical,'' which means we've got to have people start to enter all of that stuff in manually until we come up with an alternative solution.

Re:Deprecating username/password in URLs

[zhenlin]

So, you're saying that HTTP authentication is stupid?

http://username:password@www.domain.net/path/fil e is just a way of storing the authentication data in the URL. It would be translated to a HTTP request like

GET /path/file
Authorization: Basic QdXNlcm5hbWU6cGFzc3dvcmQ=
Host: www.domain.net



If you didn't supply the authentication tokens in the URL, you would have been prompted for them, and it would be the same request.

Remember: not every HTTP user agent is an interactive browser with session cookies. HTTP authentication needs neither.

Re:Deprecating username/password in URLs

[tunah]

yah broadcasting your username and password to every node along the way is such a good idea, saves some trouble of pharseing the html.

Erm, if this was sanely implemented, I believe it'd do the same thing as entering the password manually. This isn't something you use for sensitive passwords, obviously.

not to mention any spyware that sends back what you type into the adress bar

Yes, running untrusted software on your computer is a security hole.

Re:Deprecating username/password in URLs

[Anonymous Coward]

Outdated RFC. Try RFC 2396.

Go read then post.

Re:Deprecating username/password in URLs

[Holi]

Not quite but this one does seem to outdate it RFC 2616 and again no usernames or passwords. RFC 2396 only describes Generic URI's not protocol specific schemes.

Switched a while ago...

[FrancisR]

I switched away from IE a while ago because the browser windows would mysteriously disappear while using Microsoft's own Virtual Desktop Manager. Firebird works fine with it. It's ironic that Firebird integrates more well with one of MS's products than MS's own product does.

Re:Switched a while ago...

[koh]

The irony here is that Firebird probably works on VDs only because it _only_ uses _documented_ WIN32 APIs.

When you expose things to the outside, you have to make them work. Not so for the inside hacks. Too bad :)

Re:Switched a while ago...

[drsmithy]

I switched away from IE a while ago because the browser windows would mysteriously disappear while using Microsoft's own Virtual Desktop Manager. Firebird works fine with it. It's ironic that Firebird integrates more well with one of MS's products than MS's own product does.

Interesting. I have problems using Firebird with multiple monitors (anything that involves hovering the mouse over a link is broken if the browser window is on the secondary display). This hasn't stopped me using it, but I'm surprised IE has problems with VDs (handles multiple monitors fine).

Re:Switched a while ago...

[zenpiglet]

Do you mean the Virtual Desktop Manager from the XP Power Toys? The same tool that is explicitly marked at 'unsupported' by Microsoft? The same tool that was created as an afterthought by the developers? The same one that ships with other top-end tools as 'TweakUI', Image Resizer' and 'HTML Slide Show Wizard'?

Yeah, I can see how it must be a real surprise to you when it doesn't work too well.

Re:Switched a while ago...

[arkanes]

No problems with multiple monitors and Firebird for me, so it's not a generic problem.

Re:Switched a while ago...

[autechre]

1. What problems have you had with TweakUI? It's always worked well for me. I've never used those other two pieces, but then I only use Windows while I'm at work.

2. The fact that it's unsupported still doesn't make it less amusing that two pieces of software coming out of Microsoft, one of which is (allegedly) an integral component of the operating system, don't play together as nicely as one of those pieces and a 3rd-party application.

Of course...

[Tuxedo Jack]

There's always the fact that those of us who want to use this bug to, say, show "grades" to our "parents" online will keep this unpatched, thus allowing us to give them our "real" grades without the wonders of Photoshop or Fireworks or the GIMP.

Incorrect parsing

[southpolesammy]

notably 'A vulnerability that involves the incorrect parsing of URLs that contain special characters' in Internet Explorer

So now all those goatse URL's finally parse back to the trolls at /.

Re:Incorrect parsing

[DarthWiggle]

Sadly, goatse is dead. *sigh... next they'll kill zombo.com.

finally a username:password@ fix

[swimfastom]

Patches..."A vulnerability that involves the incorrect parsing of URLs that contain special characters. When combined with a misuse of the basic authentication feature that has "username:password@" at the beginning of a URL, this vulnerability could result in a misrepresentation of the URL in the address bar of an Internet Explorer window."

I can't believe it takes Microsoft so long to fix major flaws like this. Honestly, why does it take 60,000 programmers 60 days to fix an IE URL error?

Re:finally a username:password@ fix

[HillBilly]

Patch has probably been ready for a while and they were probably testing it.

You don't suggest they release an untested patch right?

Re:finally a username:password@ fix

[AK47]

Honestly, why does it take 60,000 programmers 60 days to fix an IE URL error?

They were too busy trying to finish up that "Hamlet" draft they've been working on.

Re:finally a username:password@ fix

[caino59]

yah, it takes a long f-n time to test a patch that just removes the user@pass functionality...this patch is a joke, as well as thinking that IE/M$ is secure...

i'm happily posting this comment using firebird...

Re:finally a username:password@ fix

[iminplaya]

Honestly, why does it take 60,000 programmers 60 days to fix an IE URL error?

Maybe they're Teamsters. You gotta problem with that? :)

Re:finally a username:password@ fix

[Finuvir]

The related bug in Mozilla, bug 122445 (no link since bugzilla refuses slashdot links) has been open for just over two years. How does it take the entire online world (who all have access to the Mozilla codebase) two years to fix this?

[http://bugzilla.mozilla.org/show_bug.cgi?id= 122445]

Re:finally a username:password@ fix

[Penguinshit]

So you'd prefer MS's fix, which is not a "fix" as much as it is a mere reactionary removal of functionality?

BTW: in Mozilla I never see *only* "http://www.microsoft.com" in the Location bar when the link is actually sending me to "http://goatse.cx", no matter how the link is formatted. A quick look at the Location bar shows me something is not quite right with the URL.

Re:finally a username:password@ fix

[Finuvir]

...All of which is covered by my previous post. I said 'related' bug because it's not exactly the same (specifically, it's less insecure). I never said I prefered MS's solution to Mozilla's lack of solution, but I intended to imply that the time it took to patch was not the problem, the actual solution was.

Here are the patches:

[HungWeiLo]

So you don't have to match up the knowledge base numbers in WindowsUpdate:

Here
Here
Here
Here

Re:Here are the patches:

[QEDog]

Can I click those, or should I type the address instead?

Re:Here are the patches:

[tymbow]

These sort of comments should be flagged as troll and never funny.

There is no wit in any of this anymore no matter how true it is.

Would everyone please come up with some new jokes.

Re:Here are the patches:

[Ill_Omen]

I can certify that those are all safe to click. You're browser may show http://www.stealmypassword.com, but that's a known bug and will be fixed in the next release.

Be sure to type in that link manually.

[Anonymous Coward]

I saw it on tv last night. I think it was

http://microsoft.com/download/patch/win32/2004/f eb/en/?&mid=2304520392lHKJH09728037420987&dll=LKJ2 3L4SD09UVC9432J5JS-9UDFLKJN345U9SLKJ4L5U0SJCS4

Re:Be sure to type in that link manually.

[sik0fewl]

That's pretty rude. You're gonna make them figure out the second half of the URL on their own?

Re:Be sure to type in that link manually.

[Spy Hunter]

You laugh. If^H^HWhen you get put on hold at Microsoft Tech support, instead of playing cheesy music they read you soothing Microsoft security bulletins. These security bulletins often contain URLs, so that if you're too stupid to use Windows Update you can still find their patches, or something. If you have never had the pleasure of listening to a cheerful female voice read you a giant URL over the phone, taking about thirty seconds, pronouncing every letter and piece of punctuation separately, but you can't put the phone down because any second now the MS support rep might pick up and say hello, then you should count your lucky stars.

"aich-tee-tee-pee-colon-forward-slash-forward- slash-double-U-double-U-double-U-Microsoft-dot- com-forward-slash-default-dot-ay-ess-pee-ex- question-mark-ess-cee-eye-dee-equals-sign-kay- bee-semicolon-seven-three-nine-four-four"

I'm serious, they really read you URLs just like that over the phone, at about 30 seconds per URL. I feel like beating them over the head with a clue bat. Don't they know that the browser adds http:// for you, automatically? Don't they have any idea how to make shorter URLs for easier reading over the phone? And most importantly, don't they have ANY IDEA that security bulletins have ID numbers, specifically so you can reference them easily instead of reading URLs over the phone? Sometimes I wonder about the people at Microsoft...

Ironic given an email my mom got

[MemRaven]

My mom got this email this morning which purported to be from someone at Microsoft referring to this exact patch as something she could download. The only problem (aside from the fact that even my mom wouldn't have been dumb enough to type sensitive information into a form like that, AND she uses Mozilla anyway) is that the link in the email USED the flaw that it was telling her to fix.

In other words, some email/CC#/whatever harvester decided to pull a funny and use the correction for this flaw as a way to exploit the flaw. Now that I see that the described patch is legitimate, I'm actually laughing internally at the delicious irony.

By the time my mom got the email, the target web site had already been taken down by the sysadmin of the host.

None of this is to condone the action of the scum who blasted the email, but come on, that took some balls.

Re:Ironic given an email my mom got

[lildogie]

This just points out the fundamental flaw of Windows Update: a smart hacker would attack the update process that's used to harden the system.

Just wait.

Re:Ironic given an email my mom got

[Zocalo]

"Score:5, Funny"? Unfortunately MemRaven isn't joking - I got one of these things too, from Korea in my case although the standard of English and spelling in the body makes me the the origin was the US. Here's the body, so you can see for yourself - the Subject was "Microsoft Security Update KB872446":

Dear Valued User!

At 2 : 12 Eastern Time on Friday-January 30, 2004,
Microsoft started investigating reports of a variant of a new worm "Novarg", known as Mydoom.B.

This virus reportedly blocks access to some websites, including all Microsoft.com websites. The virus is noticed to entice mail recipients into opening a message that has a file attachment.
If the attached file is opened, worm installs malicious code on the computer user's system and sends itself to any contacts in the user's address book.

Please download the latest security patch available from Microsoft.com website or download this digitally signed attachment.

message#875438809032

Customer Service.

VINA MATSUO
MATSUO@microsoft.com

In addition, there was a set of spoofed SMTP headers from the genuine Microsoft outbound SMTP server used for their security bulletin newsletter. Naturally, the attachement (called "Windows-KB823989-x86-ENU.exe") was not "digitally signed", and was infact a trojan - bet you never saw that coming!

All in all, *very* slick. It plays on the current hype about MyDoom and the combination of the spoofed headers, "digital signing" and the offer to download from the website instead are/were no doubt sufficient to lull many who might not otherwise be taken in into the trap. The clueless n00bs who actually click on these things anyway would have had no chance. I'm actually impressed with the effort - this rank amatuer sure could learn a thing or two.

Re:Ironic given an email my mom got

[dmaxwell]

To be fair, any OS that is updated from network servers is vulnerable to such an attack. Look at how long Debian took to make sure the archive wasn't compromised in that kernel bug incident a month or two back. Now packages can be signed or whatnot but that measure is attackable as well.

It just another form of the "who watches the watchers?" problem.

Re:Ironic given an email my mom got

[Reverend528]

A smart cracker would realize that he doesn't need to attack the update process to compromise the system.

Re:Ironic given an email my mom got

[ruiner13]

"aside from the fact that even my mom wouldn't have been dumb enough to type sensitive information into a form like that, AND she uses Mozilla anyway."

I had to slap myself after reading your post for thinking that you had a pretty "hip" (for lack of a better word) mom because she uses mozilla. Man, I need to unplug...

Re:Ironic given an email my mom got

[RzUpAnmsCwrds]

Unlikely. The updates are digitally signed, and nothing that isn't signed with Microsoft's private key will install. And if you can get access to Microsoft's private key, then bad things will happen.

Re:Ironic given an email my mom got

[Milo Fungus]

...a smart hacker would attack the update process that's used to harden the system

This is slightly offtopic, but that statement brought to my mind a poignant biological example of this principle: the HIV Virus. Two things made HIV so scary:

1. It attacks and slowly destroys the immune system. Imagine a computer virus that somehow disabled your ability to contact and download from Windows Update. What a mess that could cause!
2. It mutates incredibly fast within the host organism. This makes it a "moving target" for the immune system (and for whatever vaccines are used). Imagine a computer virus that could change its appearance and exploit mechanism so as to bypass filter-based detection schemes.

I'm not a computer security or virus expert. For all I know, there could be virii out there that do these two things, or something like them.

P.S. Please don't reply with any message saying that HIV and AIDS only affects homosexuals and drug users. That simply isn't true. Read the Wikipedia article for a refutation of this myth.

Re:Ironic given an email my mom got

[Mike Hawk]

And the Wikipedia article couldn't possibly be biased on that issue? I read their faq, its possible they are wrong.

Re:NOW MAYBE U FUCKING ANTI-MS HOMOSEXUALS WILL ST

[Anonymous Coward]

That's not Bill, that's Steve, and he's displaying normal behavior, move along.

spoofed by look-a-likes?!

[skzbass]

wait isn't that sorta like MikeRoweSoft? how about a patch to help us read. and after that they could hand out Opera to everyone so this never happens again. ay yai yai

special characters?

[andman42]

'A vulnerability that involves the incorrect parsing of URLs that contain special characters' in Internet Explorer

Yeah, the special characters www.google.com now correctly parse to search.msn.com

Re:Whew..

[coolmacdude]

LOL, it's not remotely close to over. Very few users regularly update their systems. How do you think SQL slammer was able to affect so many systems months after M$ fixed it?

Once...

[Anonymous Coward]

Once this thing finally hits 1.0 its gonna be a REAL solid piece of software. I'm glad to see they're still maintaining it regularly!

Too Late. Installed Opera.

[loteck]

I don't know if these last security holes were just the straw that broke, but I've had no fewer than 20 people comment to me over this last week that they are sick of IE, and are lookin for alternatives.

It's also been a hotter-than-usual topic on Usenet. There really seemed to be a mass exodus from IE over the last couple of weeks, perhaps due to what people feel is blatant neglect by Microsoft.

I left IE as well last week, opting instead for Opera, and really couldn't be happier. Screw 'em, I want my tabbed browsing!

Re:Too Late. Installed Opera.

[RatBastard]

Even so, you should probably apply the patch. A lot of programs use IE for their "internal" browser component. WinAmp being the one that springs to mind at the moment.

Re:3mb ???

[gid]

it says it's cumulative patch, so it probably does more than just these few fixes, it probably does all ie related security patches post xp sp1.

Re:3mb ???

[mobby_6kl]

>included a new clippy bmp in that ?!?! :)

no, but this patch probably involves some kernel changes which make it sobig.

Re:Whew..

[Metallic Matty]

Yeah, I know, mostly my comment was sarcasm. *grin*

But you're right, people don't stay nearly up to date on patches - for pretty much anything they use.

Reminds me of the time my friend couldn't get his Counter-Strike to work, and wanted me to help him. Within like two minutes, I realized he hadn't updated his video drivers.

Oy.

From Microsoft Security Bulletin

[loconet]

"This Internet Explorer cumulative update also includes a change to the functionality of a Basic Authentication feature in Internet Explorer. The update removes support for handling user names and passwords in HTTP and HTTP with Secure Sockets Layer (SSL) or HTTPS URLs in Microsoft Internet Explorer. The following URL syntax is no longer supported in Internet Explorer or Windows Explorer after you install this software update:

http(s)://username:password@server/resource.ext"

...and even though they continue to break standards, people continue to use their software. Are users that ignorant and lazy? .. Why do I even ask that question.

Re:From Microsoft Security Bulletin

[Naikrovek]

Are users that ignorant and lazy?

Yes. In fact not only are they ignorant and lazy, they really, truly do not care about standards compliance.

Re:From Microsoft Security Bulletin

[andih8u]

Yeah, really...why do you ask?

Since /.'ers seem to get technological tunnel vision, so here's a few hints on what the average user is really like:

1. They are convinced the monitor is actually the computer. I don't know what they think that big tower does, but since they have it piled high with boxes, blankets, and it holds up their space heater, they've more than likely forgotten that its there.

2. They have cable / dsl that they use to connect to aol and they have absolutely no firewalls or virus protection.

3. They have no clue what a modem does versus what a network card does, but they do like to pick up on words they saw in the Best Buy ad, thereby running around saying "Why yes, I just recently upgraded my ethernet to thumb-drive."

4. They have no idea that windows update even exists, regardless of how annoying that systray icon becomes.

5. They've never heard of Linux, except maybe in that one IBM ad, but as its an IBM ad, they aren't going to bother to find out.

So they are "ignorant and lazy" as you say, but not everyone was blessed with your incredible technological ability at birth.

Re:From Microsoft Security Bulletin

[queen of everything]

and these are the people who refer to themselves as "tech savvy". Imagine how the people are who admit they don't know anything about computers.

Re:From Microsoft Security Bulletin

[jdaily]

>...they really, truly do not care about standards compliance.

Sadly, I finally understand why this is true.

I recently moved from Linux to MacOS X for my primary desktop, and among all the other features that "just work" is iTunes. A co-worker refuses to use it, because it uses AAC instead of MP3.

I don't care. I have a few CDs ripped in OGG, but no major investment there; if I ever buy a portable music player, it'll almost certainly be an iPod.

Should I care? Perhaps, perhaps not. My point is, I finally understand why standards compliance is a tough sell to most users: it just doesn't impact their lives, and it's far less of a threat than thousands of other more pressing issues.

Re:From Microsoft Security Bulletin

[lsdino]

1. They are convinced the monitor is actually the computer. I don't know what they think that big tower does, but since they have it piled high with boxes, blankets, and it holds up their space heater, they've more than likely forgotten that its there.

Oh, come on, everyone knows the big tower is the hard drive! :)

Re:From Microsoft Security Bulletin

[knghtrider]

People who say they don't know anything about computers usually have pencil and paper and a typewriter. They use the US Postal Service to send mail--licking (or using those plastic/sponge 'stamp lickers') their stamps rather then buying the pre-glued kind.

They don't own a computer because:

1. They don't need one.

2. Computers cause cancer.

3. They're technophobes.

I once knew a CEO of a Fortune 1000 company who didn't like computers. His Admin Assistant had the only PC in the place. The internet access was dial-up, with a single pop e-mail account. She would read and print his e-mails, to which he hand wrote his replies, she then replied via e-mail. The only other computers they had in the entire company were the ones that actually ran the assembly lines. We worked on their assembly line computers, so they also used us to fix the one PC they had. All of accounting used ledger books--no accounting software anywhere.

.

Needless to say, the company no longer exists in it's original form--they were purchased in 2001, and parted out for profit.

Re:3mb ???

[ackthpt]

Seems that Microsoft is still offering BIG patches this fix is 2.8mb ! damm, just for a link problem I don't know if they included a new clippy bmp in that ?!?! :)

10K bug fix

2.799M new bugs

(I typed this already, but after downloading the patch my computer froze up and I'm having to retype it.)

I can't take credit for this, as I saw it on slashdot once: "64,000 bugs in the code, 64,000 bugs, whack one back with a service pack, 64,008 bugs in the code."

Actually, it DOESN'T fix the flaw...

[Anonymous Coward]

It merely removes the feature containing the flaw. For an implementation of the feature without the flaw, see http://www.mozilla.org/

Re:Actually, it DOESN'T fix the flaw...

[FrancisR]

Reminds me of what they did with gopher...

Such a lame markting move

[deadline]

Microsoft is so market driven it makes me laugh. They seem to only release patches when the complaint buzz gets high enough. As I understand it, some of the vulnerabilities in IE have been known for almost a year. Glad to see security is such a priority.

This incident, by the way, is why open source will continue to gain ground. There are no marketing nitwits working as gatekeepers.

Re:Such a lame markting move

[BigBir3d]

So, using your logic, if XYZ is an open source program that is missing something, it does me no good to interact with anyone there to fix the problem?

Please think before spouting off random junk that tries to advocate something. You make open source sound unresponsive to the needs of its users.

Re:Such a lame markting move

[deadline]

It is exactly what I said. OS software is not constrained by marketing decsions.

Let me make it simple for you sonny

In a tradtional sales marketing model, there is a cost associated with every improvement or bug fix. The decsion to pay this cost is normally determined by marketing people. There are countelss obscure bugs/features requests that only effect certian types of users. These are almost never addressed becasue the cost to fix/add them is not justified by the sized of the "sub user base". Marketing 101 actually.

With OS software if there is a small feature you want you can add it (or pay someone to do it for you).

Re:Such a lame markting move

[BigBir3d]

Just because you add the feature yourself does not mean that it will make it into the distributed version of the program. Modifying something for your own use doesn't do me any good, unless you are good enough to get it into the public version. Honestly, without knowing you, I would have to assume that you are not good enough.

Of course, look at the majority of the crap code that is written... Most of this stuff (open or closed source) is not worth actual money. I may pay for it, but between upgrade cycles, security problems (I hate any sentence involving the words 'buffer' or 'stack' or 'overflow'), downtime, calls for support, emails or message boards for support, etc, this stupid thing ends up costing far more (2-10x as much depending on what you value your time at).

And with most open source projects, this is no guarantee that anyone is listening. Look at Linus' posts from years back. If you disagreed with him, it was because you were a fscking idiot. Only age, marriage, anc children have calmed him down.

With software, there are no guarantees that are worth the paper they were printed on. And all I seen as of late is companies that are looking to hook you into a service contract. They know their code is crap, but that their service is decent.

perhaps IE was named after

[Tandoori Haggis]

"Aiee!!!", a death cry depicted in war comics?

Re:perhaps IE was named after

[nukem1999]

No no, back of the throat, "Aaagghh"

This is exactly why MS products are so insecure...

[GoMMiX]

Every product has security vulnerabilities that are exposed to the public from time to time.... However, Microsoft seems to be the King of insecure. This is yet another example. And old news at that. The problem with Microsoft is the length of time they take to fix such horrid flaws in their software. They've had many months to produce a patch for this, and countless Microsoft users have suffered as a result. Good job, Microsoft, for proving you are a proud supporter of capitalism. You've managed to make a select few extremely wealthy by ripping off your users, using a slew of vulnerabilities that are continually left unchecked for extended periods of time. It's sad, really, Microsoft doesn't even care about the bad press anymore. They're immune to it, everyone knows their products are insecure and feel they have no alternative choice. That's going to change someday, and Microsoft is going to have to actually earn their customers by providing good [secure] products and services then. Though, I doubt it will ever matter - really. Microsoft is simply too large and too wealthy - even if no one ever bought another Microsoft product again - the company could survive forever just on it's current assets. Talk about a load of smelly poo...

why not just use k-meleon?

[bruns]

Why not just use k-meleon and be done with it? Its fast if not the fastest browser on Windows. Based on Gecko, its got all of the stuff that mozilla does, but none of the heavy GUI (K-meleon is pure MFC).

http://kmeleon.sourceforge.net

Re:why not just use k-meleon?

[speedbacon]

did you just use "none of the heavy GUI" and MFC in the same sentance?

Re:why not just use k-meleon?

[Anonymous Coward]

I use K-Meleon on a daily basis. It's my secondary browser next to monolithic Mozilla. (Firebird fills no niche that the combo of Mozilla and K-Meleon doesn't do better, IMHO.)

It's great (nice and fast even on old PCs that can't run Mozilla or Firebird at adequate speed), but it lacks functionality and polish compared to vanilla Mozilla. It's very extensible if your idea of extensibility is messing around with config files, however.

One thing that sucks is the menus. "Rebar" = ugly hack (you can't use alt shortcuts to activate the menus unless you turn rebar OFF). Also, I don't like its version of tabs. Creating, closing, or switching between "layers" (tabs) causes the window's taskbar tab to move to the rightmost side of the Windows taskbar. Not good.

Don't get me wrong - for some uses, it's the best browser out there. But it's not for everybody, and for those who would use it regularly, it takes even more configuration time to tune/fix than other browsers do.

Re:3mb ???

[tarquin_fim_bim]

so it probably does more than just these few fixes

Of course it does, it now gives Redmond full access to your hard drive. And they snitch to RIAA for bucks per bust.

Fixed Indeed

[quantaman]

This Internet Explorer cumulative update also includes a change to the functionality of a Basic Authentication feature in Internet Explorer. The update removes support for handling user names and passwords in HTTP and HTTP with Secure Sockets Layer (SSL) or HTTPS URLs in Microsoft Internet Explorer. The following URL syntax is no longer supported in Internet Explorer or Windows Explorer after you install this software update:

http(s)://username:password@server/resource.ext

Unfortunatly this isn't fixed as it should be, ie you're shown the entire link in the address bar and maybe even given a warning when you go to the site. Instead they fixed this by not allowing the '@' character in addresses as was suggested they might here. Hadn't they been saying previously that problem this was unfixable presumably the reason for disallowing the '@' alltogether rather than a real fix. I have two questions, first what kind of codebase do they have that they can't make a real fix?!? Sure it might be a bit of a pain but it's obviously possible since no other browser is affected (heck I even tried IE for mac yesterday and it handled it perfectly!). They obviously handle the url properly at some point since you visit the proper site, they should be able to display the url properly!
Next, what is the effect of them deprecating the '@' tag? I don't recall ever seeing this in the wild and can't really see a lot of use in microsoft.com@slashdot.org, of course the example they give is username:password but I can't see any real site displaying the password in plaintext in the url, does anyone have an example of where this is used and what the effects will be?

Re:Fixed Indeed

[SheldonYoung]

Are they trying to encourage another type of authentication, such as Windows Domains?

Re:Fixed Indeed

[owlstead]

Well, I was just handling an iPlanet web server installation problem when I rediscovered this feature. Actually, if you are managing servers with web based configuration this can come in quite handy. Since the admin pages are not available on the internet, there is no real need for an additional (safe) password anyway.

Tools might also use this feature to log in over HTTP without filling in any nasty pop-ups, though another HTTP message might also do the trick.

As for it being in plaintext; if you use SSL with it, you might only see it in plain on your own computer and not in any HTTP communcation, which will only take place after the SSL session has been set up. Unfortunately many sites use login through web forms though, which is fine for real users but a pain in the for scripts.

Removing the entire username:password@ feature from URL's is a bit like cutting off somebody's foot because of a sore toe.

Re:Fixed Indeed

[Ramses0]

I use this at work for a few bookmarks. It gets you around .htaccess protection fairly adequately (ie: beta.site.com is .htpassword protected, and I don't want to type stupid/stupid to log in every time).

Bookmark it as: http://stupid:stupid@beta.site.com and you are done.

ftp links are sometimes given in the same way (and http_proxy environment settings under linux).

Mind you, this is super-insecure given current computing environments and security issues (1: plaintext, 2: forgery issues), but it does have it's uses in a controlled environment.

--Robert

Re:Fixed Indeed

[YrWrstNtmr]

Unfortunatly this isn't fixed as it should be, ie you're shown the entire link in the address bar and maybe even given a warning when you go to the site.

To Joe Average, that might not have been enough.
http://www.ebay.com@http://128.6.52.124 /default.html still looks like an official ebay site. Nothing in that (fake) URL is obviously "not ebay.com". Disallowing the @ in this instance takes that option away altogether.

Of course, other things will be broken:

of course the example they give is username:password but I can't see any real site displaying the password in plaintext in the url, does anyone have an example of where this is used and what the effects will be?

Oracle Forms/Reports uses this construct to pass the current username:pwd to the middle tier. Useful in a corporate environment. Clueful developers/DBAs encrypt the username:pwd, but still the same format. De-encryption happens at the server.
Methinks Larry and Bill will have words over this.

Re:Fixed Indeed

[StaticLimit]

If they can't fix the problem by allowing the real URL to be displayed then I have to ask what they are using this special character for?

I can't think of a good reason for having a special character in the first place that suppresses display of everything after it unless Microsoft needs it for some special purpose behind the scenes.

Can you just accidently end up with these things? Is it because the common controls they use have this "feature" which is needed in other applications and so IE just inherited it (if so, they could just distribute and use a different control)? Or do they actually make use of it someplace else in Explorer and need to keep it in?

I assume DNS is solid enough that citibank.com%01.haxor.org would fail and not pass on requests with that character? Or could haxor.org have their own DNS implementation that would handle that character when the lookup request arrived?

- StaticLimit

Re:Fixed Indeed

[spitzak]

I agree. I am absolutely floored by how stupid this "patch" is. It does not even address the basic bug! (the basic bug is that the preview always ends at a %00).

There are a hundred other fixes they could do that would be better than this one. It is going to break sites! Certianly in-house things use this plenty for low security, and it should be quite good security for one-off passwords that only work for a very short time.

Number 1 fix would be to preview the url in it's entirety. %00 should show as %00.

Now a lot of people have pointed out that the '@' syntax still fools a lot of people anyway (that was why a bunch of MS trolls claimed the same bug was in Mozilla, because they were stupid enough to be fooled by this). So number 2 fix, while they are looking at that code, is change it so that everything before the @ is not displayed. This also will hide the username/password for (obviously weak) security.

Removing the '@' does nothing for people fooled by "//www.microsoft.com.evil.org" thinking it goes to Microsoft and not Evil. So maybe rearrange URL's like "//com.evil.org(www.microsoft.com.evil.org)/..." or come up with a new standard for previewing them like "///org/evil/com/microsoft/www//..." so the most importante information is first. Obviously this is tough to design, but Microsoft could do this and perhaps impress people here, rather than annoy them with their incredibly lame "solutions".

. This is getting more tricky since it could be used to hide information

Re:Fixed Indeed

[edwdig]

Well, all the exploits I've seen had %01%00 in the URL. I have no idea what the %01 could be doing, but character 0 is used to mark the end of a string in C.

What's happening is MS is converting the %xx codes into individual characters and then handling the string with standard C functions, which stop when they hit character 0. Probably the right solution would be to notice the character 0 while parsing the URL, and simply not allow the URL if character is present.

Re:Fixed Indeed

[spitzak]

That's bullshit. They should keep and display the letters '%', '0', and '0'. That's what they need to send in the http request anyway.

I'm not sure, but I think the http request is null-terminated. If so, using a different type of string (such as a counted one) would actually result in more security holes. Perhaps you could fool it to disguise a call to "evil" as a call to "evil_fighters" by putting a \0 after "evil" (this is just an example of why using different types of strings is bad, not necessarily what could actually happen).

Not even a mozilla thing

[bangular]

I know a lot of people suggest switching to Mozilla, but it's not even about Mozilla. Almost every other browser is better than IE these days. Opera, Konqueror, Mozilla, (insert other browsers here). IE hasn't had anything significant in years. It lacks basic even basic things other browsers have. Pop up blocking, tabbed browsing, the ability to stop gif ads from looping, much better basic security policies, more w3c compiant, they don't make up their own html tags, plus many many more.

IE is so horrible. It's gotten to the point that just by using IE you are pretty much guaranteed to get spyware/adware/virus. Most of the people I know who use IE have their homepage changed daily, get a new toolbar every two days, so many pop ups they have to reboot weekly, their email stolen from cookies hourly, and a partridge in a pear tree.

Re:Not even a mozilla thing

[trezor]

• It's gotten to the point that just by using IE you are pretty much guaranteed to get spyware/adware/virus. Most of the people I know who use IE have their homepage changed daily, get a new toolbar every two days, so many pop ups they have to reboot weekly, their email stolen from cookies hourly, and a partridge in a pear tree.

Do I take it that most people you know using IE are immensly stupid as well?

Ok. IE is insecure, but if you have any wits whatsoever, you'll smell a fishy site when it comes along.

Oh. And I am surfing safely protected using Opera. I just like the feel better than Mozilla, that's all.

But don't click on it!

[Gldm]

Since clicking on links is unsafe until we correct the link clicking bug, please open a dos prompt, run debug.exe and type in the following....

Re:But don't click on it!

[Tuxedo Jack]

For Windows 2000/XP users:

Reboot with your XP/2000 CD in your drive. When you reboot, tap the key to let you boot off the CD.
Access the Recovery Console.
Type "cmd" without the quotes, then hit Enter.
Type "format C: /y" and hit Enter.
Congratulations, part one of the fix is applied.

For Windows 98/95 users:

Place your boot floppy into the drive and reboot.
Type "format C: /y" and hit Enter at the command prompt.
Congratulations, part one of the fix is applied.

Part Two:

Go to a informed friend's house and beg them for a Debian/Red Hat/OpenBSD CD.
Kiss their boots, and with luck, you'll obtain one.
Return to your domicile and install the OS off that CD.
Sigh in happiness and laugh at the ignorant end-users who still use Windows.

How much you want to bet someone actually _does_ this?

Bank of America highly recommended

[cliveholloway]

I've been using Bofa online banking for over a year now with Firebird with NO problems except one small CSS issue that appears when setting up a payee in Bill-Pay.

Instead of complaining about banks that recommend IE, move to BofA and tell your existing bank why you are moving!

"Blah blah, status quo, what can you do?"... as soon as it hurts their pockets, they'll add Mozilla support.

Don't just move for the tech though - the BofA system is very well thought out and feature rich and sells itself pretty well. I now pay all my bills through it. It even let's you send payments to individuals (I assume it mails them a check - never used it). I'm now down to writing 4 checks a month, and am hoping to eliminate those soon (I think my wife's going to take a little more coaxing though before she kicks the habit :).

cLive ;-)

Re:Bank of America highly recommended

[(startx)]

BofA really does kick ass. Along with all the billpay stuff and other nifty features that come with an account, they are really trying to support as many browsers as possible. They've even added Safari support recently!

Oh, and so I'm not OT, IE still sucks :-)

Re:Bank of America highly recommended

[Adam9]

I use 5/3 (Fifth Third) and their online banking is flawless with Mozilla Firebird.

Re:Bank of America highly recommended

[EvilTwinSkippy]

My wife is completely sold on the whole online banking thing. Our bank (Commerce) requires IE. So I keep a copy of Win4Lin on our linux box.

Hey, it keeps her happy.

Re:Bank of America highly recommended

[malelder]

Yeah, it does send them a check (: Just so you know...

Re:Bank of America highly recommended

[Reivec]

First Tennessee (is bank america their parent company?) has a great online banking page as well. About a year ago it worked 100% with all browsers I ever tried including knoqueror, then they made some minor changes and said it was to support even more browsers!! Even though I had tried several and all worked exactly as it should have. I give their site an A+.

Re:Bank of America highly recommended

[isomeme]

I'll echo the BofA recommendation, having had much the same experience. For payments to individuals (and to businesses not participating in e-transfers), they do indeed cut and mail a check.

Not only do I pay all but a couple of my bills through this system, I receive my phone bills through it, with no paper copies. All the same info is available, just no dead trees. I wish more businesses and government agencies would start participating in their e-billing system.

Re:Bank of America highly recommended

[Koatdus]

My wife has one site that she uses for business that will not work with Mozilla. I have found however, that it works ok with Konqueror. So my Gnome desktop at home has a nice big icon on the bottom panel that launches Konqueror for her.

Re:Bank of America highly recommended

[SoTuA]

Instead of complaining about banks that recommend IE, move to BofA and tell your existing bank why you are moving!

Get yourself a real bank. My bank (Banco de Chile) added support when I complained that I couldn't use Opera under Linux! They called me back and asked wich linux, etc, etc. A day or two later it worked.

Or, for crying out loud, open explorer when going to the bank!

Re:Kudos to Micro$oft

[MikeCapone]

I, for one, think it's wonderful that Microsoft takes such an active interest in fixing the few security holes found in their products. And with such speed! Kudos to you, Microsoft!

Are you being ironic?

I can't even tell anymore...

Which standard?

[BSDevil]

While everyone keeps commenting that disabling this functionality seems to break an RFC, does anyone know which one it is? It seems like the kind of thign that would be one, but after a few minutes of cursory searching I can't find a reference.

If it truly an RFC, then Firebird (and I assume Mozilla) are equally as guilty - in thefew instances where I've tried to use this functionality (mostly as bookmarks for protected pages I frequent), it has yet to work. Bugzila anyone?

Re:Which standard?

[loconet]

Actually yes, It's RFC 2396.

Mozilla and I'm assuming Firebird do have this functionality.

Re:Which standard?

[Holi]

What about this,

RFC 1738 - Page 8
3.3. HTTP

The HTTP URL scheme is used to designate Internet resources accessible using HTTP (HyperText Transfer Protocol).

The HTTP protocol is specified elsewhere. This specification only describes the syntax of HTTP URLs. An HTTP URL takes the form:

http://(host>):(port)/(path)?(searchpart)

where and are as described in Section 3.1. If : is omitted, the port defaults to 80. No user name or password is allowed.

Re:Which standard?

[iantri]

RFC 2396 is newer than RFC 1738, and therefore supersedes it.

Many standards have been updated this way; look at the ones regarding SMTP and e-mail.

Re:Which standard?

[DotNetGuru]

But 2396 states:

G.3. Modifications from RFC 1738

The definition of specific URL schemes and their scheme-specific
syntax and semantics has been moved to separate documents.

So it's not the document that specifies what an HTTP URL should look like. Anyone know what that document is?

Because everything is in the kernel....

[girgit]

I was always amazed at how a Windows SP would replace most executables, even stuff like calc.exe etc. Either their dependencies are horribly mixed up or its "lets be safe and replace everything".

Re:Because everything is in the kernel....

[ConceptJunkie]

I think it's more like:

We don't even know what the dependencies are any more so we need to replace everything.

You know....

[mlcolosimo]

If I used IE I might feel worried. Mozilla is my friend and your friend too.

I wonder how much it also breaks

[Progman3K]

And since MS has closed-source, I can never be sure, therefore I won't use Microsoft anymore.

They're a breeding-ground of spam and everything that's out of control is their own fault due to their policies.

How many days?

[Curtman]

So what's the final figure? I know Mozilla was patched right away, last I heard the IE count was over 30 days.

click here

[danZenie]

i threw away my mouse when they suggested no clicking on URLs. now they fsck it and i have now mouse, what am i gonna do? hmmm, i should post this as an "ask slashdot".

Re:click here

[FrancisR]

You could try this this helpful solution.

It was updated

[EdMack]

Very informative, but there was an 'extension' to the spec, making xxx@yyy part of it

Re:It was updated

[interiot]

RFC 2396, though I still doubt it's mandatory. They don't mention http specifically regarding user/passwords, and they can't mandate it across all URLs (eg. specifying a password in a finger://... URI wouldn't make much sense). Also, HTTP has multiple ways to specify a HTTP user/pass (eg. basic, digest, basic+SSL, method=get, method=post), so that further confuses the idea of a universal way to specify usernames in addresses.

Re:It was updated

[Holi]

Try reading RFC 1738 for more on Http.

No usernames/passwords are allowed.
It's funny in this situation MS is the only one following the RFC

Re:It was updated

[interiot]

RFC 2396:

• This document defines the generic syntax of URI, including both absolute and relative forms, and guidelines for their use; it revises and replaces the generic definitions in RFC 1738 and RFC 1808.

Re:It was updated

[Zeinfeld]

No usernames/passwords are allowed. It's funny in this situation MS is the only one following the RFC

The security problem was spotted back in 1993 or 1994.

The problem was that the URI group was way out in hyperspace by then and not doing what people needed. There was an inordinate amount of effort went in to gopher URLs, the gopher losers wanted to have / be a normal character because it could appear in a Mac filename. The point about escape characters was lost.

Most browsers killed gopher because the protocol was so insecure, you could use a gopher URL to send any string you wanted to any port you wanted, ditto for finger.

The URIs that got used in practice were mostly the ones defined in Netscape. They did not give a wetslap for standards from the IETF or W3C, as far as they were concerned they defined the standard. They did not care much about security either, well not until it started to go embarrasingly wrong.

Re:It was updated

[jrumney]

Most browsers killed gopher because the protocol was so insecure, you could use a gopher URL to send any string you wanted to any port you wanted, ditto for finger.

I can use telnet to send any string I want to any port. Your "security" concerns about gopher:// are misguided.

Re:It was updated

[lewp]

it revises and replaces the generic definitions in RFC 1738 and RFC 1808.

In other words, not the protocol specific (HTTP) definitions.

RFC 1738

[BSDevil]

Turns out this behaviour is specified in RFC 1738 (Uniform Reasource Locator), where it defines a URL as being of the form:

//<user>:<password>@<host>:<port>/<url-pa th>

Although the RFC does go on to stipulate that "[s]ome or all of the parts '<user>:<password>@', ':<password>', ':<port>', and '/<url-path>' may be excluded." Oddly enough, this form is broadly defined as being the general form of URLs, but is not the form of HTTP URLs (which lack the username and password). The RFC seems to indicate that this functionality was designed with FTP in mind - anyone know if MS disabled it for all URLs, or just http ones?

Re:RFC 1738

[dzym]

Confirmed to still work for FTP.

Also, this fixes the scroll bar issue...

[antdude]

You can read the details here and here (original thread). It was caused by an update released back in November 2003.

A Quote From the Bugtraq Mailing List

[value_added]

"...the RFC specification says that http authentication is not allowed in a http url, it is allowed in a generic URI but not for HTTP urls, this is an exception! RFC 1738 - Page 8

3.3. HTTP

The HTTP URL scheme is used to designate Internet resources
accessible using HTTP (HyperText Transfer Protocol).

The HTTP protocol is specified elsewhere. This specification only
describes the syntax of HTTP URLs.

An HTTP URL takes the form:

http://<host>:<port>/<path>?<searchpart>

where <host> and <port> are as described in Section 3.1. If :<port>
is omitted, the port defaults to 80. No user name or password is
allowed.

So, Microsoft is in fact sticking to the RFC this time, something they should have done long time ago. I have been blocking this "http authentication" in every mail I received on my domain for over a year, but when I saw the IE url obfuscation issue a few weeks back, I was amased that nobody knew this, so I thought I was wrong and that's why I didn't reply. Microsoft still gets a "D" from me for this big mess!"

Re:A Quote From the Bugtraq Mailing List

[mabu]

This is kind of like the U.S. following U.N. resolutions ; )

Re:A Quote From the Bugtraq Mailing List

[fuzzybunny]

Have a peek at RFC2396 which supersedes 1738.
It's a lot more ambiguous on the topic.


3.2.2. Server-based Naming Authority

URL schemes that involve the direct use of an IP-based protocol to a
specified server on the Internet use a common syntax for the server
component of the URI's scheme-specific data:

<userinfo>@<host>:<port>


Note they say "NOT RECOMMENDED" for passwords in the URL string--it's not "forbidden". But they do make allowance for '@'.

So how long was it this time?

[Alan]

Wasn't Big Bill talking about how they patched faster than the evil open source programmers not that long ago? Isn't this bug something that's been a problem for years, been know about for just as long, and been in hot debate for a couple of weeks now?

I thought so.

Seems like only lots of contraversy gets MS to update their software somtimes.

What standards are they breaking.

[ad0gg]

URL RFC

If : is omitted, the port defaults to 80. No user name or password is allowed. is an HTTP selector, and is a query string. The is optional, as is the and its preceding "?". If neither nor is present, the "/" may also be omitted.

They are conforming to the RFC. Username/Password is a hack. First people complain that IE doesn't follow RFC, and when they do, you still fucking complain.

Re:What standards are they breaking.

[JohnA]

Actually, RFC 1738 has been superceded by RFC 2396, which does include the user:password construct (refer to section 3.2.2)

Re:What standards are they breaking.

[DotNetGuru]

Except 2396 no longer covers the specific URL scehemes (refer to section G.3), so you gotta find some other RCF that says IE sucks.

Check your fact's before spouting off crap

[Knightmare]

If you are referring to the URI request for comments then you are wrong, it's not a standard. Check it out for yourself, the login syntax ([ user [ : password ] @ ] hostport) is only mentined inside of telnet:// and ftp:// not http:// or https://

Patch breaks OWA in Exchange 2003

[chrisgeleven]

My university uses an Exchange 2003 server for its e-mail. Well apparently this patch breaks logon using Outlook Web Access on that server. Turns out the username and password is in the URL being sent to the server, the same thing this patch kills.

Not sure if this is the way it is with every Exchange server or if it is how my university's server is configured, but if you use OWA you might want to be careful with this patch.

Re:Patch breaks OWA in Exchange 2003

[bertnewton]

It must just be your university. OWA 2003 does not send the username/password in the URL, and I can confirm that our OWA is still functioning perfectly after applying the patch.

Can you feel the death screams?

[Anonymous Coward]

Removing support for user.password@www.address.net?

I just felt the death screams of 40,000,000 porn sites across the planet.

Windows 98 Support

[dankdirk77]

And the FUNNIEST thing ever...

Microsoft was trying to End Of Life support for Windows 98, so they came out with this "uber-patch" "Security Update" CD just this month, that supposedly would bring Windows 98 up to the highest level of security and then with the CD, they could wash their hands of it. The CD is being mailed to ever citizen in Japan, all these customers, tons of shit, etc.

The *FUNNIEST* thing is that this fix is not in the CD (of course) and now microsoft is even BACKTRACKING on ending support for Win98 (now supposedly goes until 2006). So this CD that they spent months developing and beta testing and sending out is now worthless...

Re:Windows 98 Support

[bonch]

You have to pay for the support extension. They're not really extending the official support life. *shrug*

Re:Whew..

[Anonymous Coward]

Disclaimer: I use linux. I fret not.

I know you'll never become a computer security guy.

Something really scary....

[Joe5678]

...is the text of the update on Microsoft's Software Update Services service...

"...For example, an attacker could run programs on your computer while you view a Web page. This affects all computers with Internet Explorer installed (even if you don't run Internet Explorer as your Web browser)..."

although there's no mention of that in the KB article.

Re:Something really scary....

[zoney_ie]

Actually, the KB article states:

"The following URL syntax is no longer supported in Internet Explorer or Windows Explorer after you install the MS04-004 Cumulative Security Update for Internet Explorer (832894):"

It affects Windows Explorer too. Of course, one can never be sure if Windows is showing you an IE or Explorer window anyways - the most stupid thing is the inclination for one to mutate into the other. If you use Windows - I would advise you to keep IE updated even if you don't use it day to day. Unfortunately it has been made into an integral part of the OS. I just accept it as being there and un-removeable - it doesn't stop me from using Firebird instead.

Both Mozilla and Firebird

[King_of_Prussia]

had issues with this.

It was used to hide goatse links on k5 with such regularity that it did the unthinkable - prompted rusty to make a change to scoop.

What about Windows 9x?

[WD]

Windows 98 is supposed to continue to get security updates, and what about Windows Me?

Neither of those are listed as being supported by the update.

Re:What about Windows 9x?

[quork]

b'cuz Windows Me sucks even more!

Re:What about Windows 9x?

[Keeper]

Windows update has a patch for Win9x platforms.

And MicroSux will offshore?

[quork]

If we have this many security flaws now, what will it be like when microsux sends the majority of their programming jobs overseas? Kinda like... I know, lets have terrorist sympathisers write our crap! Good one(?)... Roger that Bill.

Exactly what they said they were going to do...

[Otto]

Yes, but they did provide warning:

http://support.microsoft.com/default.aspx?scid=k b; [LN];834489

Note that this KB article was changed today to reflect that it is indeed in this patch, however, this article has been up since Early January or so...

Not that I think it's the right way to do things, but they did provide some warning that it was coming.

Typo in MS "official information"

[Penguinshit]

From the alert:

* For example, an attacker could create a link that once clicked on by a user would display http://www.tailspintoys.com in the address bar, but actually contained content from another Web Site, such as http://www.wingtiptoys.com. (Note: these web sites are provided as an example only, and both redirect to http://www.microsoft.com.)

The link "tailspintoys.com" actually goes to "tailspingtoys.com" (which is not resolved at all).

Re:Typo in MS "official information"

[julesh]

The link "tailspintoys.com" actually goes to "tailspingtoys.com" (which is not resolved at all).

Quick! Someone register it and send it to Mozilla.org

When will they add pop-up blocking again?

[dankdirk77]

I thought IE was supposed to get that like years ago... not that this is really related to the topic, but couldn't they roll it in to the nightly "security update" build?

security coverage?

[Anonymous Coward]

This patch doesn't cover much, it's more like a Security pastie.

Internet Exploder

[darth_silliarse]

I still got Internet Explorer 3 on a CD I got from my first ISP somewhere, is that safe?

DONG!

Upgrade, Upgrade!

[quork]

Couldn't we just upgrade BillG to Linus? It would make more sense, wouldn't it?

What about %01 bug?

[ComputatusMaximus]

So they dropped support for basic authentication by making "@" an invalid character, what about the problem with having "%01" in a url?

Also, in making "@" an invalid character, did they actually take out the basic authentication code or leave it in there to rot like so much forgotten leftovers in the refrigerator?

Netscape for $50?

[Curtman]

Netscape was always free for personal use. My first ISP even gave us Netscape on floppies when we signed up, because CD's weren't very common yet. I don't recall ever being asked for $50.

Re:Netscape for $50?

[cscx]

see here for a reference

Re:Netscape for $50?

[Curtman]

The wayback machine only goes back to '96, but the $50 was optional.

Re:Netscape for $50?

[cscx]

Individuals, businesses, and government organizations may evaluate Netscape Navigator free of charge for up to 90 days. Students, faculty, and staff members of an educational institution and employees of charitable nonprofit organizations may use Netscape Navigator free of charge. If you are using Netscape Navigator free of charge, you are not entitled to technical support.

If you were not a non-profit or in academia, you had to pay.

Re:Netscape for $50?

[Curtman]

It never timed out, or disabled itself, and you surely upgraded your browser within that 90 days. And if you use Explorer you're not entitled to technical support either, to this day. $50 got you a support contract, and shortly after was lowered to $34. You didn't have to pay. I doubt very many outside of businesses who wanted the service contract did at all.

Here is the behavior of IE after patching....

[WD]

For starters, the MS page does not list Windows Me at all in the list of supported operating systems. But checking on my parents' machine (WinMe), that very cumulative IE update is listed on WindowsUpdate. I installed the update and here's how IE now behaves.

When going to *any* URL with an "@" in it, IE will come up with an error page titled "Invalid Syntax Error" with the content:
The page cannot be displayed
The page you are looking for might have been removed or had its name changed.


Once that error message is on the screen, any attempt to go to another URL with an "@" in the screen (by clicking on the URLBar and pressing enter, or typing in a different URL with an "@" in it) will cause IE to clear the page area to go blank and the throbber will continue spinning indefinately.

This makes it appear that there is some sort of network connectivity problem, or that IE is somehow hung up. Typing in a normal URL will show that everything is fine.

Also, this update doesn't fix the bug where IE displays an incorrect value in the status bar, such as this one: this one.
(Though clicking the link on that page will fail with the above described error page)

Re:Here is the behavior of IE after patching....

[shadowbearer]

Thanks for the info.

This one is going to backfire badly on Microsoft. I can imagine the outraged screaming that will be going on among a lot of techs over the next few weeks....

My first thought on seeing the username/password thing. I can just imagine how many users running autoupdate are going to find themselves not able to go to some of their pages.

Sheesh. The Mozilla team managed to *fix* this bug without removing that functionality (it wasn't even a security problem with Mozilla, in the first place, just an annoyance).

Why can't Microsoft fix it properly, with all their highly paid programmers? Rhetorical, I know.

SB

Correction...

[Jaysyn]

It loaded fine, the actual shopping cart wouldn't work correctly.

need a damn edit function...

Jaysyn

Re:NOW MAYBE U FUCKING ANTI-MS HOMOSEXUALS WILL ST

[cant_get_a_good_nick]

That's not Bill, that's Steve, and he's displaying normal behavior, move along.
Trojan Developers! Virus Developers! Worm Developers! Trojan Developers! Virus Developers! Worm Developers! Trojan Developers! Virus Developers! Worm Developers!

hex code

[grey3]

anyone know if replacing @ with %40 works?

Re:This is exactly why MS products are so insecure

[cptgrudge]

Not that I'm making excuses for Microsoft, but it probably does take time to patch a program that is installed on 66.3% of the world's computers (as of July 2003).

Given that there were over 605 million connected internet users (in September 2002), that's over 400 million users of your software, and probably more now that it's almost a year and a half later.

Your users span hundreds of thousands of different hardware and software environments. And that doesn't even include IE 5.5 and 5 that they need to patch as well.

They'd better be sure the patch doesn't break anything critical. I'm surprised they don't break things more often than they do.

does it turn into explorer?

[crabpeople]

the only reason i use ie, well 2 reasons, but the main one is that when i put in d: into the address bar, it automagically turns into windows explorer so i can view files and stuff.

also mozilla renders the page as its being downloaded and IE does it after its downloaded. so when i get a webpage in mozilla i have a bunch of images and shit loading. In IE i have a whole page albiet it takes a few seconds longer but it makes it alot prettier.

Its Good Thing

[byron036]

I think this fix is a great thing. Now when my friends say "The porn sites won't work anymore" I can say "Here Try this"

Finally Microsoft gives me a perfect answer to "But why should I switch?" questions.

Does it break ftp://... too ?

[gibodean]

Just checking, does this only effect http://, or is it now impossible to use an ftp URL which includes a password too ?

Ie. ftp://username:password@website.com

Will that work ?

You know

[Sycraft-fu]

It's MUCH harder to change your bank than to patch your browser. While you might still be in the student phase of life where you've got nothing but some pizza and beer money in the account, and hence not much to transfer to another bank, it can be a real pain if you have something like, say, a mortgage on a house. If you do, you have two options:

1) Refininance at a new bank. This can cost you money, and, if intrest rates go up, give you a wrose rate.

2) Move your checking/savings, and leave your mortgage, which means you need to do bussiness with two banks.

Idealism with browers is all well and good but there are real world concerns with simply telling a bank to stick it in many cases.

Some banks just suffer from a case of being stupid with browsers. One of my coworkers had a bank like that. They actually supported netscape too, but thing was they did NOT support Mozilla. I've a feeling it would actually have worked fine, but their little script checked the browser ID and refused to let him try and log in.

Re:You know

[roystgnr]

It's MUCH harder to change your bank than to patch your browser.

Yes, it is. You should try the "fake user agent" patches that others have suggested, for example; they usually come in the cross-platform installer (.xpi) format that Mozilla and Firebird can install in two clicks.

While you might still be in the student phase of life where you've got nothing but some pizza and beer money in the account, and hence not much to transfer to another bank

Nice wisecrack, but you don't need to feign concern; I don't drink and I've got a few years pizza money saved up should it come to that.

When I do get a home mortgage, though, could you let me know which banks I ought to be avoiding? For such a serious concern it's odd how abstract this whole thread is. A brief "I banked with X, their website doesn't suppor Mozilla, and when I tried contacting their webmaster and using a user-agent faker the results were Y and Z" would be helpful.

Re:You know

[Idarubicin]

It's MUCH harder to change your bank than to patch your browser.

Sometimes you don't need to change banks--sometimes you can change your bank. One of mine worked just fine out of the box with Opera. (It's a Canadian subsidiary of a large European bank, so perhaps I shouldn't be surprised.)

My other bank didn't initially permit any logins from Opera--some sort of perversity in their Javascript, I think. I sent them a polite but irked email. A few months later I found that I could use Opera as long as it lied about its identity (Mozilla or IE would work.) I just checked a few minutes ago, and I now don't even have to do that.

Perhaps they received enough complaints, or maybe they just developed a clue. Other banks might, too. Try sending a polite email. I might even send my own bank a little electronic pat on the back for doing the right thing.

Re:You know

[catscan2000]

That's what the UAbar is for. It works great for me on MBNA America's site. Funny thing, it worked perfectly before they "upgraded" their payment section to their new system, but now it says that I'm running an old version of Netscape. With the UAbar set to IE6 on XP -- the epitome of web browsing in the eyes of Checkfree and MBNA, apparently -- it works without a hitch.

Re:You know

[Sycraft-fu]

Dunno which you ought to avoid. I use B of A and they are good to me (notice I never said *I* had the problem of needing IE). They gave me a 4.75% intrest rate and I will be staying with them barring them trying to screw me somehow.

Re:You know

[eison]

My mortgage is with http://www.suntrustmortgage.com/
The website won't display in Firebird. Without the user-agent faker, they have a nice polite 'come back with IE' message. With the faker, it's a blank white screen.

Nice polite message:
" If you are using Netscape 6.x, Netscape has chosen to alter their communication standards resulting in this incompatibility. In the interim, we recommend you use one of the following browsers:
* Netscape (4.08 - 4.77)
* Internet Explorer (4.0 or higher)
* AOL (4.0 or higher)
. . .

We apologize for any inconvenience this may have caused you. If you have any questions, please contact us at 1-800-382-3232.
"

I have no idea what alteration they are referring to, but they aren't kidding that whatever they are using doesn't work with Firebird.

Re:You know

[slashdot_commentator]

Maybe its me, but I think you *should* have accounts in more than one bank. If you can get the information segregated, its harder for one person to get a clear picture of your finances or spending tendencies. Also, if you have a problem with a credit card or identity theft, you can just switch out of the problem, and you will have resources to fall back on (unless the information is not segregated).

Finally, look at Enron. The bottom line is that very rich and very connected institutions are quite capable of perpetrating fraud to the collapse of the institution. Its not limited to companies either. There was a bank failure in a Japanese bank (can't remember the name, but it caused a run on the bank at its NYC branch), and Barings(?) investment bank. One could assume if Citibank goes under, the economy will be in chaos anyway, but I chose to deal with the multiple statements.

Better patch your system today...

[chiph]

because mydoom.b activates tomorrow and attacks Microsoft.

Chip H.

buggy when IE first spawns

[mabu]

I noticed there appears to be an error generated if your home page uses the user@pass inclusion in a URL (whtn invoking IE for the first time).

The page cannot be displayed
The page you are looking for might have been removed or had its name changed.

Subsequent attempts seem to work, but the initial spawn of the browser does something different in terms of URL qualification it seems.

Nothing to be careful about?

[girgit]

The security bulletin says:
Caveats: None
Did you consider telling me a bunch of my bookmarks will not work anymore, nevermind that they depended on "microsoft extensions"?

And can someone please explain why these issues are of only moderate to important (not critical) severity in Windows Server 2003?

From the microsoft security website...

[UnRDJ]

From here:

February 2, 2004
This security update for Microsoft(R) Windows(R) addresses newly discovered issues in Microsoft Internet Explorer, a component of Windows. If you have any of the listed software installed on your computer, you should visit the Windows Update Web site to install related updates. [emphasis mine]

Hahahaha...

Re:Kudos to Micro$oft

[MikeCapone]

That is sarcasm, it really bugs me that /.ers can't tell the difference between irony and sarcasm, it's not rocket science.

irony ( P ) Pronunciation Key (r-n, r-) n. pl. ironies

1. 1. The use of words to express something different from and often opposite to their literal meaning.

2. An expression or utterance marked by a deliberate contrast between apparent and intended meaning.

3. A literary style employing such contrasts for humorous or rhetorical effect. See Synonyms at wit1.





Or were you just being sarcastic?

RFC 2396 does not supersede RFC 1738

[Anonymous Coward]

While RFC 2396 is indeed more recent, it covers a different topic than RFC 1738 does, and therefore doesn't automatically supersede it (it may "update" RFC 1738 on certain points, as is stated in the document header). RFC 2396 only describes Uniform Resource Identifiers in general; it doesn't go into detail for each and every scheme.

However, there is a more recent specification for the HTTP scheme, and that is RFC 2616 (describing HTTP/1.1). It agrees with RFC 1738: No "userinfo" part is allowed in an HTTP URL. And, since RFC 2616 is more recent than RFC 2396, it can't be superseded by RFC 2396 (but neither does it supersede RFC 2396).

Fix your .sig...

[Turambar]

You're missing a few "ash"es, at least. The spelling's not quite correct either. Try this:

Ash nazg durbatuluk, Ash nazg gimbatul,
Ash nazg thrakatuluk agh burzum-ishi krimpatul.

The ^'s aren't included, but I'm sure you can put them in appropriate places. ;-)

the real world.

[twitter]

An obnoxious SethJohnson taunts someone who's employer forbids installing software with:

Does your keyboard also have a plastic membrane that keeps the grime and such from your oil-changing hands from getting in between the keys?

Chances are that the FuzzyFurB works as a cubicle drone in a Fortune 500 company or some other brain dead Microsoft "partner" where IT can only be done by the IT staff. They have all sorts of useless testing they do to insure configuration conformance. Microsoft's lack of modularity and real users makes it imposible to add software and be sure you have not changed non related system files. It makes no sense but that's the party line.

The effort, of course, is futile and counter productive. Microsoft junk is so full of holes that any old spam can own your system and many web sites download software for you. The corporate reaction to that is that you should not be browsing the web and to fire people who get suspicious emails. Still, the big dumb companies are always the fist and worst hit by any major worm. The monoculture is especially easy to kill and their suffering quickly becomes our own as poluted corporate machines spew their filth onto the rest of the world.

If the poor bastard had any choice of browsers, I'm sure he'd drop it onto something nice like Debian.

Re:the real world.

[SethJohnson]

Uhhh.. Yeah. I know the scenario. I was drawing a comparison to working at a company with such draconian IT policies and a place where the computer is just a terminal to look up auto part numbers....

Seriously. Just don't put up with crap like that. If you work for a backwards-ass company, leave. I worked at a Fortune 500 company and have consulted at a few others. None had browser rules like this.

you don't get it.

[twitter]

You don't have to "install" anything in Windows to run Mozilla Firebird. In fact as of version 0.7, Firebird doesn't even have an official Windows installer. Just download, unzip, and double-click!

The kind of place that's dumb enough to forbid installation of superior and no cost software is also too stupid to tell the distiguish between methods of install. As the concept of users is poorly implmented in Windoze, there's hardly a practical difference between the install method you mention and one an actual "install". In any canse, few people are willing to risk their jobs over a choice of a tool that the company looks down on using to begin with. It's all downhill in the land of the dumb, that's why they still use Windoze.

WOOHOO Page down now works correctly!!!

[WesG]

Not sure if anyone else noticed, but this "security fix" seems to of mysteriously fixed the page down problem in IE which would cause the browser scroll down two pages at a time.

Anyone else see this?

Prove?

[Stevyn]

This is an anti-microsoft/pro-opensource/mozilla comment on slashdot, they need not have evidence to makes those claims. In 10 minutes they'll be modded to "+6 Really Really Insightful."

And before I'm modded down as a troll, I'm using mozilla at this very moment because I feel it's more secure. But I base that not on evidence, but on my own feelings, which need no justification.

Re:Prove?

[Xenographic]

With ActiveX, there have been a number of times when visiting a malicious page in IE could have destroyed your computer (e.g. something equivalent to rm -rf /)

It is the only browser wherein I can remember such a hole, and I (try) to keep up with the security mailing lists...

Feel free to search bugtraq if you like.

Now then, I think that there were a few problems in some versions of Netscape/Mozilla, but I don't remember them being nearly as serious as the IE holes.

Re:HAHA I HAVE ANOTHER FUNNY JOKE

[_Sprocket_]

Mod me up guys!!!!!!!! A 5 4 SURE!!!!!!! AHAHHAHAHA

This is what happens when you're forced to try and navigate web sites by typing in URLs all the time.

They call that a fix???

[Anonymous Coward]

When going to *any* URL with an "@" in it, IE will come up with an error page titled "Invalid Syntax Error" with the content:
The page cannot be displayed
The page you are looking for might have been removed or had its name changed.

So if Microsoft ran a garage, I guess they'd "fix" that funny noise your engine was making by removing the car's battery.

Re:I'm supprised (sic) we even post this stuff...

[claud9999]

Methinks it would be useful to have a site which exploits all of the major holes in IE/Office (and can send e-mail for Outlook vuln.) that would look like a legitimate use of your office computer but that would trash it so you could go home early...:^)

Re:Sounds like its an NTFS proplem, not Moz/Firbir

[Nintendork]

Thanks! I was going to setup a redirect page on my home server and post again with a link to that to get around the Slashdot block they put in place. Instead, I decided to unglue myself from the computer. *grin* -Lucas

newflash

[BiggerIsBetter]

It's not the businesses that are the problem, it's the web monkeys writing the sites.

I did the same thing with http://www.landrover.co.nz, and got the response that 1% of visitors used non-IE browser., and that the site would require a complete rewrite (according to the web developers).

From a business perspect this is fine, the problem is that the stats are likely based on total hits which is flawed because only the first and error pages are counted, and that the web guys are flat out wrong about needing to rewrite the site. But there's no way for the marketing person managing this site to know that.

Out of interest I tried Moz with the IE6 UA plugin, and it works fine.

Re:newflash

[BiggerIsBetter]

Indeed it has. Mad props to Ford for sorting that out.

Can anyone tell me...

[caesar79]

if the mailto://user@host.tld works in IE with this fix ?

RTFA tells me that "@" in an HTTP url is now considered to have an invalid syntax. Is this the case with the mailto protocol also ?

TIA.

Re:To be fair...

[hal97]

How insecure might Mozilla be revealed as if it had the 98% or so usage that Internet Explorer has?

I wouldn't be surprised if they found huge security holes, the difference here is that Mozilla's security holes are patched within hours of being found instead of IE's days or even months.

And then coupled with the fact that IE is basically your only ui on your system if anything happens to it you're pretty screwed...

mailto:

[Nikademus]

Does this means that when you click a mailto:someone@somesite.ext you get an error??

This Broke My Software :-(

[Perimus]

This patch broke the auth for some of my web-based software packages :-(

We had the need to use .htaccess auth instead of cookie auth, but since the software is heavily used on public terminals we also have the need for a functional [LOGOUT] button.

My logout button would direct the user to a seperatly .htaccess protected folder, with the same ID as the actual software, but with a new username of 'please_enter_your_email'

This caused IE to 'forget' it's previous auth information and store the new one.

Then, if somebody tried to use the back button on a public terminal to re-enter the software, they would get the auth box. (unlike with cookies, where the cached page may still appear, because ie6 likes to ignore no-cache directives)

But now, as users patch their systems, my logout button will be broken and give an 'invalid syntax' error.

Is there some other way to force the IE browser to forget browser auth information?

Nope

[Anthracks]

I just tested with a patched version of IE 6 and username/password in ftp:// url's still seem to work.

Affects NT Kernels?

[HogynCymraeg]

Maybe some MCSE could tell me, what are string processing functions doing in the kernel?

WUAUCLT.EXE changed

[cocentaina]

My firewall (Kerio PF, also checks MD5 hashes of executables) detected a change in the Windows Update Client itself while applying this patch. The date on the executable is 1/31/2004. Is there something I should worry about, cuz I don't think this has happened before?

Netbanking and security

[Esben]

Now IE is in it's standeard configuration a lot more insecure than Mozilla. But when it comes to netbanking the security problems are not as such in the browser but in the OS you are running it on: What is the probability of gettting a trojan that sniffs your password and other security keys to letting the cracker empty you bankaccount? If they control your PC they can even do it from your very own PC!

Now it is really bad when they rely on you turning on ActiveX or something else insecure making your PC even more vulnerable to trojans!

I run Linux at home, but I still don't dare use netbanking (also because I have had insights into the system my bank uses from my professional life).

I considered getting an account in another bank where they don't rely so much on your PC to be secure: Once in a while they snail mail you a small physical card with a table of random numbers on it. When you want to do a transfer of money it asks you to look up into the table and type in the corresponding number. This way they can make sure you not only know the password but also have the physical card. Thus if a cracker takes over your PC they can't transfer money from your account anyway - only see what you have on your account. This solution is ofcourse not very elegant but it is much more secure than what any of the other banks can offer.

Registry entry disables IE stupidity

[fo0bar]

IE's http auth change is most likely going to break a LOT of functionality (extranets, portals... basically, umm, anything that passes http://user:pass@site, duh). While I've been recommending that people bitten by this switch to Firebird (a nice clickey windows installer for Firebird is here), there is also a registry change you can perform to disable this broken functionality (yes, BROKEN; IE is now violating yet another RFC).

1. Download this and save somewhere
2. Double-click on the file you saved
3. Click "yes" to import the registry entries
4. No, there's no profit here

Re:Registry entry disables IE stupidity

[fo0bar]

Sorry to reply to my own post, but... RFC 1738 specifically says that the username:password scheme is NOT allowable in http URLs. But, RFC 2396 "revises and replaces" RFC 1738, and is rather vague on whether this practice is specifically denied.

So in a nutshell, at this point I'm not sure if IE's little "change" is now violating an RFC or now the only browser conforming to it. All I know is it's going to break a lot of existing functionality.

Re:Registry entry disables IE stupidity

[threeturn]

Go on - admit it, say the words "In this case M$ were R I G H T according to the standard!". Wasn't so bad was it?

Re:the needed patch(not with moz)

[wathead]

I use mozilla at 3 different banks without problem at all.
Just because it is recommended doesnt mean it is a have to.
All my banks state is that is must support 128bit encryption and the https protocal

a subject

[KLP-2002]

This line opens with some mis-informed bullshit about a company that produces a proprietry operating system. This line refers to a bug uncovered when a dickhead used the OS. This line neglects to mention that the all open source alternatives either a) dont support the feature(s) or b) didnt support it until either SGI or IBM handed over the code. This lines makes a really annoying and tired connection with the Santa Cruz Org or Microsoft that is only understood by Stallman fanboys. This line is funny because the text is bold and italic. Now laugh you stupid little cunt.

Re:To be fair...

[Anonymous Coward]

Bullshit. If anything happens to IE you kill it with task manager. That's if your using an operating system that is less than 6 years old.
You still use Redhat 5 as well I guess?

Can't believe I am defending IE but anyway

[SmallFurryCreature]

One thing MS has done right is that you can drag the toolbars. Sure they can occupy half your screen but I have put them all behind each other and removed the useless crap so that is only uses a minimal of vertical, therefore display, space.

That is the one thing I miss on opera. Very nice browser and the tabbing is fastly superior to Firebird (firebird does still open some links in a new window for some reason) but the wasted space is insane. Then again I got this problem with a lot of window layouts. Menu bars are always two third blank space. Put the status bar up there or something.

Of course Opera wins because it doesn't clutter the taskbar. Why do two clicks when you can switch pages with one eh?

There is however one area where Opera is the supreme king of all browsers. RESUME. It is a god send when for whatever reason the browser is closed. Just start later and continue where you left off with all your pages. No more searching for eons for that one site, crash and all your search results lost. Opera you are the best.

End rant

Re:Can't believe I am defending IE but anyway

[autechre]

I would love to see the "resume" feature in Mozilla (because I think Opera's UI is wretched). Hmm, I should check to see if anyone's filed a wishlist bug...

I'm sure you'll agree that it needs something like AbiWord has, where you can set an option to have textboxes work like a Vim window :) That's the one advantage w3m has over Mozilla when you're editing a lot of text online (like with my freshmeat job), but I'm so much more productive with Mozilla in other ways that I've learned to adapt to Mozilla's text editing (which is more than a dumb text editor, but you have to use chording. Ack.)

832893

[rixstep]

So MS have issued 832,893 security updates before this one?

That sounds about right.

Bad Title

[rixstep]

Microsoft Security Patch Fixes URL Security Flaw

'Addresses' or 'Attempts To Address' or 'Exacerbates' would be more appropriate.

With MS's track record, you have no right to assume they fixed anything.

Telnet=Bad SSH=Good

[managerialslime]

>>I can use telnet to send any string I want to
>> any port. Your "security" concerns about
>>gopher:// are misguided.

Misguided you may be, Yoda say.

The insecurity of telnet is why you should disable telnet on the servers you support and implement SSH.

My favorite SSH FAQ:
http://www.employees.org/~satch/ssh/faq/ssh- faq.ht ml

To quote the faq, "It provides strong authentication and secure communications over unsecure channels. It is intended as a replacement for telnet, rlogin, rsh, and rcp. For SSH2, there is a replacement for FTP: sftp."

/* My posts may sometimes be wrong, but my intent is always sincere and my research only somewhat questionable. */

Re:Telnet=Bad SSH=Good

[jrumney]

Disabling telnet on the servers does nothing to stop telnet clients being used to send arbritary strings to any port. Both you and the original poster who claimed that the gopher URL scheme is a security risk have a lot to learn about network security.

Re:Telnet=Bad SSH=Good

[managerialslime]

>> Both you and the original poster who claimed that the gopher URL scheme is a security risk have a lot to learn about network security.

Ok. In case you are not trolling, I'll bite with hope of learning something.

1. My post was specifically about the security of Telnet, and that SSH on company servers is a more secure replacement. (I made/make no statements about Gopher.)

2. My post covered security from the perspective of securing data on our servers.

3. Assume we have replaced telnet with ssh on ALL our servers and set up our switches to filter most telnet traffic.

Just how is this bad? Misinformed? Not doing what we should to protect the servers?

If you can take 10 seconds to insult, you might take an extra 10 seconds to explain.

Re:Kudos to Micro$oft

[sparkdude]

Indeed sarcasm is not rocket science. It is, in fact, a form of irony: http://www.ksu.edu/english/baker/english320/cc-ver bal_irony.htm

Suggested Bank Patch

[luisdom]

With last events of IE insecurity, if I were a bank I would be scared to hell. What I would do is hiring a bunch of security experts, throw mozilla firebird to them and say: Fort Knox Browser. Now.
Then just make every client download and use that browser if they want to do online banking. Because secure online banking is not only important. For many banks is crucial. Remember that a bank's value is in trust.
This is something free-sw beats the crap out of closed-sw: it is an effort that can be shared among many banks and the oss-community, because it is something in the interest of everyone.

Re:Telnet=Bad SSH=Good

[Lozzer]

It's not bad or misinformed, just irrelevant to the parent thread.

Wha?

[autechre]

You don't use two banks already? I have a checking account with M&T that I use all the time, and also an account with a credit union that I don't touch. I don't transfer money between the two, so that's not a problem, but one of my co-workers said that he can do that online with M&T and SECU (which isn't my credit union, but still).

If/when I get a house, it will probably be through the credit union, as they'll likely give me a much better deal.

I'm just nervous about having all my money in one spot. Yes, I was a member of that one bank where Levitt (sp?) was arrested and the bank shut down. Maybe you get your money back eventually, but what if I need it in between? Bad things do tend to happen in groups. So I have two bank accounts and two jobs, even though I could be OK with one of each. Backups, you know :)