Slashdot Mirror
Latest SP2 News
Xformer writes "It seems that SP2 for Windows XP isn't as secure as Microsoft touts it to be. Heise Security has uncovered two flaws in SP2's bolstered security measures, both of which may be used to get around the new trusted/untrusted executable origin checks. Of course, who would be surprised by this?" Reader EtherNetFreak writes "Well it appears that at least one hotfix is already available to fix yet another bug in Windows XP, post SP2 application." Reader Finalnight writes "'Microsoft Corp. yesterday delayed yet again its oft-delayed Windows XP Service Pack 2, this time postponing the patch's distribution through the company's Automatic Update service.'"
For some reason SP2 doesn't show up in Windows Update for me, I already have SP1. My friend gets this same problem.
SP2 for Windows XP isn't as secure as Microsoft touts it to be you just blew my mind :)
All the torrents you could want.
They were there before SP2, how does this place the SP2 at fault?
These "flaws" are not really that big of a deal. The idea of warning is so that files are not run afterwards by mistake. They give an exploit in which someone opens cmd.exe, then drags the file into it. Well if the user will follow along and execute some command they suggest, then things are already out the window. In addition the other exploit talks about overwriting a current file and it not showing a warning, once again if they can get you to overwrite a file on your hard drive with their file then you are already gone.
*Shrugs*
My pics.
is this flaw serious enough to be used to write some worm?
Surely, it's normal to release patches. Why is this news?
So they patch up to SP2 and they continue to patch. I would hope so.
So there's issues with SP2. I dare you to do a similar number of changes and then have no issues with the resulting code.
Yet another slow news day we we see headlines like "Ask Slashdot; I want to install a text editor, what do slashdot recommend?"
It seems that SP2 for Windows XP isn't as secure as Microsoft touts it to be
In other news:
Pope renounces Judaism, admits he is devout Catholic
Bear community overwhelmingly rejects $25m latrine levy
CmdrTaco reveals longstanding heterosexual relationship
We recently had heard in the office over one of the Yellow Machine that's made by Anthology Solutions.
is avaliable here
I'm curious how long it takes them to release Service Patch 2 for SP2...
Great, someone used Sweeping Microsoft Generalisations #423 and #587, and gets modded up as Funny.
Come on, guys, if you're going to bash the Beast of Redmond, at least put some effort into it!
-MT.
-MT.
Why is that funny? The initial article cracked me up...but the parent post was more like +informative ;)
Can your karma go above being Excellent?
I dunno, the software *I* use, the idea of "well I'll wait to hear from other people to see what happens, in case it breaks something" for an upgrade is absolutely absurd. What on earth is this? I posit that you windows users think upgrades acting like this "SP2" does is normal is not because it is normal, but because Microsoft has convinced you to drastically lower your expectations.
On the other hand, it might be that they don't give their QA people enough time to adequately test their products before release. I would think it's cheaper and more efficient for them to let their customers to find the bugs.
I really would like to know if Microsoft has an outsourcing company working on this project. They openly admit they outsource parts to outsourcing companies, why not this?
If this is the case, it is very easy to see why Microsoft has so many problems with security. They have no control over the hires, no control over the code (you can review it, but thats a lot of code), you have no control over security of the code.
I sometimes wonder if people purposly put in backdoors or buffer issues to allow this to happen. A unhappy coder is a dangerous coder, and lets face it, if you work for an outsource company, you probly are not too happy. I sure wasn't.
I would think it's cheaper and more efficient for them to let their customers to find the bugs.
:)
Microsoft have been implementing that system for some time now.
-MT.
-MT.
This makes me wonder how Microsoft, as well as many other large software corporations, manage security patches and quality assurance of their software. Is the problem with there being so many people working on different projects that they do not communicate and therefore things get overlooked, or is it due to the complexity of the software, or something else entirely? I couldn't imagine how someone could manage 'security' for Windows (or any similarly large project) and be 100% sure of what all the technical staff do. Does it come down to having more meticulous software engineers and rigorous testers? How would people recommend this be done? I'm sure the typical "make it open source!" answer will be given, but if that is not an option, how do companies who are more successful at this do it?
I think it's funny, because it happens very often...
... (Fill in some very good reason, like getting fired ;))
Developers vs Rest-of-company:
Pre-release-phase:
Rest-of-company : Come on, we _need_ SP2 now!
Developers : But it isn't finished yet...
Rest-of-company : If we don't get it NOW, we will
Developers : Oke, but there are too many problems with SP2...
Rest-of-company : We'll release some hotfixes, just give it to us _NOW_!
Developers : *shrugs* Oh well... Just don't forget we warned you guys...
Post-release-phase:
Rest-of-company : WHOA, There is a problem with xxx. How is that possible?
Developers : Well, SP2 just isn't quite finished yet...
Rest-of-company : Not finished? What the f**k?!
Developers : We told you so, before the release, but...
Rest-of-company : I don't want to hear that, just go and work on the hotfix...
Developers : *shrugs* Oh well...
The parent is not flamebait! Microsoft software is sloppily thrown together, especially from a developer's perspective. To start off with, too many poorly designed features (such as allowing executable code within Word documents and email messages) exist in the company's products. Microsoft apparently has marketers, not engineers, for software architects. The development environments we have to work with have generally been lackluster.. poor documentation, things don't work the way the should, etc. Dealing with anything Microsoft is frustrating.
I think I'll wait for SP2a, thanks all the same.
And remember kids: Never trust a computer you can actually lift.
Perhaps a new poll is in order.
Which will get released first?
XP SP2
Longhorn
When the source is open, the possibilities are endless.
let's be fair... it IS certainly flamebait, as it denigrates microsoft while offering no useful information at all.
Is it there or isn't it? What is it? It's the Heisenberg Patch!
And remember kids: Never trust a computer you can actually lift.
These 'flaws' are of the same type as posting a script in your .sig that executes "rm -rf /" on a *nix system.
The best security measure would be some device that read the mind of the user and warned if you were too stupid. Or maybe even easier:
if(spywareCount > 20) stupidUser = true;
secretly, i was expecting some comment relating XP SP2, Longhorn and DukeNukem Forever...
I would like to suggest XP-SP2 as the no.1 vapourware project for 2004 ;)
Privacy is terrorism.
"exit" Haha i do that too much in IM windows. :P
in SP2. They've gone through pretty much everything, re-hashed a lot of stuff, sometimes on a very deep level. Tons of bugs were fixed. There's not a software company in the world that could release something like this with zero bugs. Not even demi-god Linus Torvalds is capable of such a monumental technological feat as releasing code without bugs.
Having said that, it's all about risk management. If you're willing to postpone SP2 roll out in your org you've got to estimate the risks of not rolling it out, too. As I said it fixes a lot of issues, and if there's a bug or two the benefits still outweigh the risks by a wide margin.
How's sending .gif and asking to run cmd on Windows XP system is any different from sending .gif and asking to execute perl on Linux or BSD?
My other Beowulf cluster is... er...
was too hot.
I mean come on. Here's MS trying to push WM9 on all the media companies saying how they promise to play nice and then suddenly they shut out Divx. That didn't look good at all.
I'm not saying Divx is the greatest codec, but it looked bad.
Actually, to be honest XP is quite good. The masses really mainly seem to understand how to use it. My mum can write CDs, scan photos and so on :P ... which previously with Win98 was always a sure way for a phone call to me for support.
I really enjoy the fact hardware is finally really plug n play. No stuffing around finding the drivers. I slapped it on an old Pentium 500 recently and it detected everything, breathing new life into the box.
And yes, while I say this, I prefer (and are browsing on) Firefox, and we have a bunch of linux servers. (Its a shame I have to justify any decision to use anything which aint a "postgres server on some box where i have personally contributed into a branch of a kernel i compiled mysel" when on slashdot. ah well).
Ok, correct me if I'm wrong, but isn't a Service Pack supposed to add security fixes, and patches to operate more 'as expected'...
Yes, you can do something convoluted to get something to misbehave (save the file, open up a command prompt, run the file) etc, but seriously, if a normal user does this, then they are beyond help that we can expect an OS to provide.
Remember, you can get *ROOT* access to linux by rebooting and adding 'single' to the boot line. Does this mean that it should be fixed in the next kernel/distro?
You can only do so much to protect the user. If you go out of your way to bypass security measures, then the OS should not be expected to protect you.
Sendmail is like emacs: A nice operating system, but missing an editor and a MTA.
Would you like some cheese with that whine?
From my perspective based on the size of SP2 I'd say it's a new OS. Two patches/flaws in a MS OS is darn good. Kudos to Redmond.
XP SP2 ... disappointing (may as well be WinXPSE much like Win98SE was)
XP SP2. Websites go out of their way to find security flaws and come up with this in a feeble attempt to keep the anti-MS flow going...sorry, but if this is the worst exploit they can manage to dig up from SP2 perhaps they need to point their arrows elsewhere...
People replying to my sig annoy me. That's why I change it all the time.
Nor does yours. Nor does mine. Nor do half the posts here. Nor does the next reply to my post. Nor does the reply to that one. Nor do any tomorrow. Nor ...
*head explodes*
I just got a new 4th gen iPOD, which I can write to on Linux, but can't get to work on my XP-SP2 Windows dual boot machine.
Guess what I'll be uninstalling next...
..........FULL STOP.
WinNT ... usable, not disappointing
If you did not notice, MS normally uses the services of Akamai to auto-distribute the load of their DNS AND their content servers. The images, media and download files are hosted on (linux) akamai servers, and are auto-mirrored to practically every ISP in the known world(s).
So the bandwith excuse is not an option...
Ciao, Renato
The trouble is, M$ do not have the luxury of coding a free, open system as per Linux and are more concerned with the 'control' of the code in what it allows a user to do (or more importantly, what they are not allowed to do!!). Basically, the whole design from bottom up of windows is a bad legacy and will always cause problems
:D
BTW, here is the SP2 fix list SP2 fix list
Some great stuff here e.g. -> 823830 Your Windows XP computer stops responding after you log on
Win95 ... Neo-Rio-101 finds it disappointing ... Neo-Rio-101 finds it disappointing ... Neo-Rio-101 finds it disappointing ... Neo-Rio-101 finds it expensive but somewhat usable ... Neo-Rio-101 finds it expensive, disappointing, but somewhat usable ... Neo-Rio-101 finds it disappointing ... Neo-Rio-101 finds it disappointing (may as well be WinXPSE much like Win98SE was) ... (Neo-Rio-101 can't bear to look)
Win98
WinME
Win2000
WinXP
XP Starter Edition
XP SP2
Longhorn
*Yet* another flaw in XP SP2 has been found:
Even with the service pack applied, Windows does nothing to guard against the user revealing their password to a complete stranger in a train station in exchange for some crappy pen.
MICROCRAP WINBLOWS!!!!!!!
In my humble opinion, this article is about as useful as a troll. Many /. readers have already pointed out that these aren't much of flaws.
Mircrosoft is finally playing the right tunes, but someone on a vendetta can't accept this, so they nitpick after _anything_ to pin on SP2.
For Christ's sake, Sendmail. Sendmail had a brand new remote execution (That's translates to your unpatched box being rooted.) exploit posted a week or two ago, and not a word was said.
This isn't news. This is hypocrisy.
--
All rites reversed 2010
Sending an email and instructing a user to do something more than "click here"? What's next, "Hello. To see nude pictures of Natalie Portman, please: go to insecure.org and download nmap, go to arin.net and find ip ranges for several major calbe internet providers, search for vulnerable Windows XP systems that you can use exploits on (use Google to find Windows compiled versions of the exploiting tools), and use the exploits to inform the remote user of this method. If you infect 10 people and get them to pass it to 5 of their friends, Bill Gates will send you a check for $50 for every person that references you. It's true! I did it and you can to! K THX!"
DeMe
n SP2. They've gone through pretty much everything, re-hashed a lot of stuff, sometimes on a very deep level. Tons of bugs were fixed. There's not a software company in the world that could release something like this with zero bugs. Not even demi-god Linus Torvalds is capable of such a monumental technological feat as releasing code without bugs.
It can't be very deep when you allow this "bug" to go through a command-window. Then it's just a patch to explorer, and explorer-alternatives like Litestep and others will still be vulnerable.
I think it's all hype, and an afterthought to security when you allow these kinds of "bugs". It's not a bug, it's a fundamental wrong way of fixing things.
And so fantastically predictable too!!
http://www.debunkingskeptics.com/
Unfortunately, some idiot on /. will probably claim that Linux is better at releasing non-buggy software. Just ignore that 2.6.8.1 kernel over there.
At the top of the hour, we'll bring you Microsoft's latest battle to ensure Security in their Service Pack 2 Upgrade, but first, this message from your sponsor...
...Okay, Microsoft the #1 manufacturer of software in the US has announced that it will not be shipping its Service Pack 2 upgrade on time. We have an operative at Microsoft headquarters who can bring you the scoop. Stan?
...security are coming along just fine. Hang in there, and we'll show you that Microsoft is the only company in the world that can offer you security from all manners of Internet threats, from pirates to hackers, and of course, file-sharers."
...oops, sorry, wrong footage...
*cue the Microsoft ad*
*cut to Microsoft Windows ad*
Mr. Ballmer, how does this delay affect your company's efforts to ensure the security of your customers? What does this mean in your plans to release the Longhorn operating system?
"Well, Stan, we here at Microsoft have been long at work making things safe and secure for every single person, and we don't plan to change that now. As for Longhorn, that will be put on delay until we can secure what we have now. Beyond that, I can't comment."
Do you give any credence to the rumors that more and more of your customer base might be slipping to Windows?
"Yes, but they'll be back, when they discover that the costs of going to Linux is higher than staying with us. Our plans of world...
Thank you, Mr. Ballmer. Back to you, Charlie.
*cut to Charlie*
Thank you, Stan. When we come back, a look at your money, and a surprising look at SCO's evidence, proving once and for all, it's ownership of UNIX and Linux...
*cut to MSN Ad*
Darl McBride, CEO of the SCO Group, uncovers an amazing discovery that could turn the tables in their court case against IBM, who they allege had taken UNIX code, the recipe for a computer to work, as they provided this evidence this afternoon in court...
*cut to scene where Darl is in a straitjacket, screaming that Linux is his and if he can't have it, no one will*
*cut to scene where SCO lawyers present the Chewbacca Defense*
No question, IBM's claims make no sense. So, here we have conclusive evidence that Linux rightly belongs to the SCO Group.
In an unrelated incident, Darl McBride, surprised at the effectiveness of the maneuver, lost his sanity, and shouted about his ownership of Linux.
*whisper: Do you think they'll buy that? What?* *looks at camera* Oh, when we return, we'll cover your money, and it's safety in MS-backed stocks.
The Penguin Producer
The error didn't sound so bad when reading about it in the article. Not until reaching the part where they called Microsoft... The Microsoft person basically admitted that this is not just two minor bugs, it's a design flaw (look for the word "design", then re-read that sentence). Much worse than it sounded at first.
I mean, let's be serious. I'm not defending Microsoft because let's face it, they have allowed some pretty serious security flaws to get into Windows in the past. But the article does mention "social engineering" and I ask you, isn't this at the root of many, many security issues? I'm not saying Microsoft is never to blame - not at all. But what I wonder is how much damage has to be done before the typical user just sits down and LEARNS a little about security. I am honestly appalled at the number of computers I see that are on the internet without ANY form of anti-virus protection - much less a firewall. Computers are certainly much more complex to operate than say, a car - and we make people go through a whole course and take a test before they're even legally allowed to drive one. Why? Because they can end up killing someone, or themselves, if they don't do it right. With a computer, it's not that severe, but you can still do some major damage (or have it done to you).
Put it this way. If the average user took the time to learn just a little more about this device that is a BIG part of their lives, and how to keep it and their private information secure, would security really be as massive of an issue as it is today? I will say this, though - I'm glad Microsoft has turned the firewall on by default in SP2. I know it's going to cause a lot of headaches, but think about it - a lot of people are hearing about a firewall for the first time thanks to SP2. Hearing about it, and being FORCED to deal with it, is a big step for the average user towards learning more about security.
After installing SP2 i received an email from a person i don't really know, but he somehow had found a Word document with a lot of personal information about me online and was worried i might have misplaced it. He was so nice to send it to me, so i tried to open the document to see what was in it but Word wouldn't start properly and nothing seemed to happen. So it seems SP2 breaks Word. And on top of that my computer is really slow lately and sometimes messages appear on my screen like, 1 0wn j00! WhaAHAHa 5uck3R!!
kinda funny but i don't remember installing that...
seriously, if a user is dumb enough to follow instructions to do something he never asked for from somebody (he probably doesn't even know) he got an email from, you might just as well ask them to install backdoor.exe because it will make their computer faster.
Am I alone in picturing J. Jonah Jameson (Peter Parker's boss) when reading dialogue like this?
Can I get an eye poke?
Dog House Forum
In SP1 (and XP original I think) there is a certain time during system startup when it is on the network already but the "Personal Firewall" is not yet started. This time is long enough for some exploit to "own" the machine. Pisses me off.
That tag is starting to wear awful thin.
Why is it harmful to stoop to clutching at any desperate cheap swipe at MS ignoring any similar commentary on OSS software?.... because there's a large number of NERDS that miss a lot of useful "stuff that matters" on Slashdot because they're not prepared to deal with the rabid hypocrisy of articles like this one.
Secondly it makes the OSS comunity look like a bunch of immature fanboys rather than the dedicated professionals most of the community is made up for... that directly impacts adoption of OSS by business.
If you've ever wondered why OSS struggles for credibility in many businesses, bullshit like this article and the culture it encourages are a significant factor.
Articles like this one hurt the OSS community way way more than they ever hurt MS and feed back into the fact that the OSS community itself is all the advertising MS needs.
"News for OSS Nerds. Any desperate shot at MS."
Grow the hell up.
Get back to news for ALL nerds, and stuff that genuinley does matter. Because **gasp** there are Nerds that also develop on the MS platform, and not suprisingly they're more likely to hear the OSS side of the argument if they're actually around rather than on the other side of the room rolling their eyes at you... and maybe... just maybe... you have as much to learn from them as they have to learn from you.
"WinME - ABSOLUTE TRASH."
Now now, an old copy of WinME might be handy to hang onto for one reason: MS-DOS 8.0. They hid the bajeezus out of it, but it's still the final version of MS-DOS. Since then, all you've got is FreeDOS and maybe future iterations of IBM's PC-DOS 2000.
In the fact that files with the extension gif should not be executable? These days, in Nautilus, you get a warning message when you try to open a file of which the extension does not correspond with the actual file contents. It will even prevent you from running it by just double clicking on it.
if(Lucasarts)
...
post.replace("SP", "EP", 0);
Look, SP2 sucked, noone liked it, we are all waiting for SP3, although most of us have this feeling that it will be more of the same.
It gets complicated with SP4-6 due to something called the time-space continuum.
#hostfile 0.0.0.0 primidi.com 0.0.0.0 www.primidi.com 0.0.0.0 radio.weblogs.com
Whether or not this article is just picking on Microsoft, there really is a need for Microsoft to seriously evaluate the future of its code base.
I mean, they could start with a BSD kernel/minimal tools, the old BSD licensed wine code, start hooking their upper APIs in and probably be back up to WinXP compatibility in similar amounts of man power. (They would avoid the 'evil' GPL, have probably better performance, an unbelievable jump in security, and be in a great place to embrace/extend Unix.)
+5 REDUNDANT
Yes, I couldn't suppress a first smirk upon seeing this article. But then again, there are two major reasons we shouldn't be laughing too much about this:
a) While uncertainty about Micro$oft brings some more people to Linux (which is touted to be more secure, but then again - it can just as well be penetrated by hackers), it also turns people away from using the Internet because they get too scared of what's going on there. The latter are mostly elderly people, but nevertheless - even they should be free to use the Internet, something which a number of them dread now because they feel their privacy (through spyware) and/or financial background (due to phish scams) may be at risk. And this is not a good thing.
b) Staying still, laughing about Micro$ofts misfortune here has to more immediate effects: (a) it will spurn M$ developers even more to deliver better software - and (b) has Linux people potentially stay back and enjoy M$'s misfortune (and hence giving M$ more time to catch up, security-wise, that is). Do you want to sit at the "other" end of the story in a year or two - once M$ has sorted out most of its security issues, while linux might be more and more negligent of these issues (because everyone "knows" that it's Windows that's insecure).
Personally, I've had some of my machines broken into about 2 years ago - and that was out of negligence (thinking Linux would be safe enough on its own). In the end, it probably was just a couple of script-kiddies breaking into the box to install - of all things - an IRC proxy/cache/logger on the machine. I don't know how the originally got into the machine, as I am not even quite sure WHEN it happened. But it went far enough that they even replaced the system's own ps/netstat/... to make sure those wouldn't display the "wrong" processes. I only noticed a problem when I inadvertently stumbled across it...
Since that time, I've done some more work trying to secure the box as far as (with MY knowledge) possible - but I'll no longer think my machines are inherently better than a M$ server might be. M$ *will* catch up - and they DO have the money they need to fix these kinds of problems.
The question is - do WE have the idealism to hunt down every single bug? (M$ people don't need the idealism for it - they get well PAID to do it).
is that Microsoft has released a Service Pack way behind schedule, and can't guarantee the fixes work. Why should poor Joe ServicePack install this SP2 if he isn't confident it will reduce his risks? If at all, SP2 could convince Joe to remain unpatched until crisis time.
-
If you keep throwing chairs, one day you'll break windows....
This is not a troll. WTF?? Are all mods like this?
Hey, the above post is hardly offtopic. Grandparent says Linux Rules becoz Win XP needs an SP2 which also seems to be teh sux0r, however parent explains why s/he'd rather stick to XP, despite flawed SP2... don't see how this is offtopic...and now I suppose I'll be modded offtopic too eh?
My Favourite Meme
> It seems that SP2 for Windows XP isn't as secure as Microsoft touts it to be.
No kidding? SP2 is written and distributed by a corporation known to lie, cheat, and steal! They were even caught trying to fake evidence in court. They have no morals. It's only a matter of time before they begin screwing over their customers - more than they already do, that is. Come on, people... we're talking about Microsoft. Sheesh!
Dear insightful and thoughtful readers:
.xx beta. ...Especially those of you who DONT EVEN USE WINDOWS!!!
SP2 is *NOT* I repeat *NOT* a PUBLIC RELEASE. It is currently in BETA testing and is not currently promoted by Microsoft as an OFFICIAL release.
So please stop the moaning: It is for developer release ONLY, and the fools currently downloading it and acting like guinea pigs (read: Beta Testers) should stop bitching about a
Now, here's a nice piece of reality. See the truth in this article. You'll love it.
... Linus and crew are at work with yet another version of the kernel, this time numbered 2.6.9! Those people are so sloppy, having to upgrade the kernel every few months to fix all the issues. Doesn't sound quite right now does it? Change the tag to SP2 and Windows, and we have a slashdot headline! Mod me as troll if you like, I'm just trying to make a point.
This article explains a lot.
Microsoft is insisting that everyone install SP2 via Automatic update,
The default time set on Automatic Update is 3:00am, in your (wherever you are) timezone
Everyone in any given timezone will be attempting to download a 200Mb patch at the same time.
...So, Microsoft have scheduled DoS attacks on themselves.
In the past few Windows XP SP2 threads there have been several people complaining about slashdites seemingly "picking" on Microsoft and celebrating any and all flaws the update has. I don't feel bad for Microsoft in the slightest at this point. They've been touting the security of Windows XP for years now and have done little to actually back up their claims. Sure some Windows XP system on a managed network with double filtered internet access and nightly reimaging might be pretty secure. In the home however Windows is simply a distaster waiting to happen.
While SP2 is more secure than the original release and SP1 that doesn't reduce the number of Blaster hits my firewall blocks. It also doesn't affect the 50% of Windows users that will never download the update and will continue to be hammered by viruses and worms. Microsoft's delays and incompatibility problems just exacerbate the matter.
It's good to see Microsoft taking real heat from the industry press over their problems in SP2. The industry as a whole rolling over for Microsoft is what led to the situation as it stands now. The original release of Windows XP was riddled with holes and and was summarily exploited. No one seriously called Microsoft on this fact and SP1 was little more than a collection of security patches and minor bug fixes. The changes made in SP2 should have come out years ago. Maybe then you could plug a Windows system into a cable modem and last more than twnety minutes without being exploited.
Linux is improving in the usability and management arena and MacOS X is gaining mindshare as Apple improves its hardware. Both of these OSes are designed much more securely yet have a high level of technical capability. I really hope people begin to see there are alternatives to Windows and they're not nearly as bad as Microsoft would have you believe. SP2 is going to teach their management a hard lesson; despite being a monopoly power in the industry they still have to improve and maintain their OS.
I'm a loner Dottie, a Rebel.
Good point about ignoring the 2.6 kernel. I know I do. 2.4 FOREVER, BABY!
You forgot WinNT: usable and I would add also: WinXP: usable on a very new (fast, expensive) system with a lot of memory.
This would never happen at my office.
As if our staff would even remember what their password was...
Hire some shills to say that you did anyway. Also attack your competitors products as a diversion. Look at the monkey. See the silly monkey?
first of all :
besides the whole zone-concept is a big laugh, and besides it is an even more big laugh (which is nearly impossible to achieve) to "expand" this paradigm to the filesystem (what in fact has not been done, but will not be communicated either), we get to a point we're talking.
So now that we pointed out that all this is absolute crap anyway, the article on heise shows up that the concept has no flaws, but in fact hard bugs.
if a programm uses this mechanism to determine the "safety" of a file, it could get wrong data.
Period.
This has absolutely nothing to do with "will not be exploited from remote".
So here it is another windows problem
Chris ,
Php Programmers.
What you do when you want a large system to be secure:
You implement a very small "core" or "security kernel" or "call it what you like". It is called a "reference monitor" in TCSEC. It is a piece of code that will be asked "can subject X do operation Y on object Z", whenever a user or program attempts any operation on any object (like a file or a network connection). This piece of code is so small and simple that you can inspect it and possibly even formally *prove* it to be correct.
The operating system kernel will then guarantee that the reference monitor is consulted on all such operations. This is, after all, what operating system kernels do, among other things.
Now; you can write a simple security policy for each subsystem in your operating system. One policy for your browser, one for your word processor, one for your regular secretaries, one for your accountants, etc. (a real OS with these features will of course have the majority of all policies set up and ready by default).
The system will now enforce the security policies on everything that goes on in the system. Because the OS is enforcing these policies, and because the subsystems cannot magially change the security policies set up for them, this is called "Mandatory Access Controls", or MAC for short.
MAC ensures that a bug in, say, your browser, cannot be exploited to, say, go thru your documents and harvest e-mail addresses. Simply because the system policy does not allow a browser with internet access to access local documents. Just an example.
This is how secure systems are built. This is what SELinux is trying to do, and this is what Trusted Solaris has done for a while. This is what is required if you want a TCSEC certification in the B (or A) class, not the kindergarten-security of the C class.
Or, under the common criteria, this is what you need to get certification against the LSPP (as Trusted Solaris has), instead of the kindergarten-security CAPP (as Win2000 can have in certain restricted setups), or even the home-grown "security targets" (which SuSE got).
This is old and well known technology. Too bad big businesses and governments never put pressure on the vendors to actually have real security built in.
Good to see SELinux coming along nicely, and Sun moving Trusted Solaris features into Solaris 10.
All is not lost - but trust me, they will be selling snow-cones in hell before you see MAC in Windows.
How do sites like this still manage to exist? Surely people like the MPAA should have caught on to them, being illegal and all.
Asshole.
"You heard the man, Tubbs.. get undressed."
Where is the -1 "Telling the truth but nobody wants to hear it" option?
The RTM releases are mainly for buisneses and corporate customers even though they are publicly available.
However, It's not the final version.
Once SP2 CD is available for order and MS is officially stateing on its main XP Pages that SP2 is here, there will be another SP2 Release.
They did this same thing with SP1 however they never mentioned that the RTM SP1 was slightly different from the GOLD SP.
Once the SP2 GOLD is released the RTM tag will not be on your MS About/version windows. It will just be SP2.
We could sit here and criticize everything but I just want to point one thing out. SP2 is the single biggest improvement MS has ever made to one of their OSes. Additionally, it is great that people like this find these things and bring them to their attention and further bring their market speak responses out to the 'public' (if /. et al can be called that).
I would like to see MS make a security programming kit which could access their APIs to a greater level. Even if this were only available to BIG select 'gold' partners. You would have options other than MS to report bugs to. Yes, that is somewhat a theft from the OSS movements model. But it would really improve security. Imagine this article if that were the case "Microsofts position was that this is a feature, however IBM released a patch early this morning that corrects the behavior for thos who don't share Windows design goals with MS"
MS hires very talented young programmers and traps them in corporate bloat and arrogance. The current XP problems are mostly due to the insistence on backwards compatibility and constant recycling and cobbling of code. I can't imagine how longhorn will not continue this trend. It's regrettable no competition is in sight. Capitalism can't seem to embrace open source, thus the problem with Linux. Apple can afford to be a little more daring due to the mindset of their user base, but MS is mired in conservative practices.
Maybe Microsoft isn't sloppy!
Maybe Windows has simply become impossible to fix?!
And if it's impossible to fix, it must logically be impossible to add any more "Microsoft features" (ah well, the good with the bad)!
If Microsoft is to be considered "sloppy", the sloppiness must have occurred decades ago when top Microsoft management (i.e., Bill), laid down by decree the philosophy of design of Windows (or maybe the philosopy of lack of design)!
The first thing I did on this page is Ctrl-F, type Micro$oft, and hit Enter. Second post down! New record!
Well, I learned something. Apparently, for some time now, Windows XP has been completely willing to execute executables that do not have an executable file extension. For example, if you rename notepad.exe to notepad.gif, you can "CMD
The point?
Those of us using RENATTACH on our mail servers to filter out malware and viruses now have another hole to plug.
Thanks, Microsoft.
Dorks.
"Lawyers are for sucks."
- Doug McKenzie
This requires some physical access to a system to be infected should someone try to write a virus. This is not a critical issue. Saying that a massive virus attack will come from this is like saying that Single User Mode on a Linux or UNIX installation is a security risk. If someone else has access to your system, its not your system anymore.
With Service Pack 2, Microsoft introduces a new security feature which warns users before executing files that originate from an untrusted location (zone) such as the Internet.
One definition of insanity is trying the same thing again when you know it won't work.
Attention, Microsoft: you have been trying to make this fatally flawed "integrated browser" concept work reliably for over seven years, by adding twist after twist to this flawed "zones" model. The only component of the system that can know whether a document should be trusted is the application that requested it. THAT is the component that needs to be responsible for deciding how to handle its content.
Remove the access components from the HTML control and make it purely a rendering tool. Use a mechanism like callbacks to the application to handle embedded objects, links, and helper applications, and make that application responsible for its documents. This is a security model that works, the one you're trying to create to shore up your original design flaw doesn't, and can't.
People have been telling you this for years, you've been in denial for years, GET OVER IT.
Anyway linux isn't anymore secure or insecure then windows. It is just that most linux users got a tiny bit of a clue. But a cluefull person could also be able to setup a secure windows machine.
I keep waiting for MS to be really smart and adopt a more gentoo like approach to new windows installations. A very real problem is that a new "legal" installation is unpacthced and will not survive long enough to download patches. But this is only because MS doesn't have "download latest software" stage in its installation.
Let me explain. The entire windows problem is that it has software with security holes in listening mode before you are fully patched. When you install gentoo you download a sorta up-to-date CD with a very basic linux install. If you boot the CD you got a working linux cli but nothing extra it won't be running any listening services. So even if the machine is connected directly to the internet there is no way to attack it. No software listening to ports == no way to attack. Only way to install a listening piece of software is to download the latest fully patched software and run it by choice.
So why does MS not do this as well. A new Windows install doesn't open any listening ports UNTIL it has downloaded the latest patches.
Well the answer is of course probably very simple. It would make windows look "hard" to use. MS loves to promote the image of a click and drool OS. While the unpatched listening software is a problem just as big a problem is that the average windows user will click and drool on anything.
Note my use of "legal" installations. If you bought XP then you got a CD that when installed will give you a totally insecure system. If you pirated XP then just download a version with the Service Packs included. Yet another case where piracy really pays.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
If Microsoft is so "concerned" about security in Service Pack 2 and a firm like Heise Security is so quick to not only discover the flaws, but announce them as well... Wouldn't it make sense for Microsoft to submit their major updates to a security firm before making it available to the public, and suffering the subsequent criticism?
My wife and I both own 3G iPods (connected via Firewire) and using the latest firmware.
No problems under Service Pack 2 whatsoever, though Windows Firewall did fuss about iTunes wanting to connect o the Internet.
From my experience, many of the times when an OS/feature breaks from a service pack installation, it's because the user's PC was already damaged by corrupt files, registry entries, or"tweaks". The Service Pack simply exposed them.
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
Is the patch compatible?
\m/
- What the US government has to say about IE security
- About Windows security vs. Linux security
- About 'Total Cost of Ownership' (TCO) statistics
How much more proof do you need to stop using Windows?Is anyone else experiencing problems with the Windows Update v5 site? I've tried using it on a SP1 machine and two SP2 machines, and the only one it works on is the SP2 machine that was just reloaded and had SP2 applied.
SYS 64738
This "deep" work is pathetic. In more than a year, all they can offer up is 80MB worth of binary improvements? An organization like KDE can produce that kind of change in a week with real feature changes. M$'s little service pack is poorly reimplemnting band-aids that other people, like Zone Alarm, made two years ago. No real changes are involved here and no real increase in security will be had. It's just another annoying user inconvenience in the never ending upgrade train.
"it also turns people away from using the Internet because they get too scared of what's going on there"
Good. I still maintain (no troll, no joke) that the internet was better off without AOL connected to it. That was the beginning of the end AFAIC.
I'm surprised. I'm mean, why wouldn't you expect that SP2 would have new vulnerabilities? Any system has flaws, SP2 is not less. It was a matter of time. What is *important* about the SP2 is what it does to *solve* the security issues. Automatic update. Firewall enabled by default (no worms for those system services which are always open). When a program tries to "listen" in a port, a windows popups to ask yoy what to do with it (this means you can't have a trojan wiath a remote shell in your system without noticing it - how many linux distros / BSD systems take this approach, eh?) Well I don't need to list all features. It was quite clear (at least for me, not for the slashdot crow though) that SP2 was going to have vulnerabilities. What is important about the SP2 is that it solves them instead of leaving you a big hole.
Pretty soon we'll have Longhorn exploits coming out.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Win95 - ground-breaking. Paved the way for the GUIs in use in every subsequent windows version, and lots of *nix guis
Win98 - great for games (still is), supports the latest DirectX (still), has a very small footprint, boots fast and offers great hardware support
WinME - disappointing for some, exceedingly usable for most others. Say what you will, lots of people loved it
Win2000 - fantastic. Offered stability, great driver support, great networking, easy installs, perfect for the corporate environment (hence most places still using it)
WinXP - incredible. We're talking excelleng games/multimedia support, almost unlimited software catalogue, integrated auto-updating, visual themes, etc. etc. etc.
XPSP2 - a great step in the right direction, executed very well. If you can find fault in it, you can find fault in anything
2003 - One of the best server operating systems out there. Exceedingly fast, secure, stable, yet with great driver support, lots and lots of software, etc. Again, if you think it's bad there's something wrong.
At least get your arguments straight. Just because you label something as "disappointing" doesn't instantly wipe out the popular history that it was anything but. I know you have your head in the clouds, but even that shouldn't stop you from recognising truly important software.
I've several games and apps on this list:
http://support.microsoft.com/default.aspx?kbid=
However info about it is scarse. Apparantly this list doesn't include the "open the firewall" programs, but does sb know what the problems are exactly? (UT, UT2003, Nero)
Microsoft is a bit scarse in info.
Just took the plunge and installed SP2 on my lin/win dual boot box last night and everything appears to be working just fine, and does seem to be "snappier" as some suggest. Fixed my WMP9/DivX video playback lock-up, too. I've got my family off the IE and Outlook teat, and onto Firefox/Thunderbird, but still can't quite get the Mrs. to give Linux a fair shot (when it's up and running on the box, she has figured out how to logout and reboot back into XP, though!) -- so as for me and my house, SP2 does seem to be an improvement speed and functionality wise over SP1. Even played nice right off the bat with ZoneAlarm suite. And if it can get more people to run a firewall, then, really, even for slashdot, how is this a bad thing?
Win95 wasn't all that ground breaking if you'd been using Amiga Workbench for years before. Most of the stuff 95 did was already done, and 95 still didn't do some of it as well (e.g. pre-emptive multitasking).
I didn't really take windows seriously until Win2K, which is simply incomparable with any of the 9X/Me versions.
Under windows you don't have to run as admin.
Under linux you can run everything as root. (actually a few programs detect it and refuse to run but that is besides the point.)
About the only difference is that it is a whole lot easier under linux to work as a user and if and when you need root to simply open a terminal and become one. Please note that this may be out of date but I remember that in windows if you need admin privileges you need to logout and switch to the admin user. You can't open an admin session within your user session.
But just as windows has a lot of programs that don't "work" when you are not the admin there are a few to many linux programs that like to have sudo. If a clueless person was told that cool new game needed sudo do you think that would stop him and ask, hmmm why?
So apart from making it easier to run as a user and root only when needed and without having to close your current desktop (think about how importance this is. I browse a website for some admin help. I find out how to do it. but learn that I need to become root/admin to do it. On linux I simply leave the browser open running as a user and open a terminal and become root then do the instructions from the webpage. On windows I gotta logout/switch loosing me the webpage and then log in as admin. I then gotta reopen the webpage the BROWSER RUNNING AS ADMIN and then do the instructions. But NOW THE BROWSER IS RUNNING AS ADMIN.)
But a clueless person can still screwup his linux install. Never underestimate stupidity.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Alright, now if I understood previous statements, the RTM version that's out now gets sent to OEMs like Dell and such. Now, if your statement is correct, wouldn't that mean people who buy a new Dell would have something like-but-not-quite SP2, whereas someone who waits for the gold version will have the "real" SP2? (Yes, I know those terms are kinda loose, but the entire notion, if correct, is boggling. It's one thing to have beta/release candidates, but once you release something, whether you call it RTM, gold, whatever, it has to be frozen, otherwise you can't be sure what you've got.)
Here's what people tend to overlook- if you get the same quality software for free, why are people paying $200-$350 for WindowsXP? The saying 'you get what you pay for' doesn't appear to hold true in software.
When I make software for other companies as a part of my line of work, every check possible is done to ensure that the software is secure is possible. There are tens of thousands of dollars on the line, and customers demand quality coding and care taken to ensure that their data is safe.
With open source, there is no incentive- nobody to answer to when you screw up. Many projects seem to stem out of the 'I made a utility for my own purposes that...' and grows from there.
Now back millions of copies of XP with hundreds of dollars a piece. People are paying you for a reason- to take care of security and usability and hardware support for them! Can't even do that right.
So I'm going to pay you to build me a kitchen, but you can't seem to put my shelves in straight... yes it works as a shelf- just as long as nothing rolls. You should be coming back to fix my shelf post-haste, as it never should be like that in the first place.
when you see the word 'Linux', drink!
Read Microsoft: A matter of trust from the same author mentioned in the Slashdot story. He reported a bug, and Microsoft told him it was a feature.
Linux is buggier than windows! it never gets patched! Microsoft says so, so it must be true!
Seriously, though, This just shows microsoft doesnt do thorough testing, or any testing at all, they dont try to use hacker tactics to break a system, they need to hire a few good crackers and hackers to blast a system they patch to see what happens before releasing it.
The only time this happened with linux was a while back and it happened (the whole 2.4.20 - 2.4.26 release thing because the same bug kept showing up) I havent seen it since.. though the linux devel team is beginning to become like M$, merging development crap with the stable kernel producing unknown results, like how microsoft releases buggy quickfixes to their system with obvious little testing or regard for the user's system.
ok bad analogy but you get my point.
I'm sure some real security holes will turn up but the two flaws mentioned in the post are pretty lame. One requires that a user save an attachment, open a command prompt window and drag and drop the file into said window. I help people with their computers over the phone all the time and they have trouble openning a command prompt (run>cmd) and probably wouldn't accept that as a reasonable thing to do with a file they've been emailed. Maybe I'm giving too much or too little credit to most users but the second "flaw" doesn't even have a valid attack vector according to the article. These sound to me like ways someone might screw up a computer if they TRY but they certainly don't seem like OS problems since both would require the user to do some pretty dumb things.
Steps to reproduce: ... so that the *.adm files get updated - e.g. ENABLE domain-wide apply to all network connections in Network Connections / Windows Firewall, on the patched machine, as
1.Install SP2 on a windows xp machine, part of an AD domain.
2.Access and modify some group policy objects
3.Try to do the same on the domain cotroller, a Win2k machine...
4.Watch mmc truncating about 500.000 help strings, cause this version of mmc (win2k- sp4) only takes 256 characters in a help string.
Press OK about 500.000 times.
5.Give Up. CTRL + ALT + DEL. End TASK NOW. Go Home.
As usual, missed the point.
Linux kernel coders don't have to worry if the user is going to play downloaded p2p muzic - or watch a hooky dvd - or even care if they play it on whatever player - all they worry about is coding a solid kernel with all working.
Now look at M$ coders, and 50% of their objective is the CONTROL of the users so that he can't play DRM'ed music or can't use a DVD player or use this bit of software or don't use it due to this * etc. etc.
Because Linux is 'free' (as in the user is allowed to use the thing for whatever purpose he/she sees fit), the actual coders only have to concentrate on making it work _all correctly_...
I think some UNIX vets are confusing the Windows implementation of the command line and UNIX's. In UNIX they're pretty much identical in terms of functionality. In Windows that's not the case.
Example: yesterday I tried to FTP from a Windows 2003 server to another box. For the sake of speed, I tried using IE as my FTP client. Windows 2003 locked down the box by default, so that client wouldn't work without tweaking IE settings. However, I tried the Windows FTP command line app and it worked fine.
The "safeguard" described in the article really isn't meant to be a safeguard at all. It doesn't follow any of the low-level security features that the system provides (like permissions). It's just a quick tag for Joe User to remember that a file was downloaded and not placed by them.
So far.
But I agree with the premise behind your point.
.
uR iGn0ranc3, Their Power
Actually there is something kind of like sudo that's been in windows since 2000 called runas. It doesn't always work as expected, but for the most part it is useful. Open a command line and type runas /? to see how it works. I just wish it was more consistent across the system. Sometimes you can right-click on an executable or shortcut and you get the runas context menu item, then sometimes you don't! In those cases you have to execute it from them command line. I've actually even seen some installers prompt you for login info if you're trying to install it under a normal user account.
I use it to control services that like to crap out all the time on users machines, like the print spooler service; said user has their printer shared, and like 50 different applications open, and of course they've went on break without saving anything, and everyone's too lazy to use the printer in the print room, so I right-click on the services icon in the control panel and login as myself to run the services control panel under the user's account (whew! longest sentence evar!).
Sometimes I launch iexplore.exe using runas to do various tasks like changing file permissions and stuff. Just don't try to launch explorer.exe using runas!
grep -iw skynet
I don't get it. The guys at microsoft want at least 99 euros for the XP Home Edition. Obviously this is for HOME users, without a company administrator to look after them. Nevertheless XP's handbook consists of a short quickstart manual on how to install the os. shouldnt microsoft *admit* that they know that the internet can be dangerous for inexperienced users and offer a short guide on what to look out for and how to configure XP to be as safe as it gets?
Well, like the Good Book says, it's all been done before. What it doesn't say is, MS makes it easy.
Sure I'm paranoid, but am I paranoid enough?
Why didn't you get a '-1 redundant' mod ?
--LordPixie
I have respect for folks who can find buffer-overruns, heap-mangling attacks and so forth. These people are smart, hard-working and diligent. They give evil a good name.
:-/
I have nothing but contempt for someone with an axe to grind whose only response is the "exploit" in the linked article. It's pretty lame. Come back when you've written enough of your own code to present an attack surface.
Grow up. Sheesh.
Any sufficiently advanced technology is insufficiently documented.
Sure, it was a good OS, but it wasn't anything special. It definitely didn't step on 9X's toes :)
>Yes, you can do something convoluted to get something to misbehave (save the file, open up a command prompt, run the file) etc, but seriously, if a normal user does this, then they are beyond help that we can expect an OS to provide.
You're right, of course, but it's still useful to know the limits of a security feature, and I can imagine a situation where Juergen's discovery would make a practical difference.
Imagine another vulnerability getting discovered that allows an attacker to make a user think that an executable is a JPEG. Then SP2 would protect against the social-engineering attack of "Save this picture of Anna Kournikova and double-click!".
What Juergen discovered is that this protection may not be there when you need it, e.g. if the social engineer says "Copy this picture of Anna Kournikova over your current 'wallpaper' file and double-click!".
Bad guys today are using chains of vulnerabilities to bridge our moats. The attacks are called "blended" but a chain is a better metaphor. Juergen found a way to add one link to a chain of exploits.
>if a normal user does this, then they are beyond help that we can expect an OS to provide.
Ridiculing Microsoft over this would certainly be inappropriate. But it's worth knowing that the warning on downloaded executables is bypassable.
We can only expect an OS to help if we abandon Discretionary Access Control.
The problems are obvious if you are a programmer. If you are a programmer, the problems are so obvious that you may fail to mention them. Microsoft has known for years that their Command Line Interface has not been updated to the standards of the OS. Yet they continue to put out tools that ignore the new standards, as they did in the case discussed in this Slashdot story.
The Win XP Command Line Interface is not fully integrated. The lack of integration of the CLI is extremely serious. In some cases, there are commands that take you inside 16 bit code, where the OS loses control. There are many, many bugs. For example NET USE LPT1: [printer share name] does not work for users with limited rights. Not only does it not work, it fails in several ways that show that there are multiple problems. This was reported months ago, but it has not been fixed.
See my comment in another story for more about this: Many command line tools are not fully integrated.
Microsoft knew there was a problem, but did nothing. There is another extremely serious problem here. Microsoft programmers knew that the information is cached (See the story.), and that the method of caching introduces a bug, yet they did nothing about it. (If you are a programmer, it would be impossible not to notice.) That is something I've seen many, many times: Microsoft accepts code that everyone can see is not finished.
My original comment, In general, Microsoft seems sloppy is correct, and should not have been modded down. It is definitely not "Off Topic", as it is moderated now.
When was the last time you went to an important meeting and said nothing? This is an example of problems with Slashdot moderation. When was the last time you went to a meeting or a party, and said nothing? Generally, if there is a discussion that is important to you, you will want to contribute. This Slashdot story is of interest only to people who understand Window XP and security risks. But moderators cannot moderate stories of interest to them. They must moderate stories in which they have so little interest that they have nothing to say. That's how my great-grandparent comment could be modded down as "Off Topic", and the "Microsoft bashing" reply is +5 Funny.
Another problem with Slashdot moderation is that by covering issues about games that are of interest only to players and spectators, and not programmers, Slashdot attracts people who have no real interest in computing. Look at the beginning comments of most Slashdot stories. Many of the comments are from people who have no interest in the story, but are trying to be funny. Humor is wonderful, but not at the expense of the quality of the discussion.
Actually, what REALLY happened was:
Evil Hackers: Hmmm take a look at this. MUAHAHAHAHAHAH!
All the world's hobbits, ignorant of their approaching doom (singing): *La la la la la!*
Whitehat guys: Hey, there's a security vulnerability here!
Microsoft: *whistling* what? I didn't hear you!
Whitehat guys: I TOLD YOU THERE'S A VULNERABILITY!
Microsoft: It's not a vulnerability. You're exaggerating.
White hat guys (screaming): HEY EVERYONE! THERE'S A VULNERABILITY IN WINDOWS!!!
The Media: We've heard some rumors of some vulnerability in Windows...
Microsoft: It's just rumours. Anyway, it's those linux cheapstakes, would you believe them?
Evil Hackers: MUAHAHAHAHAHAH!!!!
(couple of months later...)
All the world: My computer's been infected!
Evil Hackers: MUAHAHAHAHAHAH!!!!!!
Microsoft: OK, OK, so there WAS a vulnerability! But now's been fixed!!
All the world: Yay!! Hooray for Bill Gates! (they put him in a pedestal, and proclaim him savior of the universe)
(Two weeks later...)
Evil Hackers: Hmmm take a look at this. MUAHAHAHAHAHAH!
Whitehat guys: Hey, there's a security vulnerability here!
Microsoft: *whistling* what? I didn't hear you!
Billy Joel (singing): *We didn't start the fire...*
This is what, the fourth SP2 article in two days? Look, we get it already, OSDN wants you to disregard SP2. Every single other place on the web, feedback has been extremely positive. If you come to Slashdot, it's almost entirely negative. This place is like a bizarro-Fox News of the tech sector.
And if you slapped Windows Me on an old P-166, it would detect everything, too.
It's got nothing to do with Windows XP's plug n play at all. You ever tried swapping out a motherboard with a different model on an XP system? Frequently, if not most of the time, it craps out, and won't even boot properly. You'll need to do a system repair with the CD to get it to work.
Windows 9x actually handled this situation a lot better than 2K/XP does.
And incidentally, Linux (but Linux isn't plug n play....hack around...text configuration files....modprobe drivers....cryptic....CLI...difficult) seems to handle it the best of anything I've ever tried.
"City hall" in German is "Rathaus" Kinda explains a few things......
It never ceases to amuse me to see the continual bashing of Microsoft on Slashdot. Yes, Microsoft has some major security issues to work out. However, they are making a fairly good faith effort to do this now. Service Pack 2 was a decent attempt. Yes, there were bugs introduced by Service Pack 2. But even Linux has bugs every once and a while after a new release.
If you really must discredit Microsoft, at least do it on fair ground and acknowledge that the operating system(s) you hold dear also have some bugs. And please, do not call them Micro$oft, M$ and other lame variants. It is Microsoft Windows, not Micro$haft Windblowz. If you can't even have the common decency to refer to somethign by the proper name, then nobody worth listening to is evey going to take you seriously.
If you want your community to be seen in a decent light, then you must behave decently.
Beware, Nugget is watching... See?
More about the Windows XP printer redirection command NET USE. There are many people who have intense ego involvement in seeing themselves as people who understand Windows software, but who have little real interest in computing.
After re-reading my comment above, I realize, from past experience, that it is likely that there will be extremely strong replies that give the impression that the writer knows a lot, but which are completely uninformed.
By design, the NET USE LPTx [printer share name] printer redirection command works only for users with administrator rights. This is fine. There are three ways that a command can be executed with administrator rights for the context of a user with limited rights. All of them fail. The failures are not clean; the failures are such that they indicate that there is a mess.
OK, now we've got something to discuss.
:(
:)
The problems are obvious if you are a programmer. If you are a programmer, the problems are so obvious that you may fail to mention them. Microsoft has known for years that their Command Line Interface has not been updated to the standards of the OS. Yet they continue to put out tools that ignore the new standards, as they did in the case discussed in this Slashdot story.
The Win XP Command Line Interface is not fully integrated. The lack of integration of the CLI is extremely serious. In some cases, there are commands that take you inside 16 bit code, where the OS loses control. There are many, many bugs. For example NET USE LPT1: [printer share name] does not work for users with limited rights. Not only does it not work, it fails in several ways that show that there are multiple problems. This was reported months ago, but it has not been fixed.
I think that the problems stem from the command line, and the DOS heritage that it represents, being shoved behind the scenes where most users will not see it, as well as being sealed inside its own little virtual machine for the most part. Slowly but surely, as Windows 9x gave way to 2000/XP, and in turn to 2003 Server, the gap between the command line environment and the rest of the Windows subsystems has gotten wider and wider, either because nobody though to try and reintegrate the two, or because they assumed nobody other than a few power-users and admins bothered with the command line anymore.
To be honest, a complete overhaul is required - a lot of the old DOS utilities are redundant at best, downright dangerous if misused.
Microsoft knew there was a problem, but did nothing. There is another extremely serious problem here. Microsoft programmers knew that the information is cached (See the story.), and that the method of caching introduces a bug, yet they did nothing about it. (If you are a programmer, it would be impossible not to notice.) That is something I've seen many, many times: Microsoft accepts code that everyone can see is not finished.
*shrug* So no change there, then, in spite of all the talk about improving security and fixing bugs in Microsoft code over the last few years. No disagreement with you there.
When was the last time you went to an important meeting and said nothing? This is an example of problems with Slashdot moderation. When was the last time you went to a meeting or a party, and said nothing? Generally, if there is a discussion that is important to you, you will want to contribute. This Slashdot story is of interest only to people who understand Window XP and security risks. But moderators cannot moderate stories of interest to them. They must moderate stories in which they have so little interest that they have nothing to say. That's how my great-grandparent comment could be modded down as "Off Topic", and the "Microsoft bashing" reply is +5 Funny.
Sadly, a majority of Slashdot users (and moderators) understand neither Windows XP nor security.
Another problem with Slashdot moderation is that by covering issues about games that are of interest only to players and spectators, and not programmers, Slashdot attracts people who have no real interest in computing. Look at the beginning comments of most Slashdot stories. Many of the comments are from people who have no interest in the story, but are trying to be funny. Humor is wonderful, but not at the expense of the quality of the discussion.
And the trolls, mustn't forget the trolls - another fine Slashdot tradition...
Sorry if I appear to be rushing this, it's nearly time for me to pack up and go home. Talk to ya again some time.
-MT.
-MT.
Asking the user delete folders still causes them to be deleted. What sort of exploit is this, anyway?
Win9X borrowed a lot from Workbench. I was just pointing out that its hardly groundbreaking when what it did had been done before.
;)
It only seemed "groundbreaking" because Win3.X was so hilariously crap
Heh.... Where I come from Amiga was never available. It seems to me that the Amiga failed because it wasn't very widespread, something that Windows had over Apple.
-]Phreak Out[-
Yes all 5 amiga users were very happy.
For a i386 PC, Windows 95 was groundbreaking. Kludgy, yeah, but miles ahead in interface, stability, and multitasking from Windows 3.x.
Please limit your comparisons to OS's released within 2 years of Win95, and having a market share at least one tenth of Windows (see I give the MacOS, which is great, but was kinda languishing at that time)
LRC, the best-read libertarian site on the web
Funny, kernel.org has looked something like this for months now:
The latest stable version of the Linux kernel is:2.6.8.1
ok, you challenged for a conversation, so here it is. i'll start off by telling you that while i do develop software, i'm not an expert and you probably know more than me. however, upon reading the article i think that the author blew the issue (not about adodb stream) way out of proportion and i can absolutely see why that would not be a high priority fix. if it was transversed and Explorer was allowing unsecure applications to run as secure because at some point in time the same name/signature was cached for a secure program, then yes, they should fix that, but that's not what the article said. now, granted that i really don't know a whole lot about the specifics of Explorer's operation, i'm completely willing to concede that this is an a=b therefore b=a situation, but the article did not mention that. the focus was on secure programs running as unsecure due to caching. does this make any sense? probably not, but oh well..i'm still learning.
Those who can, do. Those who can't, go into business for themselves.
...the main reason to install SP2 is because you have too much harddrive space, and wish to use some of it. Not because you'll get something you couldn't get it a tenth of the space.
If Google really cared they would fix Android Chrome to reflow text, instead of discriminating
All this discussion about the failings, past & present, of Microsoft are relevant but fail to miss one big issue...the users. You can lock down a system as much as you like and make it harder to get into than Fort Knox but if there is a way, any way, for clueless users to screw things up they will find it. Writing secure code, issuing patches and updates etc will help alleviate the problem but until we can educate users to take security seriously we will still have problems. Despite all the reports about viruses, malware, trojans and other nasties there are still too many users running insecure systems. The best we can hope for is that closing the security holes as they become known is that it will stop these infected machines from infecting other systems. Sure, developers have a duty to write secure code and not leave holes that can be exploited but they cannot program for every act of user stupidity. Just when you think you have an 'idiot proof' OS or application a bigger idiot comes along and proves you wrong.
One day I woke up and saw all my rights had disappeared, that's the day I knew the terrorists had won.
In other news, the ability to execute programs leaves you open to malware. The hole is in the article author's head
Make a difference - use Windows! (open source clone of Windows NT)
Sendmail isn't installed on >90% of the worlds desktops.
Sendmail isn't advertised and sold as a secure and straightforward system for home users.
Sendmail bugs are hardly news for anyone, particularly not nerds.
I'd call this news, SP2 is being hailed by Microsoft for its security features so it seems fair to report any issues with it.
Actually sorry, I'd misread it as being something other than a lame social engineering hack. On second readings I agree its hardly news.
Win 95 - nearly achieved the same level of usability that Apple did five years earlier.
Win 98 - OS starting to grow - makes greater demands on hardware, requiring upgrades.
Win 98SE - nearly right - fixed many of the flaws in the original, and at least they had the guts to admit the first edition was a disaster.
Win ME - best forgotten - too many flaws to list, obviously rushed to market.
Win 2000 - NT4 with knobs on. Pretty OKish, but too insecure for serious use, and had many driver issues.
Win XP - nearly works out of the box. Too many security flaws to list, and inherently unstable. Might be OK for the casual home user, but the business user needs something more reliable.
XPSP2 - broke both my standard XP Pro installs to the point of no return. Now deleted!
Server 2003 - don't go there. The subject of much litigation from disgruntled MS clients. Insecure, unstable, overpriced, not scalable.
THERE HAS TO BE A BETTER WAY......
One of these SP2 "flaws" involves sending the user an email with instrucitons on running an attachment from cmd.exe. Well, if we follow the logic to its end, no OS can ever be secure. All you have to do is send the user intructions on disabling their OS's security features and wham! The OS is compromized. These "flaws" are a joke.
The linux equivalent would be sending an email and suggesting the user login as root and run the attached script. Uh oh, Linux is just as insecure as windows!!! Panic!!
Give me a break. According to this article, I'd say linux users are much more vulnerable because it'd be much easier to convince a Linux newbie to run arbitrary_command and do whatever you'd like to their system.
Get out of your cabin more often.
Its getting released on Wednesday 25th August.
stuff breaks, it's going to happen. if it was perfect what would you do?
With the flaws presented on www.heise.de, I'm discovering that Microsoft has based one security features on the (so far) little know ADS, implemented in NTFS but never used before. To me this looks like a very bad kludge. The ADS allow the association of data to files, it's invisible only to the average user, but it's not a secure feature ! (probably a reason why is has not been used for DRM ). I don't think it won't be long before malware writers will not only irremediably defeat the security feature, but even use it for hiding stuff on their victim's PCs.
You could not be more completely wrong. The RTM (release to manufacture) code IS the fine "Gold" code. That's it. Period. One SP2.
To update a poster.
I read a few posts about permissions and how the distro lindows runs everything as root. That is incorrect since that never was the case. The earleir versions of lindows alowed you to create an end user for your machines. It juts has become more notesible during the install processess.
I've never seen nor been on nor seen any user run EVERYTHING as root.
and yes Linux is secure compared to windows by default.
Stupidity or not. You can't always use
its the endusersbadhardwaresoftwares fault. Especially when its M$ that keeps making the same mistake over and over again.
But if you want to talk about stupidity, all you have to do is look appon the many that still believe that M$ is still doing a 'good job' with the amount of evedence against them.
The same procedure happened to WinXP SP1.
People like you give other people the wrong idea, no disrespect but that's the way it is.
No, you got it wrong - you're supposed to install SP2 and bash Microsoft for producing insecure, buggy software. :)
:D
Look on the bright side, at least on Slashdot you don't have to actually see the editors. From what I've heard, this may well be a good thing...
-MT.
-MT.
RTM version is offered to OEMs so they can start the production line. By the time the real pc is on the desktop of end-user, There are other minor additions in designated SP.
Which will be updated as soon as end-user connects his pc to internet by Automatic Updates Service which will notify Windows Updates V5 Website of RTM label, then Windows Update Website V5 will adjust the updates level to comply with RTM Standards and finally will remove RTM version from winver and this means PC is upgraded to Full SP and from then on will be treated by Windows Update Website V5 accordingly.
#1) Commodore had a huge market share back in the day. The largest market share at the time.
#2) The Amiga OS is still being developed: http://os.amiga.com/
#3) It took years for the competition to catch up with the Amiga. The last Commodore Amiga release was October 1993. Amiga is now owned by someone else, but they are still around. It was a kick but system.
XP is better than the Amiga, imo. But my next system will be a Mac. I will keep my W2k station, but I am tired of playing the patch/firewall/hardware firewall/antivirus/patch/spybot/adaware/patch game.
Despite your great enthusiasm, this is just plain wrong. SP2 has been released and it's code is final. It is NOT still being working on or tweaked. The version on MSDN and RTM and RTW and sent to premiere customers and automatic update is identical. If you install a MSDN version and go to Windows Update it will NOT attempt to update you again, nor will automatic updates.
I'm sorry but you are wrong. SP2 is done. The code is final. They are working on SP1 for 2003. You are discussing release times.
I know all about it. The bracketed objection list was the random rants you hear from anti-Linux FUDsters about why you shouldn't run Linux. It was not my opinion.....
"City hall" in German is "Rathaus" Kinda explains a few things......
SP2 WILL be final when u can order a WinXP SP2 CD. Before that, there are builds and builds.
SP2 IS Final When you can order a SP2 CD. Before that there will be other builds to come.
When I set up my grandma's PC (running WinXP), I set her as a User and setup an Administrator called "Installing Software" for occasions when I would have to let her have admin. "Installing Software," designed after a great idea I saw on here, has a bright red background (locked with policies), reading "WARNING! WARNING! WARNING! Only use this account for installing software! Click Start, then "LOG OFF" NOW!" All the UI elements are white/red, or yellow/black, and about one size bigger than would be comfortable. Every system sound event is mapped to the "Critical Battery Alert" sound (which sounds like a computer's version of "OMG") so that every menu click, opening or closing program, etc. triggers the noise. iexplore.exe is also chmod 000--even if she could stand using that account any longer than necessary, no iexplore! (Firefox is her default browser, but I've got all the bases covered anyway).
Oh, and the Video Poker game I got her at Kmart (which has a Linux version on the same CD, so you'd think the developers would have a clue) crashes on opening if you're not an administrator. I worked around that using runas.exe.