Slashdot Mirror
Microsofts "Honeymonkey" Project
g0bshiTe writes "Ever hear the saying, 'given enough time a room full of monkeys could type out Shakespeare'? Well Microsoft seems to be taking this saying to heart, and taking a cue from the Honeynet project, they have created what they have dubbed 'honeymonkeys.' Security Focus has an article which describes this honeymonkey network, which is little more than a network of virtual Windows XP boxes in various patch states. These boxes are setup to crawl the seedier side of the web in search of vulnerabilities not bieng reported, and are being actively exploited in an attempt to further secure their product. Sounds like a decent idea from the Redmond crew to me."
they call these guys "customers" over in redmond ...
IAAL
I'm sure "honeymonkey" is a euphemism for something. I'm just not sure what. You dirty honeymonkey.
*GENERIC JOKE ABOUT MONKEYS BEING IN CHARGE OF MS WINDOWS SECURITY*
Just thought I'd head everyone off here...
(lameness filter padding lameness filter padding lameness filter padding)
I always assumed Skynet was based off of Windows XP.
In addition to getting info on new vulnerabilities, they'll probably also get loads of malware to add to the anti-spyware tool. This is a good thing.
Sounds delicious.
But the real reason they named the project this is because they intend to sting you like a bee and then throw fecal matter at you.
This is a pretty good idea. If anything, it will help curb the script kiddies indesciminantly flinging exploits around. Unless you want that overflow you found to get patched, pick and choose your targets carefully.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
It looks like the monkeys aren't only working on Shakespeare...
Comment removed based on user account deletion
This is actually a pretty good concept. I have my doubts that there are many exploits that are being actively exploited that aren't known about at all, though, which seems to be what they're banking on.
Isn't honeymonkey a dish in Africa?
Did the sun rise from the West?
Sort of.
A good idea from the MS guys is a really rare thing.
And as such, it is certainly worth the praise.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Queue the typical Slashdot groupthink about how Microsoft is somehow evil/stupid for doing this.
Actually attempting to use their product as if they were an end user in the wild of the internet. Seems to me this shows that Microsoft is definately moving towards a more security conscious mindset.
I like to call it, "break time"
"Oh, you hate your job? There's a support group for that, it's called everyone, they meet at the bar."
Why are they in various patch states? If you are looking for unknown exploits, the latest patchlevel will be just as useful, and you won't spend your time with millions of false alarms when known exploits get a hold of them.
This group has done several impressive projects. Among them is the "Strider Ghostbuster" Rootkit Detector.
This is part of the general Strider Project in Microsoft Research. They do very good work.
Test your net with Netalyzr
Put these honemonkeys on a network with a bunch of other computers running Firefox/greasemonkey, and let them fight it out.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
A roomful of monkeys wrote Windows XP? OK, I'll buy that.
I have nothing to hide. So, why are you spying on me?
Hmm. I've eaten honey. I've spanked the monkey. I've never contemplated doing both at once.
** aycee eyes the honey bear **
A good idea from the MS guys is a really rare thing.
And as such, it is certainly worth the praise.
No its not, from a company that has a 50 billion dollar warchest and can afford to hire the best and brightest, you should expect only good ideas.
Virtual boxen will catch a wide array of exploits, but may miss some. For example, it sounds like they look for attempts to create executables on disk, so a RAM resident nasty might escape notice. Also, some exploits many only work on "real" machines such as those proposed for exploiting hyperthreading.
The point is that to the extent that the virtual XP box fails to emulate ALL the features of real hardware, there will be some room for doubt. Despite this misgiving, I commend Microsoft for tackling this problem.
Two wrongs don't make a right, but three lefts do.
I never thought I'd see the day Microsoft actually did something smart... but the cynic in me can't help but think they'll use this as a way to find all the warez'd Windows Serial Numbers to set up a blacklist at Windows Update.
Now it would be possible for the worm writers to just target Microsoft honeymonkey crawler to fire up the internet.
I thought AOL patented this years ago.
Pre-Monkey Era:
-- someone exploits a vulnerability
-- 2 weeks later someone discovers it
-- half a year later M$ patches it
-- three years later new version of Windows is released and finally the last 80% of users have patched systems.
it took 3 years, 6 months and 2 weeks to patch most computers.
Post-Monkey Era:
-- someone exploits a vulnerability
-- 2 days later monkeys report it
-- half a year later M$ patches it
-- three years later new version of Windows is released and finally the last 80% of users have patched systems.
it took 3 years 6 months and 2 days to patch most computers.
nice PR move though.
This the kind of BS that they will use to claim "PronHorn is more secure!!!" The reality of this would go something like:
1. Set up weak boxes
2. Send them to questionable sites.
3. Watch them get infected.
4. Figure out how they got infected.
5. Report how they got infected.
Then
A. Do nothing, there's "no budget" to fix the problems. (very likely)
B. Modify the code -just- enough to get rid of the worst offenders. (least likely)
C. Charge the end-user a subscription to "protect" them from threats found in their research with another enterprise software package. (my choice as most likely)
In the end Microsoft says, "We've committed billions to increased security in pronhorn. It's more usable and real secure and "just works." Apply more anti-competitive practices liberally and maintain monopoly.
What bugs me the most is it will sound like it's true and kill Linux adoption. But the security patches will just keep coming.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Two simple questions:
1. Are these machines using non-Microsoft IP addresses for their 'net access?
2. If not, how long until the worm authors take that into account?
I wonder if the ??AA is involved in all of this... Who is responsible for all of the illegal data that will inevitably end up on these computers...
Can you imagine one/several of these computers gets compromised and ends up an xdcc server on one of the "seedier" irc channels?
Help a poor college student. Send a couple cents via paypal to chucks86@gmail.com
I wonder how Microsoft defines the "seedier" side of the web, and how the sites the various computers visit are regulated.
/ActiveX|Microsoft\sVM/) {
It would be interesting to run the same test, but equipping half of the machines with an alternative browser.
"if ($body_maintext[$n] =~
$seedy_side_of_web=1;
}
"
Seriously. How many 'great' ideas come out of some over paid monkey's ass each day. It's nice to know about new ideas but what's really nice is to hear about the ones that last a few months and aren't just a marketing ploy.
-Tim Louden
Yeah, and everybody should hold hands around a campfire and sing Kum-bay-yah too, but the real world tends to be a little different.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Here's the first crash
I think they were computing pi.
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Seems like the simple counter measure is a "blacklist" of the honeymonkey servers. Granted the IP addresses of these PCs should be secure but A LOT of info leaks / is stolen / is hacked / is accidentally exposed.
Okay, so they're using virtual PCs but this is just an extension of someone else's idea ... which for all Microsoft's billions is all they ever manage to get to market. Bill Gates claims that "technological miracles cross my desk every week" but he doesn't actually market any of them. Still ... I won't be surprised if this results in Microsoft being issued a patent on the concept of a honeypot, though, virtual or otherwise.
The higher the technology, the sharper that two-edged sword.
so then honeymonkey is just backwards, and more properly monkeyhoney?
"John, did you clean up the monkeyhoney?"
err... eew.
Geez...What is next? Honeybees?
I thought this article was going to say "So they've hired an entire team of moneys to get them to write the next Windows". Infact it's just a load of machines doing nothing. I prefered my idea, much more chance of shit-fights between the moneys.
Suppose Microsoft wanted to come up with a way to get the bad guys to avoid attacking Microsoft. Maybe they could spread the word that a significant range of IP space is honeypots and honeymonkeys and lions and tigers and bears, so then all the kiddies go off and attack someone else.
You could find an exploit that was fixed by a patch you already issued that wasn't applied ...
and then you could issue a new patch to fix that exploit.
I'm sure people who didn't apply the first patch would be happy to apply the second patch. Really. I'm sure they'd be happy to.
Do you have what it takes to hit the (honey)monkey?
the layman's guide to computer science
I found that a bit strange as well. If there is already a patch for it, why study it? I realized though this could actually be useful info. If they realize there is a certain exploit (though already patched) which is getting taken advantage of a lot, they could beat some admins/users on the head. "Hey you REALLY want to apply this patch", there are a number of admins/users who don't stay up to date with patches (not too smart), but its true. This info could help to "convince" these people to patch the machines.
Still seems a bit strange, but I guess having more info about what is really happening out in the wild cannot hurt.
"reality has a well-known liberal bias" - Steven Colbert
Somebody at MS got caught surfing porn/warez and cooked up this 'honeymonkey' nonsense to cover his dirty buttocks.
=Loading=
That's disgusting. I'll be using it tomorrow. :)
Microsoft has just released their much anticipated hands-free cordless mouse. Warning, it may hurt a little at first.
If you're uber-elite, would you target just any machine with your non-publicly-released exploitation?
If it was me, I'd save the big guns for specific sites.
I'd use the common ones to crack the random boxes and use those boxes to map/probe my specific targets.
Once you start hitting everybody, someone will notice and start digging. Then you'll lose your secret toy.
Maybe because they're trying to simulate the real world?
From the blurb: Sounds like a decent idea from the Redmond crew to me.
Sir, you should be taken to the public square and put in the stocks where you will be beaten by peasants for 32 days! How dare you compliment Microsoft on Slashdot? Do you not know that it's considered heresy?
Dedicated Cthulhu Cultist since 4523 BC.
Ever hear the saying, "given enough time a room full of monkeys could type out Shakespeare"?
Never in my life have I heard that saying. Not once, in all of my years on the Net, have I come across any reference to typing monkeys. What a concept!
Better to light a candle than to curse the darkness.
Then, the honeymoon project should not have started after the rootkit detector, right?
Porn? C'mon. Everybody knows that there is no better way to get infected than to google for "Office Serialz" - just try it with a box lacking 3 month of updates ^^
I don't read replies by ACs.
Imagine if MS's honeypot became owned by a bot that brough down another company. Imagine the look in their lawyers' eyes...
Just because good idea (aka "miracles") cross his desk every week, doesn't mean they are ideas worth bringing to market. A good/interesting idea doesn't always make a good product.
:)
I'm sure MS Bob seemed like a good idea, at the time. Certainly an interesting concept. I'm not sure the market was (or will ever) be ready for it, though. Even Microsoft's marketing machine can't turn that much crap into gold.
Let me get this straight. Someone thinks it's a good idea for Microsoft to exploit their own security vulnerabilities in order to poke around on other people's computers looking for someone else exploiting Microsoft security vulnerabilities???
I need someone to show us how to remote install debian on these machines.
That'll show the microsofties.
"Piter, too, is dead."
I'm giving a talk on a similar concept at the upcoming RECON. I call this concept 'honeyclients'. As part of the talk, a BSD-licensed honeyclient prototype will be released. Another person who is doing work in this area is Thorsten Holz, of the German Honeynet Project. His whitepaper is here.
I guess Ballmer should now be singing:
Monkey, monkey, monkey, monkey
Virus! Virus!
Monkey, monkey, monkey, monkey
Argh! It's a spam!
Rediculous is ridiculous!
It takes a Terminator to defeat Skynet. It takes a script kiddie and a buffer overflow to defeat Windows.
FTA: "Just by visiting a Web site, (if) suddenly an executable is created on your machine outside the Internet Explorer folder, it is an exploit with no false positive -- it's that simple," Yi-Ming Wang, senior researcher with Microsoft Research, said during a presentation at the IEEE Security and Privacy conference in Oakland last week.
With all the hoopla a couple years ago about how Microsoft is serious about security, I had ASSUMED they were doing this! The Honeynet project is coming up on 6 years, so it's not as if Redmond didn't see others doing this.
Really, for a multi-billion dollar company, it's inexcusable that they have not been running a honeynet with their product. Oh well, better late than never.
Ruby on Rails Screencast
With all that honey soaked into the monkey's fur, there's bound to be a few "accidents"...
...And it'll probably take microsoft 6 months before they start to clean it all up. :p
...earl-eye in the mornin'? ...put him in bed with the OS from Redmond ...she's so ugly she looks like a honeymonkey...
These posts express my own personal views, not those of my employer
By having tens of thousands of automatically web roaming MSIE boxes, Windows and IE usage figures on the web stay high... these boxes will be able to 'surf' faster than the average human, and will be visiting the kind of sites that have tracker scripts installed...
Is that what Laura calls him?
Eloi are stupid, throw morlocks at them!
Because MS knows their product is NEVER going to be 100% upto date patched and ready.
A side effect of this may be a smaller, more targetted software defense update which could be applied to *all* versions of XP would help more people.
Normal Windows update for pre sp2 computer = ~200mb
Targetted Surgical update = ~10mb.
Both will prevent the trojans and viruses, but one is easier to apply than the other.
liqbase
But since the OP mentioned Shakespeare and monkeys, don't forget to visit the
:)
Monkey Shakespeare Simulator!
Obviously not in a numerical sense, but it seems like an apt enough analogy.
"given enough time a room full of monkeys could type out Shakespeare"
I believe the quote is "If you placed an infinite number of monkeys on an infinite number of typewriters, one of them would eventually produce the collected works of Shakespeare." rather than the grammatical nightmare stated above.
The Infinite Monkey Theorem
Is working with his own kind.... Microsoft is stupid for doing this; if they find one messup I will end my life now!
Honestly, do you even know what you are talking about?
Plugging in a different mouse or keyboard does not make your computer more vulnerable to spyware. All of the problems, and I fully admit that Microsoft has many, are software.
Microsoft spends significantly more on research than most companies their size. I happen to like many things Microsoft does.
On the other hand, I exclusively use linux now on my laptop. Just because of their name, does not mean that we cannot give them Kudos for something good.
Every comment that is highly rated in this thread is a joke. Is this about objectivity? I think not.
Spell check, aisle 1!
It is pitch black. You are likely to be eaten by a grue.
"It was the best of times, it was the ... blurst ... of times! You stupid monkey!"
Or wait, here's an idea: how about I fix the f**king leaks.
There's nothing wrong with a honeypot, but you really don't learn much from exposing systems already known to be utterly insecure.
[1] Even though Microsoft will not be able to find every single vulnerability, this will help them find and fix common vulnerabilities that appear. Since they'll know where the problem came from, they'll also be able to test any solutions they come up with. And there always is a "window of opportunity", but this will help Microsoft shorten it.
[2] According to the description, the network is set up to crawl websites looking for vulnerabilities. If one of the websites infects the crawler, then they will have found a vulnerability. So it could help. In fact, they could also watch for non-browser related exploits, which are commonly used by worms. So in both cases, it very well could help Microsoft detect unreported vulnerabilities.
[3] All they need to do is use IE. If their system gets infected, that's enough to raise an alarm. They don't need matching video cards to see if IE has a buffer overflow in its image rendering module. And they are trying to secure their OS -- that's the point of this research! Discover holes, and fix them. A more apt analogy would be letting people try to break into your car, and then installing countermeasures against whatever techniques succeded.
Sure, it's not the perfect solution (as if one exists), but it's a good idea.
Lame anti-Microsoft jokes and Linux praise.
,Windows has it's uses and strengths just as Linux does, and Mac, and everything else out there running a computer somewhere. It's a toolbox, and you pick the right tool for the job. Do you go around making fun of the screwdriver all day because it's not effective at hammering in nails? No, you grab a hammer.
Really people, get over it. Hey
Given enough time, even monkeys might possibly be almost sort of able to get windows (mostly) right. All in theory of course.
I am Spartacus
Well it is ironic that a company like microsoft who charges for thier product and maintains a warchest places an somewhat inferior product out for sale.
Inferior doesn't exactly mean that windows isn't as good as the alternatives but the coding behind it might not be. At least with free (as in beer) products, this type of initiative has been around and used to make open source software more robust and secure then it once was.
Expecting a company like microsoft with it's large war chest to do somethign like this from the start is a little idealistic. It is somethign that would be done out of necesity. While others would think it is more of a necesity, somethign had to make them think it was important enough to do it.
Maybe the real moral of this story isn't that microsoft has decided to do somethign good rather that microsoft has finaly found enough pressure from enough places to do somethign like this. I don't know if this means that open source product or even closed source alternatives are threatening microsofts business model enough for them to take notice. Or if microsoft has been forced to change its posistion because of other deals. It would be interesting if the reasoning was actualy competition instead of a general concern for product security. Microsoft has alot of things going for it that open source just doesn't. Open source has some thigns too. I think this is an attemp to stop competitors from "outdoing" or tipping the scales of whats going good.
Maybe what Microsoft truly needs to do is hire a bunch of hackers, crackers, phreakers, h4x0rz, skript k1dd13z, and whatever other scum they can find, and pay them minimum wage to sit there and hack/crack Windows, finding vulnerabilities. "What?" you say, "only minimum wage?!" Well, that's not the whole story. Each time someone finds a way to screw up Windows, they will get paid $50. Therefore, most novice skript k1dd13z in junior high should be able to earn a $250,000 salary a year when working 10 hours a week from home.
Sounds to me like they copied this guy's idea:
http://www.malwareblog.com
He's been doing this exact same thing for almost the past year. The site just went up a couple months ago, but he's been sending his findings to AV companies and some mailing lists for much longer. There's a lot of undiscovered stuff floating around out there.
Need Free Juniper/NetScreen Support? JuniperForum
Oh, I agree ... but wouldn't you think that the financial and technological resources of a Microsoft would run to more than Windows XP and Microsoft Office, with or without Bob? Even IBM, as evil a corporate entity as it has been in the past, has been responsible for some truly remarkable advances. AT&T and Bell Laboratories achieved some great things and they were just the phone company.
In terms of technical achievement, Microsoft is little more than a third-rate software company that made its pile through getting in on the ground floor and a stream of shady/illegal business practices, not to mention ripping off any good ideas it happened to come across. Honestly, at times I wonder just how far ahead the computer industry would be today, if Microsoft hadn't achieved supremacy and ruthlessly suppressed anyone and anything that got in its way.
The higher the technology, the sharper that two-edged sword.
I wonder how much more time it would take for microsoft to pour over all those millions of lines of code looking for buffer overflows, which seem to make up the majority of the vulnerabilities we see. I'm guessing that's not very cost effective:)
Besides that, what responsibility does Microsoft have to the community of internet users that could be "attacked" by this honeynet. What kind of analysis they are going to use to find these vulnerabilities quickly and what kind of mitigation do they plan once compromised?
--"It's Bradford Company, slash your last name, dot your first name"
Great idea, Microsoft. This one won't blow up in your face... Not!
Dedicate a few thousand machine to getting infected, and give them access to the net...
I wonder how long until people start noticing that the zombies trying to compromise their systems are located in Microsoft's network.
Microsoft just made the net even more unsafe.
Let the lawsuits commence.
I don't know the meaning of the word 'don't' - J
You can't download it yet, but...
Sysinternals has a similar rootkit detector, instead of scanning the registry from safe media, it does it at a very low level as well as high level, thus it is possibly foolable but still pretty good.
You can get a Knoppix CD and do it for Linux: From within the possibly rootkitted system, MD5sum everything on the disk, reset and boot into Knoppix, repeat the MD5 sum process and look for any differences.
Test your net with Netalyzr
Why is it that I have that Ren & Stimpy song playing it my head?
I don't have to squint too hard before this honeymonkey project, "...which is little more than a network of virtual Windows XP boxes in various patch states", starts looking like the network I work on every day. Remove the word "virtual", call it the usermonkey project, and you're most of the way there.
Your post sounds a bit naive. It's not ironic that MS have the most money, and an inferior product, that is the norm for a company in a monopolistic position. No competition, no reason to do anything better. Just keep the party line.
As far as the real moral of this story, I don't know where you got the idea that MS was trying to do anything good, because the only place you'll hear that is from them and their fanbois, the *only* motivation they have is the competition that has cropped up to threaten them. If that had not occurred, they'd be doing absolutely nothing more than they had for the last 10+ years. Lets just say, MS have definetly noticed Linux, and they are feeling quite threatened... mainly because they have no idea what to do about Linux, because it's not a company, and it can't be bought, or undersold into bankruptcy.
MS have had the market in stagnation for far too long. It's about time we saw some action in the arena. Topple the giant I say.
o stfu. don't hate.
I would like to take a moment to thank you for taking the time and effort to make things better around here. I don't know what we'd do without you.
"not bieng reported, and are bieng actively"
Sorry to nit-pick but...
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
sounds like a good idea, i wounder who they stole it from?
...they don't do something like this already? How does their security team do research, anyway?
"Anyone that has ever gotten an idea based on any of my work and done something better with it-good for you."--J.Carmack
[1] whatever number of machines microsoft uses to "crawl" the "seedier side of the web" , they will NEVER be able to crawl all of it, all the time.
/. anti-M$ comment: In Microsoft's case, I don't think "0day" is a good name for unreported vulns... you know, "1month" sounds a lot better to me.
Yes, because they're not set up to crawl some of the seedier IRC channels you see some untrustworthy figures hanging about and linking flamebait in. This must all be part of Microsoft's grand scheme to find a large excuse to download large amounts of porn.
[2] more often than not, the non-reported vulnerabilities ("0day") are NOT used to mass-attack random IP's. they are used in targeted attacks against specific machines.
generic
[3] running VM's does not emulate all hardware of a machine, and therefore cannot accurately represent an end-user's scenario.
So, Microsoft will not, unfortunately, get the opportunity to say... HELP MY MOUSE IS MOVING BY IT SELF
A Modest Proposal, or not
The upshot is that (1) the rootkits will close the holes they use, (2) the vulnerable machines will be tucked behind firewalls, infected via the web and e-mail, and (3) the bad guys can send bad e-mail to victims, but the honeymonkeys can't.
I'm toast, moving on.
Karma: Bad
Given enough time the monkeys in said room would exhibit two things. First, the Near Misses, i.e. not quite Shakespeare renditions (think "To be or not to be- Hey! Thats my banana!") and the direct hits. And what of the later? Well gven enough time, when you finally open the door on those monkeys, they will be us. And we have already written Shakespeare...
you should expect only good ideas.
Well, that _is_ some quite an optimistic viewpoint. Be that about MS or else.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
Will the day come sometime in the future, when MS will be a security company ? Maybe. The strange thing is, they are looking for ways (like the av and antispy sw acquisitions) to defend a basically unsecure os, and not for ways to make the os itself more secure. My foremost problem with this is, that I don't feel optimistic enough to trust in security questions a company with almost none security-related success stories in their past. But, no doubt, there are many of such optimistic people out there. In the meantime, all their honeys can crawl my home debian for free, given they most certainly will not be able to crawl my work windows boxes.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
and arn't black hats the ones we are worried about most anyway?
Yeah, like Microsoft Bob. Total flop, supposedly worst product ever.
Clippy. Same lines as Bob, computer is smarter than you. Not the best feature.
Windows 3.1 was not the best in the world, or the entire Win ME series.
I do like office to some extent. LaTeX slides just look like crap, and Word is sufficient for one page letters.
the dedicated windows monkey team are still having difficultyrandomly producing the perfect operating system. the monkeys have been working at the typewriters for nearly 30 years now with little more than windows xp to show for it. microsofts head bill gates said he has not lost faith, the project will continue.
"if i'd known it was harmless, i'd have killed it myself"
I did this same thing over 3 years ago for another company i.e. it has prior art. If MS persues a patent on it, and my old company did not, I will be hitting them with the PA.
I prefer the "u" in honour as it seems to be missing these days.
yes but its not original .. just a twist on an existing idea
_ In Egypt Networks: Network Solutions with a Twist
Just look at Usenet, Slashdot and IRC.
:-) = I am happy
:^) = I am happy with my big nose
C:\> = I am happy with my OS
Wait a minute... is this still Slashdot?
-David
Non-simians need not apply.
microsoft deciding to do somethign "good" is just an percieved impression. Setting up a system of honey pots is a good thing. Using it to find security flaws and then fix them is a "good" thing. If MS is trying to do somethign that happens to be "good" they are doing a "good" thing.
Doing a good thign doesn't address the reasoning behind why they are doing. It isn't like my statment was implying microsoft was being a good citizen on purpose or anytjhing. They are just doing somethign that i as well as other percive as a good thing. This doens't make us fanbois or microsoft representatives either.
As for linux being the reason they decided to do this, thats pure speculation. Microsoft does know what to do about linux and if you don't think they do then look into the idiotic pattens they ar e applying for. Guess who they will be used against when the time is right. (not apple or any other company that can muster enough money to throw them out.) Your right that linux can't be bought but your wrong about bankrupting it. All they have to do is manipulate the licensing of the software to include a chunk of change for them. If "linux" doesn't pay they can effectivly stop linux from being viably sold to any market or cause the price to be inflated to enourmous level and stop it's adoption outside indevidual hobyist. Microsoft would be in position to control this with a few more pattens on what everyone has come to expect as the norm for computing.
I'm not saying microsoft should or will do anythign like this but it wouldn't surprise me when they do. To think linux is out of the scope of microsofts claws is naive and exactly what will cause it to fall. With a few more pattens, it would be possible to stop linux from even being able to compete on the same grounds it is now. When surveys are saying vender lockin is one of the bigest reasons people are going with open source products, it is only reasonable for microsoft to lockin open source products and maintina thier revenue stream.
Again the moral of the story is what made microsoft take these actions (honey monkeys) wich apear to be honey pots with a little extra. It could be fear of linux, or maybe fear of apple who has a better percieved security tract record as well as a better desktop. It could also be some ploy to fend off litigation were they didn't take steps to secure a product they are selling as secure. It may be that in order to sell to certain organizations, they have to do this or it just may be that they are trying to clean thier reputation up a little. It is all just a guess.
"If we ever identify a fully patched machine that got exploited, we got a big problem. We would involve the IE team and show them the threat." Ofcourse..it's always IE... A Mozilla system and all they have is their hands and the internet....
I'm sure MS Bob seemed like a good idea, at the time. Certainly an interesting concept.
But not an original concept.
If you're a zombie and you know it, bite your friend!
It's all very nice an dandy that they want to collect exploits, but what will they do with it? It is not that MS is known for it's swift reaction to published exploits. Maybe they wish to start working bofore (if ever) the exploit is published?
Besides they are overlooking the biggest security flaw of every computer: the user. Somebody that has been promised pr0n for instance wil not hesitate to click yes when 'unpacking' his load of porn he just downloaded from bittorrent.
The trick might work when the next version of windos comes with a dedicated monkey built in. The monkey is subjected to every piece of software to install on the real system first. when the monkey dies or some tests detect malware the software is not installed, and the monkey resurrected to a previous state. (Or maybe it attempt to remove the malware first)
Hey, why am I dreaming up things for windows? I should be designning that for a Linux distro.
This space is intentionally staring blankly at you
Do you have what it takes to spank the (honey)monkey?
Dude, you're 5 years out of date. India is saturated. My job just went to Beijing in China.
Stick Men
Honestly? No. Looked like a piece of tripe. Liked the first two though.
It would probably be a good idea if they tried to get IP addresses for the machines that don't come from their standard Redmond block. Hook them up to a consumer grade broadband cable connection and they'll probably be under attack with not much waiting.
Mmmm...
PORNBOT!
[...] "If we ever identify a fully patched machine that got exploited, we got a big problem. We would involve the IE team and show them the threat."
There you have it, folks. A tacit admission from Microsoft that Internet Explorer is the most likely vector for a security breach.
The NSA: The only part of the US government that actually listens.
Your right that linux can't be bought but your wrong about bankrupting it. All they have to do is manipulate the licensing of the software to include a chunk of change for them. If "linux" doesn't pay they can effectivly stop linux from being viably sold to any market or cause the price to be inflated to enourmous level and stop it's adoption outside indevidual hobyist. Microsoft would be in position to control this with a few more pattens on what everyone has come to expect as the norm for computing.
Don't forget about the huge amount of companies (Software, Hardware, Embedded, etc) and government agencies that have tied themselves to Linux.
Maybe Microsoft can kill small parts of Linux but going up against companies like IBM and for example the Chinese government would be a bit too much even for MS.
Honeymonkey, eh? Now I know what to call our network of self-administrating faculty and staff.
2 Words: Job security.
I might know what I'm talkin' about, but then again, this is Slashdot...
Since you used the word thrice, I think this might help:
patten (n.) : Any one of various types of wooden-soled footwear, such as a sandal, shoe, or clog, worn to increase one's height or to keep one's feet out of the mud.
patent (n.) : A grant made by a government that confers upon the creator of an invention the sole right to make, use, and sell that invention for a set period of time.
It's "Honeymonkey".
-gjr
Only if your last stage was "Newbie with an inferiority complex and an attitude" and your next stage is "Rampaging a**hole who still doesn't understand computers but insists he's a hacker because he can double click on a Perl script"
"Live Free or Die." Don't like it? Then keep out of the USA
So this leaves to Bill as Hanuman and his army of monkies.
That would be the point of all the patents microsoft is carrying. Only the big players and rogue developers would be able to continue using linux for anyhtign substancial. IBM and the chinese government would have to "pay to play" of sorts and m icrosoft would be getting about the same profit margin if not more.
Of course if demanded, IBM or china would pay homage to the patten holder because they wish to do business in certain markets that would require it. We recently saw a patten on a way to treat email as an object that would only seem as an obvious next step but because of the timeline it was implemented they got away from it. It is possible for any competing email program to actualy haved to pay an outlook/MS office fee now just to compete with microsoft. This allows microsoft to win even when loosing.
I'm curious though, how ldap directories would interact with this patten because they treated employee information as objects and inturn created an email address that is actualy an object and stored in a location for retrieval. Maybe i'm going into too many different places now. i guess my point is that microsoft has began to adjust it's stratigy to match with it colapsing monopoly. They have the ability to profit from other peoples work without buying them out or stealing thier products. Linux could eventualy be effectivly killed as we know it today except for a few large companies who sell it at a high price because of patent fees. I 'm sur emicrosoft won't trump anythign for a while until it has more of a patent "war chest" but it won't be long before this scenario could be carried out.
I agree and also noticed the shift to an IP company at Microsoft. People always say MS has until now never abused it's patents... but the "until now" part is the most scary IMHO.
:-)
I think they are definately going to try but I personally believe they are not going to make it as there are far more heavyweights backing Linux than they can go up against and the chinese don't care about patents. This will give a problem to the chinese trading in the us, but MS needs the growth in the emerging markets to keep it's shareholders happy.
IBM, CA, Cisco, etc. patent portofolio dwarfs MS and it's unavoidable that the y violate lots of them.
Maybe Microsoft should stop producing software at a point and become a company of laywers
Well, you have a choice to make.
You can go down the path of the Script Kiddie, Fandom, Techno-Fandom, Programmer, Uber-User or Hacker.
Script Kiddie pretty much excludes being any good at the other paths, but the other paths do not necessarily exclude each other.
Script Kiddie: A worthless waste of skin who considers themselves to be "better" in one way or another because they can download and run the utilities the found listed in their copy of "Hacking Exposed" and type in an obscure dialect of L33t 5p33k.
Fandom: A Sci-Fi or fantasy fan. A Geek path that does not require computer skills, but doesn't preclude them either. Star * Geeks, Buffy fans and even some furries fall into this category, but don't let the unsavory stereotype associated with the above groups turn you off. The vast majority of Sci-Fi fans are perfectly normal people.
Techno-Fandom: The Sci-Fi fans who run the Sci-Fi conventions. There's a LOT of overlap with the theater industry in this group. It also has a lot of people who dislike Sci-Fi but participate to hang out with their friends and meet hot chicks at the Dresden Dolls concerts.
Programmer: Linus Torvalds,Woz, Bill Gates in the early years, Mad Dog and the like are among the icons in this category.
Hacker: Black Hat, White Hat or Grey Hat, this is the group Script Kiddies are pretending to be part of. Cult of the Dead Cow is good example. Most of this group's literature is read by the Script Kiddies, who then pretend to understand it, sometimes even fooling themselves.
Uber-User: Many Techs fall into this category. They know far more about computers than a Script Kiddie ever will, can administer most servers and environments reliably and tend to be on the ball. In their knowledge, they're beyond the "Just Enough to be Dangerous" level, but not quite Programmers or Hackers. They're a separate category because many people send their lives here, never quite becoming Programmers. The difference is often Grey and fuzzy, with people changing their classification easily if you shift platforms on them. For example, many Windows Hackers are reduced to Uber-Users when switching to *nix and vise versa.
"Live Free or Die." Don't like it? Then keep out of the USA
TrunkMonkeys to Microsoft to make some sense of all this.
Well i can see your side about the big players. Thats probably why it isn't already happening. I'm not sure that microsoft would need the emerging markets when they can charge somethign for whatever is being sold there. It is like a big pyramid scheme and all they have to do is sit back and wait for more "other people" to make them money.
It may be possible that microsoft's product do in fact violate other patents. On the other hand, there probably is some kind of arangment already in place that might allow this violation so i would be a little cautious on banking on that. My hopes are that what you say is true and the big guns can save linux and opensource if it comes down to it. It apears that IBM has already feilded an attack from SCO and is doing well. The problem is were companies analize the lawsuites and build another from the conclusions of that. Eventualy someoen might win against IBM or the big guns might give up the expense of fighting. I am a big opensource fan but i'm not afraid to state what i percieve as obvious. We are in exciting times and i look forward to the outcome. Hopfuly it is as optamistic as you are. Linux and opensource is in a state that it can explode into wonderfull thinks. Some people want it to replace microsoft, i just want it to work for me. the closer to the former we get, the more we have to worry about microsoft changing the game.
WHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHAT?
Instead of seeking out more bugs to fix, why don't they ____FIX THE CURRENTLY EXISTING ONES!____
I will admit, Microsoft Spyware Detector Beta is a step in the right direction.
But come now.
You clean off your plate before you re-cover it in spinach.
So why haven't they? The problems with Windows have been around for 10 years, and yet Windows is still notoriously insecure. If the availability of money was the sole arbiter of excellence, then Windows would be the most secure/best/whatever OS around, and Linux (because it lacks money) would be like DOS 3.0.
The ONLY reason that MS is now trying to act proactively, and saying that security is important to them, is because the see a threat. They are doing what their only option is now - make good newsblips and start laying the groundwork for lawsuits by patenting everything they can.
I couldn't have said it better: MS is threatened by insert FOSS name here because it is not a company, it can't be bought, or undersold in bankruptcy.
--- "To ignore race and sex is racist and sexist!" -- Jesse Jackson