MS Invites Security Questions

daria42 writes "Microsoft is inviting ZDNet readers to submit security-related questions online to a team of Microsoft security gurus. Microsoft's Ben English and his team will take questions online until the 30th of May. A selection of questions and answers will be published by ZDNet starting from the 6th of June. Submit your questions starting now!"

Comments

What I asked

[Dante]

Why does microsoft not eat it's own dogfood? As a network administrator
I'm contstatly struggling with rights on workstations. I know that MS
gives admin right to all of it's own users. (I live in seattle I've seen
it.) But I can think of no security hole larger then giving out rights
to users who *SHOULD* not need them.

There is a laundry list of applications written *by* Microsoft that do
not work properly without additional rights.

This has been true sense NT 3.51. How did this happen? Upgrading to
longhorn it not a soulution. If I worked for Microsoft this would be
my first priority. Take away rights, fix existing applications.

Re:What I asked

[Baloo Ursidae]

True since NT3.51? No, no...True since DOS was released.

Re:What I asked

[dwlovell]

They are trying. Clearly the previous OS's didn't make it easy to not run as admin, but it is possible in XP, 2000 and 2003, despite a few jumps and hoops.

See Aaron Margosis' blog on msdn.

A choice quote:
"My #3 reason applies just to Microsoft personnel, particularly those of us in customer-facing roles. Hey, y'all! We need to lead by example. People look to us for best practices, for the right way to do things. We are trying to convince the world that we are thought leaders in software and in software security. In the Unix world, they never run as root except when necessary. They "su", do what they need to do, and revert back. We are not leaders when we run as root all the time. Comrades: you need to run as "User", and your customers need to see you doing it. If you run into issues, don't add yourself back to the admins group - file a bug against the offending product. Customers: if you see any MS sales, MCS, Premier, PSS, etc., doing web or email as admin, please tell them, "You're not setting a very good example. I am disappointed.""

So when Longhorn is released we can see if they made good on this idea, but until then, they openly agree with you and are working towards making it the standard to not run as root.

-David

Re:What I asked

[Dante]

"They are trying. Clearly the previous OS's didn't make it easy to not run as admin, but it is possible in XP, 2000 and 2003 Aaron Margosis, despite a few jumps and hoops."

If this was true ms would have their *regular users* not running as adminstrators. The receptionists run as administrator!

I just don't see Aaron Margosis comments anything but lip service. Microsoft don't even try!

Re:What I asked

[UknowLessThanURiz]

Well I've never met a network admin that didn't think they were the next best thing to God. Yet weren't as about as next to useless when it came to practical computer knowledge.

Re:What I asked

[sconeu]

Clearly the previous OS's didn't make it easy to not run as admin, but it is possible in XP, 2000 and 2003, despite a few jumps and hoops.

Please have your admin install the following, and then you may try to run them as a non-admin user:
* The Sims

* Mavis Beacon Teaches Typing 15

Re:What I asked

[myov]

Depends on the company. GM Canada effectively forces all computers to run as admin, as their login script tries to patch things whenever GM feels like it. Many of their installers are actually ZIP archives extracted to the proper places.

Re:What I asked

[zerocool^]

Here's the problem with that (and this is from real-world expierence).

Go to 2003SBE server. Add user in "Active Directory Users and Groups".

Go to computer. Join computer to domain. Tell user to log in with their username and password, making sure that the login screen says "Log on to: SomeDomain".

Then:

User calls. They can't install office. Log onto server via terminal services, push MSI office install to user's desktop, tell them to restart. OK.

Then:

User calls. They can't install weatherbug. Explain to user that weather bug is possibly spyware and not necesary, but since the User is the owner of his or her particular Gastro-enterology office (or whatever), what they say goes. Go out to User's site, install weatherbug along with MS Anti-Spyware.

Then:

User calls. Their application (which is in reality nothing more than a fancy telnet client they paid $400/seat for which attaches to a SCO box that was unearthed at an excavation of Bunker Hill) won't run without administrative privs.
Log in as local administrator, add their domain user account to the local administrators group. Sigh.

Then:

User calls. Thinks his machine is infected with a virus, and wonders where the popups came from.

The problem then is this: There are so, so, so many random little proprietary applications which need root privs to be able to run. These same permissions which can be granted to run these programs are what the spyware needs to install.

MS can probably change everything so that most programs will run as non-Administrator, and set up users to not be Administrators by default... but there are still going to be a slew of applications that require it. And telling random-guy that he needs to find a new piece of software to replace the one that he paid $8,000 for 2 years ago in order to make his computer secure is not going to go over well.

~wx

Re:What I asked

[Unnngh!]

Microsoft has made most of its fortune not by developing a solid and stable OS but by developing something which they could sell the masses (read: home users). The masses, who couldn't care less about security, and who will only become frustrated when something doesn't work out of the box.

I know lots of people who thought that SP2 broke stuff on their computers because it had bugs. For the most part, breaking applications was the price of enhanced security.

I generally log in as root on my linux box at home--sometimes dangerous but much more sensible when it's just me. At least Linux is scalable. Windows has been acceptable for the home user for years and only recently has security become a concern for that group. Windows was only adopted for the enterprise as an extension of their PC stranglehold. It was never meant to go there, IMO.

So, you have a company that has pretty much sucked for the enterprise but dominated the home PC market, and is trying to move forward while staying backwards-compatible. I think you would find the price of supporting old applications and having poor user rights to be much lower than starting clean.

It is a good question though; MS really should be smart enough to think up a solution to make everyone happier.

Re:What I asked

[drsmithy]

Here's the problem with that (and this is from real-world expierence).

Simple solution - give your users some details of a *local* admin account and introduce them to the "Run As" command.

Incidentally, you're better off setting up software distribution via AD such that users can install stuff from the "Add Remove Software" Control Panel rather than pushing software out to them. They can do this without admin privileges.

I Just Asked them the Big Question

[mfh]

My Question
Why don't you open up your source? I have an analogy to Open and Closed source:

With closed source, you are in a room full of razor blades everywhere and you are blindfolded. With Open Source, you are in a room full of razor blades everywhere and you are NOT blindfolded, so you can see where the exit is and perhaps avoid getting too cut up.

Which is really safer, closed or open source? Would you rather be blindfolded?

Re:I Just Asked them the Big Question

[Anonymous Coward]

Microsoft's Answer:

With Open Source, you are in a room full of razor blades and you can see, but it's really too much of a strain on you to get yourself to the exit safely. You can't possibly do it, and you might actually try to take a razor and cut someone else.

With closed source (or really, just MS) you are blindfolded because you are far too stupid to avoid getting hurt, and we really can't trust you not to use those razors to attack someone else. So we are going to hold your hand and gently lead you to the door.

What they won't tell you is the door only leads to more razors, and the guy holding your hand probably put them there in the first place (but that won't stop him from charging you to hold your hand).

Re:I Just Asked them the Big Question

[dwlovell]

Here is my version of the analogy:

With closed source, you never enter the room, something breaks and is visible from the outside and you say "Microsoft, thou shalt fix this or I will take my maintenance contract elsewhere!", and then Microsoft sends its devs into the room of razor blades with their own lights to fix the problem. (Now you might debate their effectiveness, but thats another issue.)

With open source, stuff breaks, no one is there to help you and you have to visit hundreds of howto sites in order to get the exact path to traverse the razor blades in the dark without killing yourself, just so you can fix the problem yourself.

-David

Re:I Just Asked them the Big Question

[Anonymous Coward]

you don't need to show off your useless analogy

How was it useless? I thought it was right on the money.

Re:I Just Asked them the Big Question

[jojo tdfb]

The problem is in the real world people don't understand that there are razor blades in the room and get cut the hell up even thou they can see them. If you can't see the razor blades but know they are there you tend to be a bit more careful. Of course in both situations you can avoid being cut by knowing that there are razor blades around.

The biggest issue I've seen with admins who use any product isn't weather the source is open or not, but weather they know what the hell their doing in the first place. In my experience admins usually aren't programmers, so even if they have the code, they don't know what their looking at. Elitist, yes, but sadly true in a lot of cases.

Linux does get hacked and you can lock down Windows. The only logical conclusion is that all operating systems sucks and if your ever stuck using one, be aware that there will always be problems.

Re:I Just Asked them the Big Question

[Anonymous Coward]

He bought the account on ebay. No joke.

Re:I Just Asked them the Big Question

[McCheese]

He could have made his point quicker without having used it.

Re:I Just Asked them the Big Question

[Anonymous Coward]

I think it's the perfect analogy, really.

Re:I Just Asked them the Big Question

[McCheese]

It turns out that the analogy was unneccesary but well-matched with the author's point.

Re:I Just Asked them the Big Question

[Emperor Skull]

Nah, it's more like you are in a field and you know there are land mines out there somewhere. With closed source you are relying on the army that buried the landmines to find them, defuse them and just maybe keep you from stepping on them. With open source you have a technical geologic survey of the area available for everyone to see, but the only geologists that have the ability to read the surveys are out to discredit the army. Generally the army has a bit more credibility so lots of people tend to follow their advice even though from time to time someone looses a leg.

Re:I Just Asked them the Big Question

[dsci]

With open source, stuff breaks, no one is there to help you and you have to visit hundreds of howto sites in order to get the exact path to traverse the razor blades in the dark without killing yourself, just so you can fix the problem yourself.

Right, because RedHat, Mandrake, Mozilla and a host of other Open Source companies don't support their products at all. [/sarcasm]

Re:I Just Asked them the Big Question

[gurumeditationerror]

With closed source, you never enter the room, something breaks and is visible from the outside and you say "Microsoft, thou shalt fix this or I will take my maintenance contract elsewhere!", and then Microsoft sends its devs into the room of razor blades with their own lights to fix the problem. (Now you might debate their effectiveness, but thats another issue.)

With open source, stuff breaks, no one is there to help you and you have to visit hundreds of howto sites in order to get the exact path to traverse the razor blades in the dark without killing yourself, just so you can fix the problem yourself.

Have you actually heard of MS fixing a bug specifically for a customer? I'd be interested to hear about that.

Also I think you're ignoring that there are service contracts available for support on OSS. Infact it's better because you've got some choice in the matter with MS your stuck with MS.

Re:I Just Asked them the Big Question

[crossconnects]

Mod this up!

one of the best analogies i have ever seen!

/. em

[technomancer68]

We should show them the /. effect and send nothing but linux security questions on how to fortify your linux distro ;-)

Re:/. em

[Anonymous Coward]

Brilliant! Let's complain about their lack of security all day and night and then when they try to do a simple thing to get some security feedback we should hit them with a veritable denial of service attack.

Sounds logical.

Re:/. em

[pg110404]

We should show them the /. effect and send nothing but linux security questions

And it would be just as much a waste of effort. The current design of windows is so flawed when it comes to security if microsoft actually listened to their customers, would have to revamp their entire security model in the OS breaking just about everything in windows. Microsoft is in a very tight spot right now with their design of windows and anything more than lipservice on their part would mean making a very hard decision to change the OS so fundamentally that it is not compatible with its predecessors and is something they cannot afford to do. As it stands, the security or lack of security in windows will remain for quite some time. There are tricks they can use to minimize the damage once security has been breached. For example, Upgrade the active/x layer to allow a 'read-only' mode for a given process wherein the first thing the web browser does when it starts up is to neuter itself. Whether you run IE as administrator or not, it's a safe bet that more harm than good can be done letting it run silently. By having IE issue a call to a one-way demotion of privileges, along with a 'this application is trying to do this. Enter your administrator password to override for this one time occasion', would vastly improve but not solve the security problems. With this simple trick, spyware infested web sites would have a much harder time installing their wares without you knowing about it. Again, it wouldn't solve that security problem, but it would greatly improve it.

Then again, maybe, yeah. We SHOULD ask them how to secure our linux boxes better. At least I'd get a kick out of the reaction from the microsoft soldiers.

Re:/. em

[jojo tdfb]

You know Microsoft has a Linux lab, right? The problem is they probably could answer your questions and possibly seal up a few security issues that could have bitten you in the ass later. Your right about Windows being a flawed model, but they said the same thing about Unix 20 years ago. All security models are flawed that allow people in to do things like "run programs" and "view data".

I've yet to see a secure os and it's not from lack of effort. I've been looking for an os that doesn't suck for years.

Re:/. em

[Anonymous Coward]

"The current design of windows is so flawed when it comes to security if microsoft actually listened to their customers, would have to revamp their entire security model in the OS breaking just about everything in windows."

If I had mod points I would mod you a troll. Have you not heard of sp2? I have yet to encounter a virus using sp2 within the past two years...

Re:/. em

[dioscaido]

You seem to be confusing insecurity in the OS with the problem of people running their desktop as Administrator. Show me where exactly linux protects me if I run my desktop and all my supporting applications as root. It doesn't. By definition root (or Administrator) has full access to the system. I could write a simple bash script to hose your machine. But linux is secure, without question. In effect this is what most spyware writers are doing now a days. They are not taking advantage of any explicit security holes or escalating their priviledge -- they work with the assumption that they can freely modify the machine's settings.

Remove your account from the Administrators group in Windows, and you'll be quite surprised at how extensive and robust the permission system is within win2k/XP/2k3. I've been running this way since win2k and I haven't had any spyware issues (and I don't need AdAware or MSAS running in the background).

The problem is not one of engineering but one of Marketing -- the marketing folks decided that it would be best to keep everyone admin so as not to confuse them. This set a horrible precedent, but we engineers are winning out and MS is now recommending people run as limited user (even though the install default is still admin) and in LH it's all about not running as Administrator.

Unless, of course, you know of some specific limitations with the OS that I'm not familiar with. I'm a developer on Longhorn so I consider myself fairly knowledgeable when it comes to the OS internals of XP/2k3/LH.

Re:/. em

[cranos]

Secure OS: A shiny white box sitting in the corner without any cables plugged in and completely powered down.

Re:/. em

[don'tdowindows]

I like how mac os X can still run mac os 9 apps is there a reason why the next windows couldn't do that?

Re:/. em

[ThJ]

Mmm... sounds pretty close to that battery powered Mac Mini...

Re:/. em

[Anonymous Coward]

Come on now, bit much to ask that Longhorn can run OS9 apps isn't it?

Re:/. em

[wild_berry]

That sounds like ignoring the thing (and this implies security-by-obscurity) is the Operating System for that box.

I think I will offer a patch for you secure system: bury it under concrete and configure it with outputs methods (if it's ever powered up) which use electromagnetic rays and other energy emissions at levels and frequencies which destroy humans. Because paranoia is helpful when it comes to security you must admit that this doesn't keep it safe from the invisible chickens of Mars. This may be a moot point, but how would the GP feel if she or he found the perfect secure operating system?

;-)

Re:/. em

[Emperor Skull]

It was a developer, not a marketing person that wrote the XP Windows Welcome oobe and allowed it to be used in place of the mini-setup. The fact that this tool forces a user (that doesn't know how to drop back to sysprep factory mode with CTRL-SHIFT-F3) to create a user account that is an administrator with no password and then logs them in automatically.

Those developers are just as bad as the scientists who research how to make cigarettes more addictive to kiddies if you ask me. Just because marketing asks for it doesn't mean you should.

Re:/. em

[drsmithy]

The current design of windows is so flawed when it comes to security if microsoft actually listened to their customers, would have to revamp their entire security model in the OS breaking just about everything in windows.

The Windows security model is better than that in most unixes. What on Earth makes you think they need to redesign it from scratch ?

Re:/. em

[drsmithy]

AFAIK Longhorn will run Win16 and DOS applications.

Besides, get some perspective here - Win16 was deprecated 10 - 12 years ago. OS9 was only declared dead in 2002.

Let's see how much of a priority OS9 support is for Apple ca. 2012 - 2015 before trying to make any comparisons...

Re:/. em

[Bin]

[the winxp welcome oobe] tool forces a user ... to create a user account that is an administrator with no password

Actually, if you put in "none" as the first and only user it dosn't create any users, and you end up with Administrator on the welcome screen (that disapears once annother user exists, but you can always get back to it with the ctrl-alt-del twice trick).

That is how I add the odd laptop to our domain as I don't want any local users (when for some reason I'm not RISing them), well now I know the ctrl-shift-F3 maybe not ...

Presumably it only works on XP Pro as XP Home trys very hard to deny the existance of the Administrator user (until you boot it up in safe mode to password it)

Bryn

Re:/. em

[Emperor Skull]

Actually, if you put in "none" as the first and only user it dosn't create any users

Cool. I didn't know that.

[CTRL][SHIFT][F3] at the first welcome screen drops the system back to sysprep factory mode. We get a lot of machines preinstalled and it's easy to do this, switch to mini-setup and reseal, then use our sysprep.inf to complete the installation and kick off our customization scripts.

Is Microsoft Windows *OS* more secure than Linux?

[r_jensen11]

Guarenteed question. Answer: According to many studies that we've funded; yes.

Could the key word be...

[sznupi]

"selection"? ;P

Re:Could the key word be...

[whoopass]

Why does this come as a surprise? Selection is entirely appropriate given the number of question/caliber of each question/applicability of each question to a broader audience.

Slashdot follows the same approach when we post interviews with key thinkers in the open source community. Why hold Microsoft to higher standard than that to which we hold ourselves?

Re:Could the key word be...

[sznupi]

Yep - I was mostly joking. And our moderation points should be at least the other way around...oh well, it's /.

Unbiased?

[nizo]

If the Microsoft team gets to pick which questions are answered, I doubt this will be akin to Achilles waving his naked foot right under Paris' nose, since questions like, "Why is Microsoft's security better than Linux security?" are more likely to get answered than questions like, "When did Microsoft hire a team of security gurus?"

Re:Unbiased?

[jerometremblay]

Microsoft is full of brilliants people with good ideas and good intentions.

However other forces within the company are sometimes (some will argue always) taking over. If the suits decide that they prefer more features over less bugs, or if they set impossible deadlines, good peoples aren't enough.

Re:Unbiased?

[Doc Ruby]

The suits control Microsoft. What difference do the intentions, or even the abilities, of the "good people" make, when Microsoft is defined by the suits? This isn't a sympathy contest, it's a globally-essential corporation's increasing everyone's security risk.

Re:Unbiased?

[jerometremblay]

I agree. I was specifically responding to the part about "When did Microsoft hire a team of security gurus?", because they actually did. They are just not listening to them.

Re:Unbiased?

[spells]

The suits control Microsoft

Psst. Don't tell anyone. But I heard it from a reliable source that the suits control all the big companies. That's why I'm wearing jeans.

Re:Unbiased?

[killjoe]

Really? From the outside it looks like MS is full of sleazeballs without ethics or morals.

Re:Unbiased?

[WhiplashII]

Are you kidding? That's why I'm wearing a suit!

Re:Unbiased?

[Monkeman]

Probably looks like that from the inside too.

Re:Unbiased?

[tchernobog]

You can't have both brilliant people and people with good intentions at Microsoft: only brilliant dishonest people or stupid good intentioned ones stays.

Isn't the WWW full of them...?

[guyfromindia]

Almost EVERY website that deals with security have commented on M$FT and their security. That would be a good place for Mr.Ben English to start. Not to troll, but I think this is just another PR stunt by M$FT!

Re:Isn't the WWW full of them...?

[brouski]

I think you were revealed as a troll the minute you used M$.

Re:Isn't the WWW full of them...?

[Anonymous Coward]

Not to mention the fact that the comment was completely useless.

Apparently "guyfromindia" doesn't understand how to make a cohesive arguement on his own, so he is reduced to pointing out how other websites have commented on Microsoft.

Re:Isn't the WWW full of them...?

[Anonymous Coward]

And you make a living commenting on other's comment, I suppose.. get a life, dude...

Re:Isn't the WWW full of them...?

[Anonymous Coward]

Apparently "guyfromindia" doesn't understand how to make a cohesive arguement on his own,...
At least 'guyfromindia' made a faint attempt at suggesting that this is a PR stunt. But, you cannot even make a cohesive comment on your own! Shame on you!

In other news...

[cainpitt]

Slashdot asks what kind of story will really bring the M$ bashing to an all time high?

Re:In other news...

[Doc Ruby]

That would be "the truth". The truth about Microsoft is unparalleled bashing grounds.

Re:In other news...

[Sponge Bath]

Bill Gates builds a clone army of Darl McBrides to spread Windows and the Mormon faith to the world.

By force, if necessary.

what doesn't get answered

[sumdumass]

It would be nice to see the questions that don't get answered. It would be interesting to see if some questions get glossed over or ignored because of some inherant design flaw.

Maybe someoen would make a lost of all the questions and group all the simular ones together in order to create somethign like this. I guess microsoft is feeling the heat from other vendors stating that microsoft isn't as secure as thier products.

Question:

[lunchlady55]

How do you keep your jobs?
I'm assuming you've got some excellent blackmail material on someone in HR but I'd like to know for sure.

Re:Question:

[Anonymous Coward]

Their jobs are kept through a giant siphon of money from the generally clueless public. I believe nobody has ever really taken Microsoft's flaws seriously. "Bugs are bugs, reboots are reboots -- that's just how it is, man! That or go command-line unix, right?"

Not enough people understand. When a virus/worm spreads through the net, people need to get hit over the head and be told that Microsoft shares at least part of the blame in this. (your clueless admin gets part of it too!)

Because of spin and propaganda, people have ACCEPTED these security flaws as part of computing. Only relatively recently has there been enough of an uproar to get MS to do additional PR work (Trustworthy Computing) to liven up their security image a little.

We all know what will happen.

[Psionicist]

They will ignore everything and give generic answers to worthless questions such as "how do I secure my home computer". The answer will probably be something like "use the microsoft firewall and the microsoft anti-spyware program, and a microsoft antivirus program on your geniuine microsoft windowxs xp operating system".

Nothing to see here, move along.

Re:We all know what will happen.

[NineNine]

That's actually a pretty good answer for 99.9% of the population, actually. What's your beef with it?

Re:We all know what will happen.

[DenmaFat]

That's actually a pretty good answer for 99.9% of the population, actually. What's your beef with it?

No it's not. The one-way firewall doesn't prevent spyware that slips through from connecting out. And ActiveX makes it easier for malware to dupe the average Wal-Mart computer buyer into loading it. The latest build of Longhorn maintains the status quo remains unchanged for both of these. Hey, let's install an IE toolbar.

Re:We all know what will happen.

[DenmaFat]

damn...editing...preview...mmphmm

Re:We all know what will happen.

[arminw]

...how do I secure my home computer...

Answer: Keep the monitor, keyboard and mouse. Connect them to a Mac mini and you will have a secure computer. If the PC is good enough, get another monitor, keyboard and mouse and use it to play games. Make sure this PC is NEVER connected to the Internet or any other network and it will be very safe from worms and other malware.

a slection eh ?

[oh_the_humanity]

a selection ... translation easily answered questions made up or planted by microsoft employs. so they dont have to answer the hard hitting questions.

Re:a slection eh ?

[oh_the_humanity]

If i really cared id say spend your time fixing the fucking gaping security holes, instead of poling the general public on whats wrong with there OS. but since i dont care , eh who cares ?

I question the "guru" title

[Mr. BS]

MS Guru's?!?!?! Oxymoron!! If they're guru's... why are there still issues after hundreds of "fixes" over the years?

Just hype to cover their asses and to keep the sheeple happy!

Re:I question the "guru" title

[jojo tdfb]

If they're guru's... why are there still issues after hundreds of "fixes" over the years?

The same reason Linus and hundreds of other people still do patches to Linux. No software is truly finished and secure. Not even Hello World. There's a really nasty buffer overflow in that one. I don't even know why people still use it.

Re:does this apply to online (hotmail?)

[avalys]

You obviously get some kind of referrer bonus for sending people to their site. I count three links to shinyfeet.com in your post.

And really, who the hell would want an email address with "ShinyFeet" in it?

What's considered a security bug?

[Anonymous Coward]

This is pretty much the most basic question possible, but what do you consider to be the range of behaviors that qualify as security bugs?

For example: do you consider features that require the user to do something insecure (like run as a local administrator) in order for that feature to work a bug? Do you consider system defaults that can cause the user to perform an action they didn't intend to do (such as launching a hostile executable) a security bug?

If you answered "Yes" to these questions, do you consider ActiveX web browser plugin support and hiding file extensions to be security bugs? How soon will a patch be available to fix these bugs? How does the timeframe from "discovery of bug" to "fix for bug" compare to your competitors average time-to-fix for security bugs?

Simple enough, really.

Re:What's considered a security bug?

[Keeper]

do you consider features that require the user to do something insecure (like run as a local administrator) in order for that feature to work a bug

The answer to this is clearly no, if you consider running as a local administrator an insecure operation; there are some things only a privledged user can do. Otherwise there would be no point in having a local administrator account.

Do you consider system defaults that can cause the user to perform an action they didn't intend to do (such as launching a hostile executable) a security bug?

Anytime the user performs an action, and the computer does exactly what it is supposed to do in response to that action, it is not a bug. The problem you are describing is one of usability and user education. There are many locations where the design of the UI encourages the user to blindly click ok. There are other locations where the user doesn't know enough to make a correct decision.

Are these security bugs? I don't think so. Are they problems with the way the software is constructed? Yes.

Re:What's considered a security bug?

[drsmithy]

Do you consider system defaults that can cause the user to perform an action they didn't intend to do (such as launching a hostile executable) a security bug?

How do you propose the OS detect the difference between a regular executable and a "hostile" one ?

Besides, isn't one of the major complaints about Windows the way it tries to guess what you really mean instead of what you just did ?

Ecuritysay ybay obscurityway

[whoppers]

Ancay Iway askway ywhay eythay on'tday useway igpay atinlay?

I'dway atherray eatway ymay ownway eadhay anthay anslatetray everythingway omfray igpay atinlay ustjay otay ackcray intoway omeone'ssay ystemsay.

Can I ask why they don't use pig latin? I'd rather eat my own head than translate everything from pig latin just to crack into someone's system. See what I mean? Maybe it's Friday and I'm the only one seeing the humor...

Re:Ecuritysay ybay obscurityway

[Anonymous Coward]

You are. Trust me.

Beating around the bush

[camelmix]

I'm sure they will just beat around the bush like they always do. Gates's arrogance will trickle off.

Re:Beating around the bush

[Anonymous Coward]

Ssh! You've got to post as anonmyous to get the insightful modifier on these types of comments!

Comment removed

[account_deleted]

Comment removed based on user account deletion

I have a question...

[WAR-Ink]

1) Why can't you get software out the door that doesn't contain security flaws that you will be spending the next 6 years trying to fix, and still not get it right?

2) Word association: Microsoft -> buffer overflow.

3) Do you understand the concept of "Deny All Except" or has it ever been mentioned to you?

4) Do the 1 million monkeys Douglas Adams referred to work in Redmond?

5) Why is Bill Gates such an ass?

6) Who will protect us from Microsoft?

Ok. So it was more than one question. But one wasn't technically a question.

Re:I have a question...

[radish]

How on earth did that get modded "Informative"?

Re:I have a question...

[Anonymous Coward]

How on earth did that get modded "Informative"?

You didn't read all the items in the post.

5) Why is Bill Gates such an ass?

Surrender your five digit SID because you are new here.

Re:I have a question...

[corrie]

3) Do you understand the concept of "Deny All Except" or has it ever been mentioned to you?

Absolutely!

I would add: Why did you make it impossible to make IIS SMTP server a closed relay?

Re:does this apply to online (hotmail?)

[downsize]

just no ads is all. if yahoo offered something like that, I'd do it to. its also in my sig.

And really, who the hell would want an email address with "ShinyFeet" in it?

I guess millions? dunno, but I remember everyone saying that about yahoo and others thinking hotmail was perverted sounding.

Don't do it, it's a trick

[frovingslosh]

Come on, does anyone really think that Microsoft is going to select any of the tough questions that they really don't want to address? This is a sham. It gives them a way to say that they responded to users concerns, when in reality they will pick and choose things that can make them look good or give them a chance to attack open source. The more people who participate in this sham the more it servers their purposes.

Re:Don't do it, it's a trick

[consilience]

something akin to the way crowds are picked at the president's rallies..... "questions?" "yes mr president, i just wanted to say thanks for (insert absurd not even wrong non-question here)" And just like with those press conferences the majority of the american public won't blink at the obvious farce.

My Version of M$'s reply

[MrAnnoyanceToYou]

Ability to use metaphor implies capability for higher thought... Is this useful in a business environment? What are the upscaling interoperability and B2B / B2C / B2D implications of using higher thought if it disassociates your personal intelligence quotia from the actual intelligence quotia of the low-TCO due to high-WorkerProd with minimal training requirements? Security with open source is no good, because your TCO suddenly becomes higher, and that includes updating and everything - we've done studies. Next time you submit a question, please use plain English and technical terms so we can aid you to the best of our training.

Time 2 Market vs Security & Fiduciary duties

[team99parody]

Dear Microsoft - it's long been known by us shareholders that your stock has only flown so high because you understood the proper tradeoffs between security (slow and unprofitable) and time to market (== profit == shareholder value).

How can you be betraying your feduciary responsibilities to shareholders by delaying products in the name of security, which history has proven that your corporate customers don't give a damn about anyway.

To avoid shareholder lawsuits of you not acting in what has historically been shown to be the best for your shareholders, why don't you return to your security-be-damned buggy strategy and return your stock to the glorious heights it once held?

I asked

[RealAlaskan]

Gates recently declared security to be ``Job One''.

Why wasn't it a high priority from the begining, and why haven't we seen any meaningful results?

The first part of that question is legitimate, and not flame bait.
The second part we can almost say that about: it would at least give them the chance to boast.

I predict we won't see an answer to either part.

Re:I asked

[Anonymous Coward]

The answer is because Microsoft realized that their most important customers (the PC OEMs) don't give a damn about security; and this lets them easily double-charge their customers who end up buying one OS from the vendor (XP-ME or XP-Home) only to replace it with another copy that at least has some security features(Server2003).

There's a tie-in to the question I asked them.

Why are you shifting this focus to security, when historically you've proven that you can produce far greater shareholder value by releasing insecure systems that require people to keep paying continually for frequent upgrades.

Re:I asked

[RaffiRai]

Not to defend MS, but that's trolling. "Security" wasn't a high priority in the beginning because it didn't exist as a highly important factor until like 1999. XP is based on 2000 which is based on NT 4.0 which is based on NT 3.51. There's no way they could have forseen security being as important to the computer world as it is now. Granted, it took them a bit to realize it, but they can't change the entire NT codebase without releasing a new OS, which they're doing. SP2 is about all they can do without making fundamental changes.

Why am I defending MS? I don't like them..

Re:I asked

[praxis]

If you take a look at the vulnurabilities found in the first six months of Windows 2000 Server being on the market and the vulnurabilities found in the first six months of Windows Server 2003 being on the market, you'll note that the number has gone down dramatically (I don't remember the exact figures). Also, for many vulurabilities, a default 2003 installation will not expose the vulnurable area whereas a default 2000 installation will. Those are meaningful results.

Re:I asked

[Anonymous Coward]

The reason Windows wasn't designed in the first place with security is that it wasn't designed to be networked. UNIX and others (Mac, Linux, BSD) were .

Re:I asked

[NutscrapeSucks]

That's simply false. Windows NT was designed with authenticated RPC networking at the core. The problem is that this system only works on safe networks and is a total disaster on the hostile Internet. (Maybe you heard of MS-Blaster that killed the RPC service, which caused the computer to reboot!)

UNIX was designed with nearly no network security. Ironically, that helped it become a much more secure OS because most of the services are so dangerous that they are now disabled. OTOH, if you do need Unix RPC, it is usually implemented on a much higher layer -- J2EE for example.

Re:I asked

[NutscrapeSucks]

I would add that the security track record of Windows 2000 (awful) actually compares pretty well to the security track record of Linux 2000 (the awful Redhat 5/6 for example).

Both companies have cleaned up their act, but MS still has to deal with a massive W2K installed base, and RedHat does not.

Re:I asked

[drsmithy]

XP is based on 2000 which is based on NT 4.0 which is based on NT 3.51. There's no way they could have forseen security being as important to the computer world as it is now.

There's nothing lacking in the design of NT - from the start - with regards to security. It's multiuser, with a very fine grained permissions model.

It's amazing how much people go on about how important XP's SP2 was, when all it really did was twiddle a few default settings and recompile many of the core libraries to protect against buffer overflows. These were not major changes. NT does not need major changes to be "secure".

Re:I asked

[rtb61]

Security on computers connected to a network has always been an issue. To say it was not an issue prior to 1999 is akin to saying microsft could ignore security because Linux had yet to make an impact and become a threat.

Windows 98 had a username and password login, everybody knows it was just a BS marketing joke, but why do it if not to pretend to provide security (a really pathetic way to treat your customer).

A person would have to be an idiot to assume a public access network that was providing financial transactions did not need to be secured or just not give a shit because it would cost money to provide it (microsoft's chairman can take his pick).

What the hell.

[killjoe]

Has ZDNET given up even the pretense of being a tech magazine? Have they finally embraced the fact that they are nothing more then a thinly veiled publicity arm of Microsoft?

Where are the real journalists asking the tough questions to the executives of MS and other tech firms. Instead they invite questions from the public there the "experts" will pick the softballs and spew on an on about how safe, secure and super-duper-keen-nifty windows is compared to that communist linux.

Re:What the hell.

[killjoe]

Slashdot is not a magazine. You should learn the difference.

Answering template

[gmuslera]

Dear Microsoft customer:

42

Re:Answering template

[t35t0r]

I hope the book is not as terrible as the movie

Re:Answering template

[iccaros]

what was the question?..

Benefits of Firefox and competition

[augustz]

With ActiveX, when all the junk spyware sites would try to install software, it was impossible to always deny the publisher install rights, but you could easily ALWAYS allow publishers to load up your computer with the worst junk imaginable.

If you've ever been to a retirement home using Internet Explorer on a shared computer, you would laugh at how much junk computers would be loaded with.

Along came Firefox, and with it the freedom from training folks to click a million times no to a million ActiveX dialogs. Pop-ups and other forms of nastyness reduced.

All of a sudden a fire seems to have been lit under Microsoft around security and its browser.

Aside from the above listed changes, what other positive changes do you think Microsoft will introduce as a result of some competition, particularly in the browser space, but also elsewhere.

ZDNet are running a Giant MS ad on the page top!

[devitto]

How could you consider this even vaugely unbiased, when ZDNet have a HUGE great Microsoft advert at the top of the page ?

Sheesh.

MY version of Microsoft's reply

[temojen]

Our business model depends on selling licenses to use our products.

They have it backwards

[starling]

Based on past performance, the MS security gurus should be asking questions of the general public.

What I posed

[Amoeba]

What I posed to them was "What is the current status of the Mako project and which of the 3 focus areas has been the most difficult to implement and why? We've seen some movement in the firewall/anti-virus area but I've read or seen little regarding the dynamic-systems-protection or behavioral blocking."

Quick background on Mako: http://www.microsoft-watch.com/article2/0,1995,176 4087,00.asp

Having previously been a contractor at Microsoft and being intimately familiar with the security setup of their online properties (Hotmail, passport, messenger, etc.) the dynamic systems protection area was one that would get the most play (and benefit) on the server side. Automagically monitoring system state and port management would be extremely useful if it was a part of the server OS.

My question...

[cperciva]

On March 2nd, I reported to the Microsoft Security Response Center a serious flaw in the implementation of Hyper-Threading on recent Intel processors requiring operating system patches. On May 13th, FreeBSD issued a patch, and several other operating systems have followed suit since then.

When will Microsoft issue a patch or advisory concerning this?

Of course, most linux vendors haven't issued patches or advisories either, but at least some of them have been talking to me...

Re:My question...

[Khyber]

I read about that on the Slashdot Story you Posted.

Quite the interesting read. If Microsoft won't answer that question, I can forsee with my Jedi powers that many computers (not including my own, I only run one or two apps at a time on my simple 1.8 GHz P4) will suddenly become compromised.

Let me ask you a question. With this flaw in the architecture, will the chip manufacturers or motherboard companies have a solution ready before this exploit gets too far widespread, or will they just keep touting it as "The way to go for next-gen processing?"

Personally, I'd rather have a dual or quad processor system, and set certain programs to execute only on those processors, rather than rely upon a flawed architectural design.

Re:My question...

[cperciva]

Let me ask you a question. With this flaw in the architecture, will the chip manufacturers or motherboard companies have a solution ready before this exploit gets too far widespread, or will they just keep touting it as "The way to go for next-gen processing?"

The shared-cache-between-threads channel can be fixed in silion. Whether it will be fixed is quite a different question, and which I can't answer. For some strange reason, a certain multi-billion dollar corporation doesn't want to talk to me about its unannounced products...

Re:My question...

[Anonymous Coward]

Windows isn't scheduled to be patched/serviced until June. *insert hordes of Linux fr33ks laughing*

Re:My question...

[Anonymous Coward]

Why should software patch a hardware issue? I believe that the hardware vendors should just provide a free replacement chip to the affected customers. It's similar to car manufacturers that need to replace a specific component due to a security risk. They are not patching the driver's brain to not do this or that with the car.

My question..

[Rasta Prefect]

ActiveX Web Controls: What the hell were you thinking?

Slashdot Interview Questions

[bizard]

Instead of flooding them with so many questions that they can easily ignore the hard hitting ones, how about a Slashdot Interview style selection of good questions which we then submit as a group.

Corollary:

[temojen]

Is there an easy way to see which files have been denied access to (and what types of access) so admins can set ACLs quickly to allow regular users to use programs which normally require administrator access, but shouldn't (ie simply accounting)?

Re:Corollary:

[Anonymous Coward]

I wouldn't exactly call it quick and easy, but you can do what you want by turning on auditing of object access failures in the relevant parts of NTFS and the registry.

Re:Corollary:

[Anonymous Coward]

It seems that permissions in the registry are given at the "folder" rather than at the key level. Most likely this isn't an issue, theres not a lot of places where some keys should be blocked but others should not.

The biggest perpetrator really are the game companies writing cd copy protection schemes that require hardware access to work, and therefore require admin privs. Whats needed is for the game companies to quit doing this. It only works for about 30 minutes, by then if the warez groups haven't cracked the game, the people who get pissed off at trying to get the game to run have.

Re:Corollary:

[Dwonis]

It seems that permissions in the registry are given at the "folder" rather than at the key level.

What are "folders" in the registry, exactly? My understanding is that the registry has keys, and every key can contain other keys, an unnamed value, and multiple named values. i.e. The things that look like folders in Regedit *are* they keys, aren't they?

Re:Corollary:

[Emperor Skull]

Technically they are called hives.

Permissions can be set at the hive level or at the individual key level and the folder/file analogy is appropriate.

Where the permissions are set isn't important, that the permissions are set appropriately is.

Re:Corollary:

[csirac]

Over at sysinternals.com, there's filemon, and regmon. These are real-time registry/file activity loggers, will show which processes access which files with the result code (open success/fail/permission denied/disk full/file not found/etc). These are absolutely invaluable tools, especially when you come across a new virus that your virus scanner doesn't pick up and general bug hunting... sysinternals has the most useful tools that I really miss from the unix world.

Re:Corollary:

[Anonymous Coward]

Yes - SELinux.

Re:Corollary:

[Anonymous Coward]

I don't know what it is you are saying is technically called a hive, but it sounds incorrect. Each key can have one or more named values and one unnamed value. Keys can have subkeys. A "hive" is a set of files that contain a subset of the registry rooted at a particular key. The registry has a handful of hives but a large number of keys. See Registry Hives

Re:Corollary:

[Anonymous Coward]

The folder icons on the left side of regedit *are* the keys. Each key has its own security settings, analogous to the security settings on a folder. The things on the right side of regedit are the key's values. Each key can have several named values and one unnamed one. Values do not have individual security settings.

You can think of a key as a section in an .ini file, and the named values as the x=y entries in that section of the ini file.

Microsoft jokes

[dapyx]

Maybe this would generate a whole new set of jokes similar to the Radio Yerevan jokes. Now, please complete this template with your jokes: The Microsoft Experts were asked: "<Is it true that...>" The Microsoft Experts answers: "<In principle yes, but...>"

Re:Microsoft jokes

[Anonymous Coward]

Is it true that Windows has rock solid security? In principle yes, but..

Where are the tools?

[disposable60]

Microsoft apparently has fine-grained access, rights and permissions built into WindowsXP. Where are the tools to manage those permissions?

By the way - HOME users need those tools, too. They would (could) go a long way to preventing zombification.

Re:Where are the tools?

[arminw]

...Where are the tools to manage those permissions? ...

It is possible to set user and file permissions very nicely in Win2K and XP. The problem is that many programs want to write data in places that are off limits to non-admin users. These programs then die outright or misbehave in other ungraceful manners. Most users become unhappy when their programs don't run any longer after they installed a newer version of and OS or bought a new computer. Even installing some updates causes programs to cease working correctly at times. Therefore, to prevent the wrath of the users coming down on them wholesale, MS takes the easy albeit unsecure way out by making everbody an admin by default.

Re:Where are the tools?

[scupper]

gpedit.msc and secpol.msc , aka "Local Security Policy" and "Security Configuration and Analysis" snap-ins aren't available on XP Home. You have to make the changes manually.

mvps.org has a lot of the registry hacks needed to make security policy changes. So does windows registry guide, labmice, elder geek, and technet.

Good books to get are the XP Registry Guide and xp hacks. But the easiest thing to do is to run a copy of XP Pro.

XP Pro needs a paired down version of Windows 2003 Server "Security Configuration Wizard (SCW)"

Invitations?

[erroneus]

Microsoft has been inviting security questions for ages. But I assume this time they are preparing to actually answer them?

Microsoft: the plan is simple and reliable -- build a new OS entirely and then write a 'legacy' VM on top of it to run the current and old stuff. You can be secure and overcome the old crap. Why aren't you doing that?

Re:Invitations?

[Stormwatch]

They did, but the new thing is as full of security holes as the old one.

When will a secure version of IE for the Mac exist

[WillAffleckUW]

And why is it still stuck on IE5, especially if MSFT plans to "upgrade" MSFT Office?

Vhy? (heavy Yidish accent)

[Mishtara2001]

Vhy?

Vhy oh Vhy?

that's what I personaly like to ask them.

When surfing with my laptop using free WiFi

[Anonymous Coward]

what does that popup box that says "All your base are belong to us" mean?

And what does it mean by "Finished downloading software" when I click on the link to confirm that email that I got from my bank?

My friend says I'm a zombie, but I haven't noticed any hair falling out - why is this?

Re:When surfing with my laptop using free WiFi

[WillAffleckUW]

what does that popup box that says "All your base are belong to us" mean?

That you should upgrade your OS to something else.

Re:ZDNet are running a Giant MS ad on the page top

[rikkards]

So? every once in a while I have seen a MS ad on Slashdot? Course that isn't when I am running Firefox with adblock

Have you stopped beating your customers?

[Prototerm]

That's my question, but we all know the answer, don't we boys and girls?

Why not use Canadianlatinay?

[Anonymous Coward]

So you can fuckoffay

Trust and Security

[augustz]

Microsoft is constantly telling folks lies, and then creating "independent" verifications about them on performance issues. Witness the veritest reports

So you know as we all do that every morning Microsoft engineers are waking up, and KNOWING that these tests are totally bogus and blatently rigged, go out and lie like crazy to their customers about what the results prove.

Even if the product is faster, at least avoid creating such crap tests. I remember the garbage J2EE benchmarking as well, and wonder what microsoft is thinking getting up every day to push this stuff?

In the security world, trust plays a very important role in security. In addition to putting locks on doors, a business does well to hire employees it can trust.

In the long term, do you see any value in working to establish trust with your customers? My mother currently would share info with google she would never consider sharing with Microsoft, which I thought was interesting.

Re:Time 2 Market vs Security & Fiduciary dutie

[jerometremblay]

I love this message! MOD PARENT UP!

My take on the answer: competition (linux) and changing conditions (internet) have simply changed the "sweet spot" between security and time to market.

A harsher world means getting better or dying.

Strange error message:

[a_greer2005]

my question I keep getting this strange error message "0-\/\/-/\/-3-|) by Cowboy Neal, He Be 1337 hax0r " is that a security threat that I should worry about?

Re:Make the trusted sites list easier to manage?

[rmallico]

Win2003 has some functionality somewhat like that... Internet Explorer Enhanced Security Configuration... its under the add/remove windows components and its installed by default on Win2003... it is kinda a pain but when you head to a site it asks you if you want to add it to the 'acceptable' sites... might not be the perfect solution for this but it is a start

Re:does this apply to online (hotmail?)

[jkujath]

just no ads is all

That's all?

From their website:

Referral Program
Referral program provides you with a $5 or $10 referral per user that signs up and supplies your Shinyfeet username in the referral ID field.

Here's my question for them

[Khyber]

What is the reason for not allowing me to move the security slider for the internet zone past Medium? Do you think everyone that uses Windows XP isn't technically/internet savvy enough to know what they're doing when they wish to drop the security level, at their own understanding of the possible risks?

Accountability

[mrighi]

When a security hole is discovered, how much accountability rests with the developer(s) responsible for the hole/bug? Have serious holes led to programmers being fired? Is there any sort of incentive for building bug-scarce code?

OMG this promotes OS and it's modded DOWN

[Anonymous Coward]

WTF?

Re:OMG this promotes OS and it's modded DOWN

[Anonymous Coward]

All the OS mod points were spent already and only paid Microsoft /. emps have any points right now, so of course they would mod down such a cunning analogy. That butterfly has some serious angst!

At least *we* all know the Troll mods going around on the grandparent are BS. :-)

M$ +

[Anonymous Coward]

M$ + Security + Guru != Knowledge

M$ stop calling your people security gurus, they are just peons/pawns that you've namebranded for the press.

M$ -10 karma points

Re:does this apply to online (hotmail?)

[downsize]

oh, I forgot about that one. who pays for email services now a-days anyway?

I'm just looking to offer a little insight and get a few ads knocked out of my emailer. I don't need no shinyfeet money....
uh, but if you do sign up for one of those paid subscriptions... (check the sig)

Dear Microsoft...

[Anonymous Coward]

Dear Microsoft...

I heard some "Linux" thing is more secure than Windows. Where can I buy this product from Microsoft?

Re:Time 2 Market vs Security & Fiduciary dutie

[Anonymous Coward]

"Dear Microsoft - it's long been known by us shareholders that your stock has only flown so high because you understood the proper tradeoffs between security (slow and unprofitable) and time to market (== profit == shareholder value)."

Oh, wake up. It's because the company has behaved with a total disregard for anything other than money.

Re:My question would be...

[jojo tdfb]

Probably because that would set a legal precedence for suing the creators of ever OSS Operating System every security flaw ever exploited in their software as well. Spam has to be relayed somehow.....

Re:When will a secure version of IE for the Mac ex

[Anonymous Coward]

Microsoft discontinued IE for the Mac a couple years ago after Apple rolled out Safari. I doubt there will be any more updates for Mac IE.

I think it's great

[promantek]

This just goes to show you what a great company microsoft is.

They are really making an effort to provide end users with the best possible experience, and they are just demolishing their competitors with their lower prices, better products, superior customer service and overall they are just nice people.

Oh, one more thing Bill, you misspelled my name on the check. That's an 'a' not an 'o'. Care for a reach around?

Re:My question would be...

[Mad Merlin]

"Why doesn't Microsoft have to pay back for all the damage done due to viruses, worms and trojans even though business/people pay a lot of money for the product that allows it to happen?"

Have you ever read one of their EULAs? If those are considered law, then they're not legally obligated to do anything of the sort. Then again, even if they were, they probably still wouldn't.

Having said that, I can't say that it's the way I think things should be.

My question for Microsoft

[Anonymous Coward]

Dear microsoft: WTF?

Thank you.

Re:When will a secure version of IE for the Mac ex

[Anonymous Coward]

what the heck do you want something like that for? I've got more browsers than I shake a stick at on my Mac!

Ben English

[Anonymous Coward]

A: Ben English.
B: How long?
A: Ben English since I was born, mate!

Re:When will a secure version of IE for the Mac ex

[ad0gg]

Because osx has Safari. I wouldn't expect a new version IE, much like i wouldn't expect safari to be made available(konquerer doesn't count) for the PC platform. Office on apple doesn't mean jack, much like iTunes and Quicktime means jack.

Re:BBC Television series/Books

[vertinox]

But like Microsoft, the best work was in the 80's.

Re:My question would be...

[Anonymous Coward]

Because it's not 1977 anymore. When you chose to use Microsoft products, you know what you're getting into. If I repeated hit myself in the head with a hammer, does the hammer manufacturer owe me damages?

How about simple best practices?

[smittyoneeach]

I've got the O'Reilly XP Hacks book, but I'd like to see official, supported stuff from the horse's whatzit.

Ask 'em something hard, like..

[Sloppy]

Microsoft has all the momentum of a run-away train. What makes you so popular?

Linux boxs get hacked and know about it.

[Anonymous Coward]

Windows cannot be hardend to the point the linux.

Default Linux is harder than Windows but there are still more levels of protection that can be activated.

seLinux is now default. Lids is still a addon. Lids disables root only way to reconfigure is use a boot disk even deleting logs can be stoped. This is a system breaching persons worst nightmare. Break into a system and not be able to cover there tracks and not able to do major damage.

Basicly Operating systems are flawed at this point but linux is proactive adding features to stop the flaws even if the happen.

Re:Linux boxs get hacked and know about it.

[jojo tdfb]

Blah, their just copying OpenBSD. You can harden up Windows. Shit, something like 80% of Window's security issues go away by throwing up a simple firewall. Not using IE helps , thou now more Firefox issues are coming up so even that's not so true anymore. The biggest security flaw out there that's even cross platform is thinking that anything default will protect you. Any time you think "oh, well I'm secure now" you've probably just been rooted.

Basicly Operating systems are flawed at this point but linux is proactive adding features to stop the flaws even if the happen.

Linux isn't proactive, they're reactive. You must remember, Linux wasn't designed for security, it was designed so that Linus could run Unix on his PC at home for free. Fixes happen because flaws were FOUND not to keep them from being found.

If Windows XP is secure

[amcdiarmid]

Why should we have to pay them for an anti-virus product? (or need one?)

Re:If Windows XP is secure

[Anonymous Coward]

Hard?

Mmm...what about..

640 != enough

Re:Time 2 Market vs Security & Fiduciary dutie

[darkmeridian]

The parent is joking. A shareholder derivative suit alleging a violation of fiduciary duty will be preempted by the business judgment rule. As long as Microsoft decisionmakers were not self-dealing and looked at the relevant research, there is no basis for such a suit.

How can users submit bug reports?

[jondt]

I've got a question here. When I find security bugs in your software, how on earth can they be submitted for you to fix them? The support page offers little guidance.

Last time I found a security bug in IE, I ended up e-mailing it to Scobleizer who thankfully picked up on it quickly. This doesn't seem like a very effective system though!

-dgr

Re:How can users submit bug reports?

[core_tripper]

https://s.microsoft.com/technet/security/bulletin/ alertus.aspx found @ http://www.microsoft.com/technet/security/default. mspx

Why has it taken you so long?

[Threni]

That's my question right there! Why has it taken so long to take security seriously?

Am I missing something here?

[Anonymous Coward]

"Microsoft Security Guru"??...that's my oxymoron for the day.

don't worry, be happy.

[Erris]

Dear Valued Cu^H^H Shareholder,

You ask us "How can you be betraying your fiduciary [konqueror spell check used, thank you] responsibilities to shareholders by delaying products in the name of security ... why don't you return to your security-be-damned buggy strategy and return your stock to the glorious heights it once held."

Don't worry, our future products (TM) will always be buggy. The only problem is that we are out of start-ups to screw out of mature programs because all the developers and startups are now geared to Linux, that evil unAmerican cancer that's draining the life blood out of the stocks you were so foolish to buy from us. In time, if you click your heels together three times and chant, "No stock is better than Microsoft stock," we promise that you will feel better. This works remarkably well for our software users and is the basis of our famous $50/hour phone support. If you are really lucky, hardware manufacturers will collude with us to lock our Linux and all other software, leaving nothing but buggy junk for those without keys. At that time Microsoft will internally switch to Linux and our relative productivity will dynamically soar, and the predicted dinosaur domination will be a reality.

Have a nice day.

One for the list

[Anonymous Coward]

Here is the question I submitted:

During the Microsoft anti-trust trial, Jim Allchin, group vice president for platforms, testified [1] that there were security flaws in Windows so grave that to reveal the source code would be to threaten US national security, including specifically US armed forces in Afghanistan. Within a couple of years, Microsoft was providing [2] that same source code to foreign governments including China's.

Is it safe to assume that Microsoft was able to fix all of these flaws before revealing the code? If so, can you provide any details on the nature of the flaws and on the process to identify and fix them? E.g., did it require large scale changes to Windows' architecture?

1. http://www.eweek.com/article2/0,3959,5264,00.asp
2. http://www.microsoft.com/presspass/press/2004/sep0 4/09-19OfficeGSPPR.asp

Re:One for the list

[sumdumass]

That is a damn good question to ask. I hope it is answered!

While still ontopic

[Seiruu]

Where the hell are the WMD Bill???

Re:FP!!

[Anonymous Coward]

Fuck. Off.

Re:Make the trusted sites list easier to manage?

[Anonymous Coward]

It would be nice to have a button on IE that let you "add current site to trusted sites".


Ask, and you shall be given. This IE5 tweak (works under IE6 too) adds two options to the "Tools" menu: Add to trusted zone and Add to restricted zone

Also, it might be nice to have a "trust once" button, to temporarily trust a site for a single visit.

You can get a similar effect by setting the site to restricted after you're done with it.

Re:Time 2 Market vs Security & Fiduciary dutie

[Anonymous Coward]

Extremely interesting. Is that how companies can get away with other practices that can get in the way of profits, like sane environmental policies, paying fair wages, hiring US workers, etc.

It's a serious question - I hear my previous employer talk about how they're obligated to maximize shareholder profits all too often to justify sleezy behavior; and would like to know what the "right" answer to this excuse is.

My question

[ToasterofDOOM]

Why can't you come out with security patches faster than the open source commmunity you so abhor? You have more trained professionals than open source, ones that are paid to work for you all day long. And, if viruses exist for my OS, doesn't that mean that there is some hole in the OS it can crawl through? Shouldn't you fix your OS fore free rather than charging even more just for a piece of mind?

Pirates, Yarrr..

[Mr. KFM]

My Windows XP was obviously pirated, is a pirated version as secure as the genuine version?

Re:Time 2 Market vs Security & Fiduciary dutie

[Anonymous Coward]

As long as Microsoft decisionmakers were not self-dealing and looked at the relevant research, there is no basis for such a suit.

You sure?

The research shows that poorly secured OS's do vastly better in the market than secure OS's - perhaps due to upgrade revenue, perhaps due to time-to-market.

Security is an expensive, difficult, and labor intensive process; and it's not clear that there is any positive ROI on having a focus on security for the bulk of the market.

If Microsoft is ignoring this research, or, worse, looked at the research but making decisions to the contrary, isn't that a breach of their duties?

Tattooine

[hkb]

Have these Microsoft security "gurus" been hiding out on Tattooine for the past 10 years?

Look at me, I go and see Star Wars, and I'm already a Trekkie!

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Is Microsoft Windows *OS* more secure than Linu

[Stevyn]

and according to linux zealots administrating networks in their basements: NO!!!! OMG!!! ROTFL!!! WTF mate?

and so before I get modded as troll, I'm sure most agree it's not so much the system but the person administrating it to keep it secure.

Re:Make the trusted sites list easier to manage?

[Piquan]

Also, it might be nice to have a "trust once" button, to temporarily trust a site for a single visit.

This is rife for abuse. Remember that once you trust a site, its ActiveX can change all the entire rules for trust.

Sure, you run without ActiveX on, even for trusted sites. But J. Random Luser who sees the "Trust Once" option doesn't. And he doesn't realize that by trusting a site once, he's giving them the ability to take control his computer forever.

Why such a limited audience?

[Gary Destruction]

The article says that Microsoft will respond to ZDNet Australia readers. That's it. And why Australia and not world wide? Was that a randomly selected country or did Microsoft have a specific reason for choosing it? If MS's Q and A's are anything like the so-called "studies" they do, it won't even be worth the time reading the replies.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Let's hope that never happens

[jojo tdfb]

I'd be really distraught. I'd probably spend a week not eating, drinking heavily and listen to really depressing music. I'd also give up computers, move to a mountain and become a monk of some esoteric religion. I'd have to after havening finished my life long quest so abruptly.

Man, that would suck.

Re:Make the trusted sites list easier to manage?

[Nik13]

If you mean for desktop/home users to manage it themselves, I guess that could be useful (not that I think using IE is a good idea at all)

In a corp environment, we don't want users to be able to touch those things, and we (at least I) use vbscript/WMI to change things like that. (MicrosoftIE_Security under \root\cimv2\Applications\MicrosoftIE is where it's at). Other stuff can be accessed in the registry. Making scripts to manipulate those lists isn't hard.

Haven't used IE in so long I've almost forgot what it looks like ;)

Is security really the problem with Microsoft?

[Dolda2000]

You know, I have to wonder -- why care about the security of Microsoft programs? There's so much more that is so fundamentally wrong with the architecture of any Microsoft program that security seems like a rather secondary matter.

To me, it seems almost like discussing the problems of intellectual property in communism. There are so many other, much more important, issues about communism -- it's founded on an absurd philophical model and a historical perspective that's outright wrong. It's pointless to begin discussing IP issues, since there are so much more fundamental problems to discuss before that even becomes relevant.

Who cares if the security model of Windows is absurd? I mean, seriously, what can you expect from a system that is not only absurdly abstracted, but even abstracted in 50 redundant ways, and which has a kernel-level windowing system, a monolithical kernel, etc. ad nauseam. Is security even an issue?

Someone had to say...

[CapnGrunge]

_Microsoft_ _security_ _gurus_

Wow, that's beyond oxymoron.

Security?

[mike518]

"Microsoft security gurus"

Thats gotta be some kind of double negitive or ironic in some way -- i just cant quite put my finger on it.

Oh right!

[Anonymous Coward]

Now they are interested!

And we are now allowed to ask questions about their horrible security problems!

This is bullshit! They were made aware of the problems before they became problems, convinced themselves that there were no problems and now they invite questions about them!

Fuck 'em; just fuck 'em!

Typical...

[SleepyHappyDoc]

They only field questions until May 30th. I wanted to ask them if they wish me happy birthday (the 31st). :(

oxymoron?

[sl4shd0rk]

microsoft......support....guru..... I'm trying to understand those three words in the same sentance and having great difficulty.

"Microsoft security gurus"

[intnsred]

Isn't the term "Microsoft security gurus" an oxymoron?

What's next, a /. Q&A from the US military's "human rights and Geneva Conventions gurus"?

(sigh)

Use strace

[skandalfo]

At least on Linux, the functionality you miss is called strace.

http://www.liacs.nl/~wichert/strace/http://www.lia cs.nl/~wichert/strace/

Re:Use strace

[vdboor]

To be precise: strace -e trace=open /usr/bin/the-app-you-run displays all files being opened by the application.

Administrator can destroy your computer.

[wuemura]

Some time in 2004 i've did some tests to prove that a normal user account it's more secure than the Administrator one. The tests shows that a malware can't infect the system if they do not have the Administrator permission for it.
If the user do not have the Administrator power, a malware will not write to your Windows register, create files in system folders, change IE properties and so on.

I think that Microsoft should give more attention to this details and show the users how bad a Administrator account can be bad for you, intead of waisting millions in new "protection" software.
For thouse that want to watch the videos...
They are all in portuguese (sorry for that), and the SO in the test did not have any updates or any antivirus installed.

How to create a normal account and secute drive C
http://rapidshare.de/files/1815234/segms1.exe.html

Sober.G running as a normal user
http://rapidshare.de/files/1815305/segms2.exe.html

Sober.G running with Administrator Powers
http://rapidshare.de/files/1815380/segms3.exe.html

Sasser running as a normal user
http://rapidshare.de/files/1815590/segms-sasser.ex e.html

Sober.P(O) running as a normal user
http://rapidshare.de/files/1815661/segms-sober.exe .html

The real question

[cwraig]

Dear Micro$oft, do you know why people still insist on using your products??
cause i have no F*kn idea

Dear MS Security Guru,

[plaxion]

I need to harden my system better...

Can you tell me how to get Debian working on my laptop?

Ha-ha! I get it!

[StueyGriffin]

Security! That's a good one! But seriously, what do you guys really do at Microsoft?

WTF?

[Anonymous Coward]

> I would add that the security track record of Windows 2000 (awful) actually compares pretty well to the security track record of Linux 2000 (the awful Redhat 5/6 for example).

Redhat 5??? Let's see. I distinctly recall putting 5.2 on a new box in 19-fucking-97. By the year 2000, I was using 7.3. So, with apologies with people with their head up their ass, you have you head squarely placed up you ass.

make it backwards

[john_uy]

why not ask things like:

given microsoft's excellent track record in security (based on documents published by microsoft,) what does the open source community need to emulate the good practices of microsoft?

given that microsoft does not disclose security flaws in its product to protect the users from malicious attacks reaching them before patches are made, how will the oss community improve on its disclosure rules and prevention of possible news regarding security flaws?

you get my point. just make their claims work against them. i am interested to see their response (that is if they respond at all.)

My post

[Anonymous Coward]

Microsoft is building Trusted Computing/DRM into it's next generation of operating systems. This provides no real security benefits to costumers, but rather provides security to the business models of the members of the RIAA, MPAA, and BSA. On the other hand, Microsoft is pitching this as improving security. Indeed, I suspect that the number Bill Gates gives for security spending at Microsoft includes DRM initiatives. Why should we trust Microsoft's announcements on security, when it is obvious that a large amount of the information released by Microsoft is spins and lies, with no real substance? Or is there some sort of substance that I am missing?