Slashdot Mirror
MS Invites Security Questions
daria42 writes "Microsoft is inviting ZDNet readers to submit security-related questions online to a team of Microsoft security gurus. Microsoft's Ben English and his team will take questions online until the 30th of May. A selection of questions and answers will be published by ZDNet starting from the 6th of June. Submit your questions starting now!"
Why does microsoft not eat it's own dogfood? As a network administrator
I'm contstatly struggling with rights on workstations. I know that MS
gives admin right to all of it's own users. (I live in seattle I've seen
it.) But I can think of no security hole larger then giving out rights
to users who *SHOULD* not need them.
There is a laundry list of applications written *by* Microsoft that do
not work properly without additional rights.
This has been true sense NT 3.51. How did this happen? Upgrading to
longhorn it not a soulution. If I worked for Microsoft this would be
my first priority. Take away rights, fix existing applications.
"think of it as evolution in action"
My Question
Why don't you open up your source? I have an analogy to Open and Closed source:
With closed source, you are in a room full of razor blades everywhere and you are blindfolded. With Open Source, you are in a room full of razor blades everywhere and you are NOT blindfolded, so you can see where the exit is and perhaps avoid getting too cut up.
Which is really safer, closed or open source? Would you rather be blindfolded?
The dangers of knowledge trigger emotional distress in human beings.
"selection"? ;P
One that hath name thou can not otter
If the Microsoft team gets to pick which questions are answered, I doubt this will be akin to Achilles waving his naked foot right under Paris' nose, since questions like, "Why is Microsoft's security better than Linux security?" are more likely to get answered than questions like, "When did Microsoft hire a team of security gurus?"
I Am My Own Worst Enemy
Almost EVERY website that deals with security have commented on M$FT and their security. That would be a good place for Mr.Ben English to start. Not to troll, but I think this is just another PR stunt by M$FT!
Slashdot asks what kind of story will really bring the M$ bashing to an all time high?
It would be nice to see the questions that don't get answered. It would be interesting to see if some questions get glossed over or ignored because of some inherant design flaw.
Maybe someoen would make a lost of all the questions and group all the simular ones together in order to create somethign like this. I guess microsoft is feeling the heat from other vendors stating that microsoft isn't as secure as thier products.
How do you keep your jobs?
I'm assuming you've got some excellent blackmail material on someone in HR but I'd like to know for sure.
They will ignore everything and give generic answers to worthless questions such as "how do I secure my home computer". The answer will probably be something like "use the microsoft firewall and the microsoft anti-spyware program, and a microsoft antivirus program on your geniuine microsoft windowxs xp operating system".
Nothing to see here, move along.
a selection ...
translation
easily answered questions made up or planted by microsoft employs. so they dont have to answer the hard hitting questions.
"When they invent bitch slaps that can go through a monitor you better f'ing duck" --deft (253558)
You obviously get some kind of referrer bonus for sending people to their site. I count three links to shinyfeet.com in your post.
And really, who the hell would want an email address with "ShinyFeet" in it?
This space intentionally left blank.
This is pretty much the most basic question possible, but what do you consider to be the range of behaviors that qualify as security bugs?
For example: do you consider features that require the user to do something insecure (like run as a local administrator) in order for that feature to work a bug? Do you consider system defaults that can cause the user to perform an action they didn't intend to do (such as launching a hostile executable) a security bug?
If you answered "Yes" to these questions, do you consider ActiveX web browser plugin support and hiding file extensions to be security bugs? How soon will a patch be available to fix these bugs? How does the timeframe from "discovery of bug" to "fix for bug" compare to your competitors average time-to-fix for security bugs?
Simple enough, really.
I'm sure they will just beat around the bush like they always do. Gates's arrogance will trickle off.
Comment removed based on user account deletion
1) Why can't you get software out the door that doesn't contain security flaws that you will be spending the next 6 years trying to fix, and still not get it right?
2) Word association: Microsoft -> buffer overflow.
3) Do you understand the concept of "Deny All Except" or has it ever been mentioned to you?
4) Do the 1 million monkeys Douglas Adams referred to work in Redmond?
5) Why is Bill Gates such an ass?
6) Who will protect us from Microsoft?
Ok. So it was more than one question. But one wasn't technically a question.
Come on, does anyone really think that Microsoft is going to select any of the tough questions that they really don't want to address? This is a sham. It gives them a way to say that they responded to users concerns, when in reality they will pick and choose things that can make them look good or give them a chance to attack open source. The more people who participate in this sham the more it servers their purposes.
I'm an American. I love this country and the freedoms that we used to have.
How can you be betraying your feduciary responsibilities to shareholders by delaying products in the name of security, which history has proven that your corporate customers don't give a damn about anyway.
To avoid shareholder lawsuits of you not acting in what has historically been shown to be the best for your shareholders, why don't you return to your security-be-damned buggy strategy and return your stock to the glorious heights it once held?
The second part we can almost say that about: it would at least give them the chance to boast.
I predict we won't see an answer to either part.
See what I've been reading.
Has ZDNET given up even the pretense of being a tech magazine? Have they finally embraced the fact that they are nothing more then a thinly veiled publicity arm of Microsoft?
Where are the real journalists asking the tough questions to the executives of MS and other tech firms. Instead they invite questions from the public there the "experts" will pick the softballs and spew on an on about how safe, secure and super-duper-keen-nifty windows is compared to that communist linux.
evil is as evil does
42
With ActiveX, when all the junk spyware sites would try to install software, it was impossible to always deny the publisher install rights, but you could easily ALWAYS allow publishers to load up your computer with the worst junk imaginable.
If you've ever been to a retirement home using Internet Explorer on a shared computer, you would laugh at how much junk computers would be loaded with.
Along came Firefox, and with it the freedom from training folks to click a million times no to a million ActiveX dialogs. Pop-ups and other forms of nastyness reduced.
All of a sudden a fire seems to have been lit under Microsoft around security and its browser.
Aside from the above listed changes, what other positive changes do you think Microsoft will introduce as a result of some competition, particularly in the browser space, but also elsewhere.
Based on past performance, the MS security gurus should be asking questions of the general public.
Quick background on Mako: http://www.microsoft-watch.com/article2/0,1995,176 4087,00.asp
Having previously been a contractor at Microsoft and being intimately familiar with the security setup of their online properties (Hotmail, passport, messenger, etc.) the dynamic systems protection area was one that would get the most play (and benefit) on the server side. Automagically monitoring system state and port management would be extremely useful if it was a part of the server OS.
Do not taunt Happy-Fun Ball
Of course, most linux vendors haven't issued patches or advisories either, but at least some of them have been talking to me...
Tarsnap: Online backups for the truly paranoid
Instead of flooding them with so many questions that they can easily ignore the hard hitting ones, how about a Slashdot Interview style selection of good questions which we then submit as a group.
We should show them the /. effect and send nothing but linux security questions
And it would be just as much a waste of effort. The current design of windows is so flawed when it comes to security if microsoft actually listened to their customers, would have to revamp their entire security model in the OS breaking just about everything in windows. Microsoft is in a very tight spot right now with their design of windows and anything more than lipservice on their part would mean making a very hard decision to change the OS so fundamentally that it is not compatible with its predecessors and is something they cannot afford to do. As it stands, the security or lack of security in windows will remain for quite some time. There are tricks they can use to minimize the damage once security has been breached. For example, Upgrade the active/x layer to allow a 'read-only' mode for a given process wherein the first thing the web browser does when it starts up is to neuter itself. Whether you run IE as administrator or not, it's a safe bet that more harm than good can be done letting it run silently. By having IE issue a call to a one-way demotion of privileges, along with a 'this application is trying to do this. Enter your administrator password to override for this one time occasion', would vastly improve but not solve the security problems. With this simple trick, spyware infested web sites would have a much harder time installing their wares without you knowing about it. Again, it wouldn't solve that security problem, but it would greatly improve it.
Then again, maybe, yeah. We SHOULD ask them how to secure our linux boxes better. At least I'd get a kick out of the reaction from the microsoft soldiers.
Is there an easy way to see which files have been denied access to (and what types of access) so admins can set ACLs quickly to allow regular users to use programs which normally require administrator access, but shouldn't (ie simply accounting)?
Microsoft apparently has fine-grained access, rights and permissions built into WindowsXP. Where are the tools to manage those permissions?
By the way - HOME users need those tools, too. They would (could) go a long way to preventing zombification.
You're looking for quotes? See my journal.
my question I keep getting this strange error message "0-\/\/-/\/-3-|) by Cowboy Neal, He Be 1337 hax0r " is that a security threat that I should worry about?
You know Microsoft has a Linux lab, right? The problem is they probably could answer your questions and possibly seal up a few security issues that could have bitten you in the ass later. Your right about Windows being a flawed model, but they said the same thing about Unix 20 years ago. All security models are flawed that allow people in to do things like "run programs" and "view data".
I've yet to see a secure os and it's not from lack of effort. I've been looking for an os that doesn't suck for years.
Linux is really boring from an os standpoint. Now Plan 9......
If they're guru's... why are there still issues after hundreds of "fixes" over the years?
The same reason Linus and hundreds of other people still do patches to Linux. No software is truly finished and secure. Not even Hello World. There's a really nasty buffer overflow in that one. I don't even know why people still use it.
Linux is really boring from an os standpoint. Now Plan 9......
I've got a question here. When I find security bugs in your software, how on earth can they be submitted for you to fix them? The support page offers little guidance.
Last time I found a security bug in IE, I ended up e-mailing it to Scobleizer who thankfully picked up on it quickly. This doesn't seem like a very effective system though!
-dgr
You ask us "How can you be betraying your fiduciary [konqueror spell check used, thank you] responsibilities to shareholders by delaying products in the name of security ... why don't you return to your security-be-damned buggy strategy and return your stock to the glorious heights it once held."
Don't worry, our future products (TM) will always be buggy. The only problem is that we are out of start-ups to screw out of mature programs because all the developers and startups are now geared to Linux, that evil unAmerican cancer that's draining the life blood out of the stocks you were so foolish to buy from us. In time, if you click your heels together three times and chant, "No stock is better than Microsoft stock," we promise that you will feel better. This works remarkably well for our software users and is the basis of our famous $50/hour phone support. If you are really lucky, hardware manufacturers will collude with us to lock our Linux and all other software, leaving nothing but buggy junk for those without keys. At that time Microsoft will internally switch to Linux and our relative productivity will dynamically soar, and the predicted dinosaur domination will be a reality.
Have a nice day.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Come on now, bit much to ask that Longhorn can run OS9 apps isn't it?