Slashdot Mirror
MS Patch Train Leaves the Station
per1176 writes "Microsoft has released 10 advisories to cover a dozen security vulnerabilities, including a "critical" cumulative update for the Internet Explorer browser. The IE fix corrects a remote code-execution vulnerability that exists due to the way the browser handles PNG (Portable Network Graphics) files."
Does this fix the crash with large streched images?
ie width=9999999 height=999999 in an
That's hilarious, because IE barely supports PNGs at all, but they apparently are vulnerable to them nonetheless. If you don't know of the png problem, they just don't display the colors right and/or won't do transparencies right at all.
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
but is there an obvious point where software become more patch then content?
Lately I envision all Microsoft products as lumbering stay-puff marshmallow men, ambulating labored steps inside a comical suit of band-aids.
:::: the insomniac's digest
Why not just release a patch that uninstalls IE?
After the jpg incident, wouldn't you tend to look at the code handling other image formats for similar problems? Guess not.
Okay, I'm not familiar with IE's internals. But I still cannot understand how you'd introduce a remote execution vulnerability into "get PNG bits, arrange bits for display system" unless you were *trying* for that. Yeah, I know you have to allocate memory for the PNG, and I understand the problem probably comes from an overflow of that, but still, it makes me wonder just how badly written this stuff must be.
Microsoft has released a free security update to Windows users today: Service Pack Linux. Service Pack Linux includes a fix for all IE vulnerabilities, as well as flaws in Outlook and Office. IIS users will be happy to know that Service Pack Linux will fix many problems with Microsoft's premier web server package as well. Service Pack Linux is considered the most comprehensive security fix in Windows history. Users should get it now at http://distrowatch.org/
-py
http://www.us-cert.gov/cas/techalerts/TA05-136A.ht ml
Best Buy can have you arrested
I thought they might have fixed the png transparency bug, which was reported to them eight years ago... but no... just a buffer overflow.
For those admins who tend to a small MS shop and don't have the need for an expensive patch management solution, WSUS was released last week to replace the lame SUS (Software Update Services). I had to disable SUS due to some GPO issues, so I'm looking forward to checking out WSUS. And with this round of patches, it seems like the ideal time to test.
Entrepreneur : (noun), French for "unemployed"
Never needed MSFT to put in a "backdoor" for them, specifically. Christ, they just needed the source-code so they could use all the ones there were already there.
Your problem is that you listen to Kim Commando in the first place. :P
Any new on latest FireFox vulnerabilites? Have they been patched?
Sorry, I don't use linux and I openly profess my general ignorance.
That obviously makes me a minority around here. Twice over, in fact.
:::: the insomniac's digest
You'd better go here and install the Fedora updates (three in the last month)!
Best Buy can have you arrested
You know, you DON'T HAVE TO UPDATE. I haven't updated my XP box for almost a year now. I'm still running SP1 and no anti-virus (I know how to use the TASKLIST command). Guess what, I have no problems, save for the occasional crash due to Photoshop being a bitch. The difference between my unpatched Windows not getting spyware/viruses is that I'm not a dumbass and try to download Buddy Handjob Bar or whatever it's called. That, and I use FireFox, which has NEVER failed me.
IGB: More fun than eating oatmeal!
exists due to the way the browser handles PNG (Portable Network Graphics) files."
/frustrated by lazy programmers
Hmm... Buffer overflow maybe?
Buffer overflow is an amateur mistake. Check your god damn code.
The Kim Commando show? Seriously, that show sounds like they put a phone in a mental institution and let the patients phone in. Please don't use that as your proxy.
Finance tutorials and more! Understandfinance
It's happened to me twice now...
I'll install a vanilla copy of XP Pro onto a system, and within minutes of hooking the machine up to the network, it has become infected with a virus, basically requiring a reinstallation immediately.
My normal mode of installation is:
- Install XP
- Two IE windows open:
- One downloads Firefox
- The other goes to Windows Update and starts downloading patches.
- Download everything else using firefox, including drivers, etc.
But apparently Windows Update isn't a fast enough method to get the machine patched, and the machine is compromised before the appropriate patches are finished being applied.
I've made a "XP Install Disc 2" for myself, which has the full SP2 installer file, Firefox, Avast, Spybot, and Adaware on it, that I then install while the box is still offline. It seems that SP2 does well enough at plugging exploits that the system then has enough time to download the other patches normally without becoming compromised.
Does anyone have a better solution?
A humor security issue has been identified that could allow a Slashbot to remotely compromise your sense of humor about Windows patches and bore you to death. You can help protect your sense of humor by installing this update from Microsoft. After you install this item, slashdot.org will resolve to 127.0.0.1 .
How to Uninstall
Read all comments rated as funny under a story about Windows Update on slashdot.org and your sense of humor will be successfully uninstalled.
Help and support
http://omgmstehsux0rs.slashdot.org/
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
MS releases a patch and it's news?
One ring to bind them - should probably have more fiber and less rings in their diet.
The amount of "CPU time" "Windows users" spend patching holes is a few minutes every month. And get off your high horse, here: while Linux distros provide updates for a more comprehensive range of apps, it's also the case they you have to download far more (in terms of raw megabytes) far more often. I'm willing to bet right now that, timing from the release of FC3, FC3 has required more and bigger updates than Windows.
I'll never forget the time, earlier this year in fact, when Mandrake provided a security "update" for the kernel (you may remember the much-publicized priviledge escalation vulnerability around the end of last year). This "patch" consisted of the whole kernel source (maybe 40MBs of it) which you would have to manually compile and install (no nice binary rpm, here). With this one single update, Mandrake users have exceeded the "CPU time" required for a few months of Windows updates. And let's not forget the hefty kdelibs security updates, which basically amounts to downloading the whole of kdelibs again, since none of the distros seem to provide diff-style patching. The same with Firefox (8MB on Linux...?).
Also, while we are free from worms and viruses here, note that there is nothing innate to Linux that precludes phishing and spoofing attacks.
Ugh.Want good tech radio? listen to Leo Lapporte on KFI on the weekends
train I don't ride anymore - thank goodness.
goodbye billy and steve - have fun with your os. glad you are thinking about security.
> And, do I need to remind you about stability issues with Debian Sarge?
Yes. No problems here...
1. Why is it news when MS releases a patch? It happens every week.
2. First a JPG problem, then a PNG problem, so what's next? A GIF and a BMP problem? Or are we moving onto video formats next?
~Ilyanep
To get message, take amount of carrier pigeons at each stage mod 2. Then decode binary.
If you look at Macintosh, BSD, and Linux distributions, they also have regular security updates, with many similar vulnerabilities.
There are really two problems here, one true of all major OSes right now, and the other one true of proprietary systems.
The first problem is the pervasive use of C and C++, which makes systems unnecessarily prone to buffer overflows and related problems. C and C++ programmers keep saying that they can handle it, but it is obvious that they can't.
The second problem is that Microsoft and Apple only update their own applications; users are saddled with downloading updates for other software by hand. If all these bugs exist in IE, you can be similar bugs exist in Photoshop, Office, and many other apps that aren't automatically updated.
Otherwise known as the Bugwarts Express. To find the boarding platform, run your luggage cart full tilt into that blue screen.
Don't blame Durga. I voted for Centauri.
I use mandrake, I have since 9.0. I have _never_ had to compile the kernel from source. You urpmi the source from the command line. The mcc interface will NOT install the kernel automatically. You have to do it manually.
In older distributions, you would simply type urpmi kernel (or whichever of the other kernel's you're using, like enterprise, etc.). In the recent mandriva releases, you have to type urpmi kernel-2.6
Obviously you haven't been using linux often... Where did you get the impression that you "had" to compile it from the source package?
Maybe as an engineer who uses computers to actually accomplish something I just have a different point of view.
Or maybe you're just a pretentious holier-than-thou asshole who doesn't realize that some of us use Windows because that's what our products are delivered on, or we need a piece of legacy software to do our work, or our kids have Windows-only games, or we've never heard of Linux so we don't know there's alternatives to Microsoft, or our bank requires IE, or any of the other thousand and one reasons some people use it.
There's no need to assume we're all idiots, you know.
PS. phishing and spoofing are platform-agnostic. Without the right knowledge, your grandma would get owned by PayPal scammers no matter if she ran Windows or Warty (or anything else, for that matter).
the coolest club on
We can't go back to gif, can we? ;-)
Exercise caution when modding this message up: the author acts like a jerk when his karma is excellent.
Currently getting FC4 to install, but, actually I mainly practice safe networking with a Linksys router/firewall at work and an OpenBSD gateway at home. The point is I like to use a computer for computing and getting work done. When I was a Windows admin several years ago it was a daily/weekly event for employees to come running in worried about the latest vuln. attack they heard on the news - I can completely do without all that static and distraction, it just seems to come with the "Windows culture", which came from their long standing practice of releasing not ready for prime-time software and then patching it later in the field, because it's legal to do so and they could get away with it.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Also, when you have sex, you DON'T HAVE TO USE CONDOMS. I haven't used condoms of my box for almost a year now. I'm still running high and no aids-virus. Guess what, I have no problems, save for the occasional clash due to girlfriend being a bitch. The difference between my unprotected sex not getting aids/viruses is that I'm not a dumbass and try to have sex with everybody in Bars or whatever it's called. That, and I use a fidel girlfriend, which has NEVER cheated me.
It's the Paaaaaaaaaatch Train! The longest running update progam in computer history. Now with your host Steve Ballmer!
Thalasar
The sad thing is that you probably don't know whether your PC is infected or not (and it most probably is). It's dumasses like you that make life so difficult for sysadmins who have to battle the attacks from zombie PCs.
Something is happening here but you don't know what it is, do you, Mr Jones.
If MS doesnot patch you all say "MS wont patch their crappy stuff"
if they do patch, you all say "Wow, it must suck really bad to have to patch it"
As if Linux doesn't require constant patching either, hypocrites
Without actually using AV software, you'd verify this how? Don't pretend that the tasklist command from the CLI (just a text version of the Task Manager) is going to save your ass. Most viri don't tend to show up in such a perfunctory fashion. I'd be willing to bet your box is in alot worse shape than you think it is. Don't be like those guys who have sex with random people wihtout protection because they have a false sense of immunity from what affects everyone else. Your Windows isn't special.
Slashdot: Playing Favorites Since 1997
I'm still running SP1 and no anti-virus (I know how to use the TASKLIST command).
I suggest you Google for "Rootkit".
You may also wish to Google for "Over confident" or "has it coming".
Hope this helps.
I mainly practice safe networking with a Linksys router/firewall at work and an OpenBSD gateway at home.
Does your firewall block outgoing HTTP connections and incoming email? If not, then it's not going to help against attacks like this PNG bug which are propagated through user-pulled data rather than attacker-pushed port connections. Such attacks exist for Linux, too. There is no such thing as "safe networking", and the only way to come close is to keep every connected computer up to date. I think Fedora still comes with up2date searching for updates in the background and displaying the results on a panel icon. Unless you use something else for security updates you ought to be clicking on that every time it finds something new.
This is all partly as a result of the way the PC platform itself works, it's merely that Windows has got so much compound crap in its code that these things are bound to happen. As Linux distros continue to grow and mutate and people ignore the old idea of the smallest kernel possible, we're going to see more buffer overflow errors on Linux. If BSD had the same kind of useage rates as Linux, we'd see a similar trend there. Mac OSX is taking off, we're going to see evolutionary crap in its genetic structure as it were.
Tearing Windows present design platform down to the smallest parts and scrubbing and rebuilding would probably put back the release of XP's successor to 2016. Let's hope some people are listening on the Linux and OSX sides and get it in their heads to keep their code lean and healthy and well tested.
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
Comment removed based on user account deletion
I just installed the latest update for windows 2000 on my wife's computer and it hosed the installation. I assume it included these latest patches. Has anybody had a similar experience? I am getting a "SYSTEMced corrupt or missing" error which google tells me has to do with registry problems.
apparently so. Maybe the moderators should realize that we get a little icon that pops up telling us it is there hours before the story even gets posted. Just imagine if we had a slashdot story for every *nix patch as well. We would be nothing but patchdot.org. I'm sick of these and the stories about how something is 1 yr older.
Two roads diverged in a wood, and I - I took the one the bus load of girls just went down.
Your naivity would be amusing if it wasn't such a pain to those of us who have a job to do. Are you sure you're old enough to be using a computer?
Something is happening here but you don't know what it is, do you, Mr Jones.
That's right, there is no absolutely, guarenteed, bullet-proof 'safe networking' - but there is SAFER and RISKIER, and I feel much more comfortable with the level of risk in this box than exists with any M$ft product. Are there vulnerabilities on this box? Most certainly. Have there been any incidents? No, zero, none, nada. Am I going to chew my fingernails off and live in a perpetual state of paranoid anxiety worrying about potential exploitz? Nope.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
I'm surprised no one has yet mentioned the problem one of these "critical updates" is causing on Dell Optiplex GX280 computers. I had two systems on my LAN mistakenly configured with "automatic updates" that had serious problems after one of these updates was installed. The user complained that they would turn on the computer and after about 10 seconds (before they could even finish logging on) their monitor would turn off. I first thought it was a monitor problem, but changing monitors didn't resolve the issue, so I called Dell Corporate/Gov't. Tech Support. Before I even got through the menus to a live body, there was a message on the line suggesting that if you were having video problems on Optiplex systems after installing the Critical Update, you should re-boot the system in VGA mode and change the default resolution to 800 X 600. Apparently, one of these updates re-sets default resolution to a range that cannot be supported with the built-in video hardware on the Optiplex.
Once you re-boot in a low resolution, you can then re-set the default resolution to something more acceptable (say, 1024 X 768 or something similar) and you're golden, but I have seen nothing in the press about this bug (that took me well over an hour to puzzle out on both affected computers).
My other systems are configured for SMS control, so patches aren't rolled out before testing, but these were set up to Auto Update (which Microsoft recommends for everyone, despite problems such as this). Otherwise, this could have been a major headache yesterday.
He forgot to say that it's not on a network :)
"Give a woman two glasses of wine and some pad thai, and they'll agree to just about anything." the Sports Guy
Maybe as an engineer who uses computers to actually accomplish something I just have a different point of view.
Ugh.
I would agree this is an awkward way of putting it -- but stressing the different usage-patterns of your typical engineer vs your typical joe 6p is in itself a valid point, I would say. There is a point where insisting things being in some respect "equal" is self-defeating.
Recognizing a difference does not necessarily invalidate one or the other "variant," in fact it often allows the best to emerge in each.
I guess what I mean is that, though perhaps poorly worded, my GP actually just pointed out the different usage patterns, but perhaps was not actually saying that computing the "joe 6p way" is inferior somehow. Just different, is all.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)
Well, seeing as there's no 100% foolproof method of determining this anyway (your AV could be out of date, or just behind like some vendors seem to be, or you could have a new virus no one else has seen yet)...
It's pretty easy to not get a virus in Windows. How? Well, there are 3 basic ways you get infected:
1. Listening network ports with compromisable services. Solution: install a NAT'ing router with firewall. Paranoid solution: install Zonealarm or one of the dozen other competing offerings as well. Have fun remotely exploiting my machine when you can't connect to it.
2. Opening infected executables. Solution: only install software from trusted sources. Paranoid solution: only use what the standard install comes with. Believe it or not, not everyone installs 50 pieces of extraneous software. On my last remaining Windows box, I think Winamp and a Citrix client for work is about it. These installers have long since been checked for viruses and are installed from known, good, read-only media. Good luck infecting me there.
3. IE, Outlook, or other network-aware application exploits. Solution: turn off activeX, javascript. Paranoid solution: don't use these apps at all. Find small, niche apps that have never been exploited - yes, these do exist.
This growing attitude of "if you don't run AV software, you're probably infected" is disturbing. Viruses and worms don't just magically appear out of nowhere, they come in through known, predictable routes. Close those routes, and you prevent infection. Well, until virus writers become so sophisticated that they can fake out a TCP/IP stack entirely - in which case they can probably fool your AV software as well.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Possibly - God knows I'm always putting my foot in my mouth whenever I go off on one of my rants :) One of the perils of a communication medium where all of the usual verbal cues and body language are removed, I guess...
"...putrid arrogance and condescension..."
m ageLoader (src='image.png', sizingMethod='scale')" />
Sad little man. The previous poster wasn't calling you a sheep, but I will. Sure, you can run Windows because it 'Just sucks...err....works out of the box' and be constantly on your guard against the mentioned spyware, malware, trojans, viruses, etc. The plain fact is that OSS bugs and security flaws are generally less damaging, less frequent and resolved faster than the flaws in MS products.
You completely failed to mention Gentoo when trying to rip Linux. My updates can be several hundred MB in size, but I don't mind. It is the price I gladly pay for software that 'just works, and works the same every time.' For 20+ Linux systems and servers, I download a new source package once. Centralized NFS distfiles directory prevents me from wasting valuable time downloading the same update on every machine. Do I need to mention how Windows handles this situation? There are obvious advantages to using Linux (as well as other FOSS) that many MS evangalists REFUSE to see.
"I beg you to come unto me, brothers and sisters. I have seen the light and I can lead you to your salvation or possibly your doom...."
Weren't we talking about PNG on IE before? Someone mentioned the transparency issue in a different thread, which can be resolved with this code:
<img src="blank.gif" style="width: 100px; height: 100px; filter:
progid:DXImageTransform.Microsoft.AlphaI
You may want to implement browser specific insertion of that code...it totally doesn't work in anything but IE
Word!
"Lame" - Galaxar
That is not the point, the pont is, that Microsoft never rolled out a workable PNG solution although the bug has been reported first, around 8 years ago. Even worse, the IE5 on the MAC does PNGs properly!
none of the distros seem to provide diff-style patching.
Suse 9.3 does, as I'm on dialup it's a godsend.
As it's now GPL I wish other distro makers would look closer at YAST, it's by far the best config etc tool I've seen.
We have our own here in the UK, only we call it a "Carol Vorderman".
...exists due to the way the browser does not handle PNG files. The web would be a beautiful place if content creators could depend on complete PNG support. This problem has been around for over 8 years! IE blows.
That's cool - does anyone else? I'm surprised it's not much more prevalent in non-source based distros, as I know that in at least Debian, every .deb contains a manifest of all files that will be installed by the .deb, and I think a md5 of each one, too. It strikes me that it should be easy to create a "dummy" deb that verifies that the old version has not been tweaked and, if not, simply replaces just the necessary files with fresh copies.
Dell Support Page
Just because you used Firefox doesn't mean you shouldn't update your IE... It's not like the update will harm anything on your PC, so why leave the vulnerabilities open in the first place?
I have to say it was really nice to wake up this morning and have my system ready to reboot after it installed the patches.
Hands off security.
Yummy.
Pretty Pictures!
www.eweek.com is not responding, I can't even read the article...
Is there a mirror somewhere?
I'm using IE7 which has full PNG support amoung other things I'm not talking about.
Our home network is NATed and WinXP SP2 isn't mandatory.
The biggest problem is the occasional spyware infestation. And even that doesn't happen very often anymore. Decent ad-blocking software filters out most of the crud.
I run a virus scan every now and then just to be sure the various programs I've downloaded are clean, but I haven't checked in weeks and honestly I'm not worried.
I'm moving the household over to FireFox (love adblock and greasemonkey) but even with that, I'm the only one who visits shady warez sites.
Viruses are reaching a level of sophistication where most people won't even know they're installed (even if you've got a fancy scanner) because they hook in at the kernel level or use some sneaky pete masking techniques.
Don't believe the hype
[Fuck Beta]
o0t!
Whoever modded this transparent tripe up should be ashamed of themselves.
Obviously not using IE though, it doesn't support transparent tripe.
but they can't just go and change the way their browser treats content any time they feel like it.
So your basic argument is that because flaws in IE6 have stunted web development to this point fixing it would cause chaos and should be avoided. Continuity of error over correct implementation of standards simply for order's sake.
I can't think of a better argument for ending IE domination or the web or an illustration of the ill effects of monopoly.
=tkk
Bill Gates - Creationist?!?
i have WIn XP Pro at home and never have i had a virus, malware, etc etc, no spur of the moment reboots, no bluescreens. i have cable internet so the computer is on 24/7. i maybe have to reboot once a month for new windows updates but thats about it.
"It's crap like this that makes me wonder at the possibility of Apple eating Microsoft's lunch on the OS front."
t ml 1 528). The flaws include a healthy number of buffer overflows and integer overflows.
That's interesting considering that Mac OSX also has security updates released regularly.
http://www.us-cert.gov/cas/techalerts/TA05-136A.h
US-CERT, 2005-05-16: "Apple Mac OS X is affected by multiple vulnerabilities" describes the ten vulnerabilities addressed in Apple's most recent security update for Panther (Apple Security Update 2005-005, released last month http://docs.info.apple.com/article.html?artnum=30
-- "I never gave these stories much credence." - HAL 9000
I believe a third party patch is available for that.
http://macuser.pcpro.co.uk/news/72440/tiger-widget -vulnerability-highlighted.html
"Screwts! Screwts! Screwts!"
Don't blame Durga. I voted for Centauri.
I'm expecting this to be exploited by a Blaster/Sasser type worm. Time to go on Terry Tate mode looking for users with laptops...
Yes, my only tool is a hammer. And you're starting to look like a nail.
+1
I agree. Patching windows is far more comfortable than patching linux.
The linux zealots are absurd regarding the PNG issue: buffer overflow in linux libpng was discovered a little while ago - exact same problem. Linux is just as vulnerable to buffer overflows as windows (until all distros use add execshield by default).
The linux zealots need only enter the following in google:
site:http://www.cert.org/advisories/ linux
And they'll get quite a few results.
I use suse, and patching is much easier than with other distros, but still nowhere as comfortable as windows.
Would it kill MS to release patches when the vulnerability is fixed, rather than waiting for some magic 'patch release day'?
"We are all geniuses when we dream"
- E.M. Cioran
The illusion of security... I bet you dont use a firewall either. Part of my job is cleaning malware off of computers, and about 75% of them say "but I'm so careful! I never download anything I dont trust completely, and I use firefox!" Unfortunately, if you dont have an AV, you're playing with fire. Tell me you use a sandboxing setup and have a clear understanding of your registry, and use a top of the line firewall, and I might believe you've got a clean system
To err is human, to really foul up requires a computer
Does Tuesday's patchfest include the Several Critical MSIE Flaws Uncovered on May 15? Or has Microsoft finally fixed IE bugs faster than Mozilla fixes Firefox bugs contrary to what I argued last month?
It must be Windows. It needs half a gig of RAM and a hardware-accelerated graphics card just to run Solitaire.
I'm also running XP w/o service packs: I did install the RPC patch because at that time I was on dial up, so didn't have a router to help out. But other than that, Windows update is switched off and I've given SP2 a wide berth... Yet staying virus/crapware free has been very simple: don't be a retard. Don't use networked software which is widely renowned for being swiss cheese (Outlook (Express), IE), and don't run britney_nude.exe. If you're not a total dunce, it's incredibly easy to stay clean in Windows.
If you are a total dunce, you can bet you'd be able to hose a linux system as well. And don't give me that utter, utter bullshite about how "linux is properly multi-user so only your home directory could be affected". WTF? Do you think I care about OS files, which I can reinstall easily anyway? Or do you think I care about MY data, MY music, MY writing, MY photographs, MY code, which (if you lack up-to-date backups) are simply irreplacable?
Don't get me wrong, I fully accept that MS's security track record is dismal, and they make it far easier than it should be to install crapware. That doesn't really change the fact that it's perfectly possible to stay clean in XP with nothing more than a $50 router and a lick of common sense, nor the fact that it's perfectly possible to screw up a *nix / OSX / whatever box just as badly as XP given an equivalent level of naivety and stupidity from the user.
Are we going to do this every month?
It's not like the update will harm anything on your PC
*gasping for air*
Man, I needed that laugh. Thanks!
Dissolve... Resolve... Evolve...
Take the Patch Train to Crashville
And I'll meet you at the station.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
I don't see C/C++ as being the problem. It is more that the security hurdles in Windows makes it impossible to run efficiently in anything but a privilaged account. This allows malware of all sorts to take advantage of vectors not found on other Operating Systems. Opening an email could infect your system if done in a privilaged account. Reading a web page could infect your system if done in a privilaged account. Browsing the local network resources can infect your system... So on and so on.
You'd have to be a zelot fanboy to recognize that any Operating System is a complex software system. Complex software systems are prone to bugs and as pointed out every one of them receive regular updates to patch problems. The problem with Windows is not the bugs but the way they handle them which makes the entire process of correcting flaws painful. Today I've been chasing people to reboot after installing the patches (thankfully I can force the patch install remotely) their system because I know 90% of them won't reboot their machines. I tried once before to reboot in the early mornings but I got an earful from multiple people who didn't save and left things open.
Windows is not only hard to patch in the enterprise, its hard enough to work with that people won't close applicatons! Talk about a double whammy.
The sad thing is that you probably don't know whether your PC is infected or not (and it most probably is). It's dumasses like you that make life so difficult for sysadmins who have to battle the attacks from zombie PCs.
And how do you know that your computer is not infected?
I was thinking at first that I agree with you, but then, how many holes have been found in sendmail since its inception. You'd think with armies of open source programmers and decades of time, they'd get this thing nailed down. Evidently not that easy, or maybe the fundamental design is just flawed and the only real solution is a ground-up recode (enter postfix or exim or qmail type stuff?)
I don't presume to know it all, and I'm not pointing any fingers, it just seems to me like Microsoft is a victim of it's own legacy code and bad design. They designed windows as a single user, trusted system and then tacked on multi-user ability and unsurprisingly, have had problem after problem with untrusted code and exploits, etc. In much the same way, Linux and Unix apps even as old as sendmail can be a victim of a bad design decision (setuid binaries, too many weak points in the chain, etc)
I'm not exactly defending Microsoft, but it's not a problem unique to them, either.
-Jay
I know I'm NOT INFECTED because I'm a system admin, you asswad.
Run->CMD->tasklist
I know each and every legit process and those that aren't.
IGB: More fun than eating oatmeal!
You're an idiot. Why don't you stick to being an "MS-only-AOL-user" and leave the computing to the real programmers, mmkay?
IGB: More fun than eating oatmeal!
If real programmers think it's OK to run Windows without patching or a virus checker I think that I'll stick to being a sysadmin.
Something is happening here but you don't know what it is, do you, Mr Jones.
I agree that it's difficult to know for sure. So I run behind a NATed router, run anti-virus software, keep scrupulously up-to-date with security patches, and use a firewall to block all incoming ports and all outgoing ports that I don't use.
You're right that I can't be absolutely sure but it's a lot safer bet than the idiot whose running without patching or anti-virus.
Something is happening here but you don't know what it is, do you, Mr Jones.
The problem is that's pretty hard to defend against those things. Home users don't know how. Corporate network administrators have hundreds of interlocking "business requirements" that prevent them from shutting the door to "critical services" like SMB file sharing between PC systems.
Worms get into corporate networks through a variety of means, borrowing techniques from viruses and mass emailer viruses, as well as adware and spyware. Some of those holes are impossible to block on a typical corporate network. Take the Internet Explorer holes in corporations that have spent the last several years deploying "internet based applications" that only function correctly with Internet Explorer, for example. Can't block 'em. Might take months to patch 'em if you have tens of thousands of PC systems.
Once a worm gets into a network by exploiting a single system through a mundane virus or adware-only hole like this, it's likely to find a wormable exploit on many other systems. Once a worm is inside, the soft candy center of the corporate network is difficult to defend from a worm with conventional techniques, which are typically perimeter defense in nature.
Even worse, some of my clients have reported that they have, out of tens of thousands of users, at least several who seem to get their PC infected over and over and over. They suspect that this is a "coffee break effect". The users learned that if they double-click on the occasional malicious attachment that leaks through the antivirus email filter at the gateway, and the one on their PC, they get the afternoon off because their PC is taken offline by the network admin staff.
So AntiVirus really is part of the layered defense required for "closing those routes" in the modern age for most companies and home users.
By the way, the observed incidents supporting the "coffee break effect" are the worms and viruses that successfully exploit the patch gap or the definition gap. Most of the time that users double-click to unzip, type in the password and then double-click to execute a malicious attachment, they are thwarted by the AntiVirus system.
If you mod me down, I shall become more powerful than you could possibly imagine.
Maybe I've been lucky, but none of the critical updates I've applied have screwed up my system, heh. Neither did this one. ...It's still funny how IE craps the bed when it tries to render a transparent PNG, though (post-update).
This set of patches destroyed the registry for me on a XP SP1 machine. End result was a blue screen just before the login screen appeared. YMMV, but I spent a good part of this evening fixing said machine.