Possible RSS Abuse in Longhorn

dMill writes "There has been a lot of discussion about Microsoft's decision to bake RSS into Longhorn (see previous Slashdot coverage) but the obvious security implications seem to be on the back burner. eWeek has a story discussing the risks and Don Park is also warning about the potential for abuse and exploitation. For example, the primary mechanism behind podcast, RSS enclosure, can be used to deliver worms and worse to the desktops. If there are any vulnerabilities in iPod (or any MP3 player hooked up to podcast sync client) codec, then podcasting is a good way to deliver overflow inducing content."

Comments

Microsoft products abusable?

[Musteval]

Well, I never!

Not IF there are vulnerabilities but WHAT they are

[WillAffleckUW]

let's not be obtuse - we know there are vulnerabilities, MSFT just doesn't want to fix them in a way that won't let them steal the underlying patents from the public and others.

[caveat - I own MSFT stock]

Worse than worms?!?

[zerocool^]

Worse than worms?!? Worms can get into your system, slave it, erase or steal data, slow it down, advertise to you, and any number of other things! What's worse than lost data, identity theft, popups, and a slow computer? Strangulation via TCP/IP?

~Will

Re:Worse than worms?!?

[Trigun]

copying a folder of lolita child porn to your hard drive, mucking with the dates, and sending a tipoff to the FBI?

I'd rather have the worms than Hepatitis and UPIAs in the shower.

Re:Worse than worms?!?

[gclef]

This

Re:Worse than worms?!?

[Anonymous Coward]

Autosubmitting postings to "alt.wesley.crusher.die.die.die" in your name?

(Sorry man, couldn't resist.)

Re:Worse than worms?!?

[dr_dank]

Strangulation via TCP/IP?

Don't worry, there'll be an RFP for that soon.

Re:Worse than worms?!?

[krakelohm]

Just drag your ass along the carpet seems to work for some.

Re:Worse than worms?!?

[idontgno]

Tapework Contagion Protocol/Infestation Protocol

Re:Worse than worms?!?

[idontgno]

Crap! Stupid "submit" button moved. Must be an RSS worm.

Tapeworm Contagion Protocol/Infestation Protocol

Hey, if we filter RSS packets for the IP Evil Bit, we should be safe, yes?

Re:Worse than worms?!?

[AuMatar]

And emailing death threats from your email to bush@whithouse.gov

This could make things interesting.

[AltGrendel]

Especally in light of this previous article.

OS X

[m0rph3us0]

I guess OS X must be REALLY insecure then.

There is a big difference between RSS being a security risk and a bad implementation of an RSS reader and poor security model being insecure.

Re:OS X

[Iriel]

It's not just a matter of a bad implementation. Even seasoned sysadmin pros will tell you that part of the reason Linux is so secure is because the public doesn't perceive it as The Enemy and script kiddies don't think it's so much fun to take apart and take out a RedHat server as a Window Server 2003 one.

Of course Micro$oft will completely screw up RSS implementation, and that's to be expected with almost everything they do except marketing, but what will make RSS the new medium for M$ worms is that M$ has established itself as a target. People want M$ dead and they think it's fun to destroy it even though the illeterate computer user may think that they have to buy a new computer. OS X won't suffer as much because Apple isn't a hated monolith in the tech industry. M$, on the other hand, has such a reputation that everything they make walks around with a red target on it. It won't be long before people crack open the protocol and exploit it only because it's M$. It doesn't make it right, but that should be the majority of the RSS worm problem for the future.

Re:OS X

[DogDude]

the illeterate computer user

Like yourself, and the rest of the anti-"M$" fanboys? Hahaha... what a joke!

Re:OS X

[DrSkwid]

Even seasoned sysadmin pros will tell you that part of the reason Linux is so secure is because the public doesn't perceive it as The Enemy and script kiddies don't think it's so much fun to take apart and take out a RedHat server as a Window Server 2003 one.

See, even seasoned sysadmin pros can be wrong.

Linux boxes get owned every day of the week, just like any other box with exploits available.

The perception of security has *nothing to do* with the actual security.

Re:OS X

[Iriel]

Notice that I said "part" of the reason.

I understand your point completely, but what I mean is that a large factor in why Windows gets hacked as often as it does compared to other platforms is because of the Microsoft image. Linux isn't perfect and neither is any other system for that matter, but Windows, being such a widely despised OS is what helps provoke people to break it.

I'm not trying to make definitive statements for everything, but simply provide some insight. Please don't take everything I say as such a literal maxim.

Re:OS X

[FunWithHeadlines]

Fanboys? All you have to do in order to become anti-Microsoft is pay attention.

Re:OS X

[wayoutwest]

"seasoned sysadmin pros"

You misspelled Microsoft Certified Systems Engineer

Re:OS X

[DrSkwid]

Notice that I said "part" of the reason.

But that still doesn't make it even slightly true.

The security of a system is not proportional to it's perception.

Please don't take everything I say as such a literal maxim.

What other metric should I use except that which you state ?

Widespread use is not a provocation. People don't steal cars because there are lots of them.

There is zero kudos for posting an FXP site if it's a Windows box. Now, posting a pwned Mac OSX IP would be far more exciting to those that care.

Re:OS X

[DogDude]

Microsoft software runs my business. I'm pretty happy with their stuff, thanks.

Re:OS X

[DogDude]

If this smartass comment wasn't posted by an AC, I'd ask to compare financials with this shitheel.

Re:OS X

[Iriel]

No perception grants an actually greater level of security, but perception can grant one a level of anonymity. Microsoft is not targeted because it is widely used, I have not claimed that, and that is where you seem to have interpreted pieces of my statements. However, it is targeted because it is widely hated. Teenagers are more likely to vandalize a car if they know it belongs to their school principal.

The security granted from anonymity is not *actual security* based upon the system's merits, but still has influence.

And if you don't my asking, what's an FXP site?

Re:OS X

[Anonymous Coward]

Of course MS is targeted proportionally to its use. Most people who are out to 0wn a system don't care what OS that system has. A randomly chosen host is very very likely to be MS. A randomly chosen host that can be trivially compromised is even more likely to be MS.

Re:OS X

[Anonymous Coward]

> because Apple isn't a hated monolith in the tech >industry.

Fanboys who pay double for a 'cool' toy arent the industry.

Apple is a closed-source company which behaves in a manner that most geeks should find very annoying and if there actions where taken by Microsoft, we'd have blasted them continously for things like trying to keep us from opening the box of Jobs.
Of course, Apple is like the girl with the great tits and ass who gets away with lots of shit because of the tits and ass.

To hear open-source advocates fawn over them shows that even geeks think with their dicks than their brain.

Re:OS X

[Anonymous Coward]

No, but the number of cars stolen is proportional to their abundence in society.

This, however, isn't true in the pwned box market. A disproporionate number of windows boxes go down, relative to market share.

Oh, and this verifying image rocks, awfmabo! BWA!

Re:OS X

[Pollardito]

you say this because OS X is already doing everything else that Longhorn is supposed to do?

otoh, this is finally a feature that we can be sure will be ready by the time that Longhorn is released. all of those asking "since X feature yet another one that is shipping after Longhorn, what exactly will be inside Longhorn?" can rest easy with this as your answer

Re:OS X

[NanoGator]

"Fanboys? All you have to do in order to become anti-Microsoft is pay attention...." ... to your karma while making "M$ $UCKS!" comments.

If you don't think Slashdot is a MS haters club, then you're nust kidding yourself.

Re:OS X

[masklinn]

Last time I checked, Safari had RSS support and iTunes 4.9 had podcasting but OSX itself didn't integrate RSS & podcasting into the kernel or os space...

Re:OS X

[FunWithHeadlines]

Slashdot certainly has always been a traditional MS haters club, yes. But /. has been paying attention to all the Microsoft stories, so no surprise there.

What has surprised me is that in the last year or two, I've noticed a real change around here. Now if you post something knocking Microsoft, you are equally likely to get modded to oblivion as modded up. Since Microsoft hasn't changed, I can attribute this shift to one of two things:

1. Lots of new people reading /. who don't know (or don't care) about Microsoft's shady behavior, and get offended if you say anyting bad about them.

2. Microsoft astroturfing. People who scope out anti-Microsoft talk and mod down accordingly.

Re:OS X

[DrSkwid]

> And if you don't my asking, what's an FXP site?
I don't mind at all, in fact I used it as a test to see if you knew much about the scene on which you are trying to comment. File eXchange Protocol http://en.wikipedia.org/wiki/FXP

It is used by warez traders. One can transfer files between two FTP servers without any having to come to you first. One owns a (usually Windows) box, creates hidden directories with directory names that are untypeable at the terminal (using special characters) [the _vti directories are a good base for this, MCSE admins rarely look inside them and even if they do, have no idea what they are for]. One can then FXP between hosts, thus obfuscating the audit trail. One uses a base owned box to use as a file store and preserve it's bandwidth thus reducing the likelyhood of discovery. One then FXPs the warez to other owned hosts and these secondary tiers have their hostnames posted in irc for other couriers to download from and distribute.

The other major use for owned machines is as an irc bouncer to facilitate the above.

Microsoft Windows is targetted because it is a soft ubiquitous target, pure and simple, not because the attacker has any personal feelings about the OS.

Re:OS X

[Anonymous Coward]

And that's why Apple is smarter than M$...by not integrating it into the OS in a stupid and unneccessary way they can avoid some degree of exploitability. But with Windows everything has to be integrated for some reason and thus a large text file opened in Notepad can bring my whole PC to a screeching halt and some jerk-off with a bad PNG or JPG forces IE to tank my whole OS. Thanks Microsoft....

Re:OS X

[NanoGator]

" Now if you post something knocking Microsoft, you are equally likely to get modded to oblivion as modded up. Since Microsoft hasn't changed, I can attribute this shift to one of two things:"

The shift is because of all the sensationalistic bullshit Slashdot's been stoking for the last few years. Noone can really judge from reading Slashdot whether or not MS really is shady. Because everything MS does is bad, even if your favorite company does the same thing. A Linux distro intentionally infringes on MS's trademark? It's Microsoft's fault. Security flaw in IE? It's time to switch. Security flaw in Firefox? This is proof we should stay with Firefox. Microsoft decides to discontinue support for Windows 98? MS is evil for forcing people to upgrade. Microsoft decides to continue support for Windows 98? MS is evil for keeping that insecure OS around.

You don't have to be an MS astroturfer to be sick of the bullshit and often outright fiction that the Slashdot community post about MS. Why would I care? Because I love Microsoft? Heh no. Not even close. If Slashdot posted a story right now about MS truely doing something evil, it wouldn't be anymore credible to me than Rush Limbaugh's criticism of a democrat. Slashdot's cried wolf too many times.

Slashdot's lack of credibility about Microsoft is not a result of astroturfing.

Re:OS X

[FunWithHeadlines]

/. has always been sensationalistic, but the response has definitely changed in recent years. I can't prove any given mod is astroturfing, but I am convinced it is happening overall.

Re:OS X

[NanoGator]

"I can't prove any given mod is astroturfing, but I am convinced it is happening overall."

What would be the motivation for people suddenly liking Microsoft if they 'haven't changed'?

Re:OS X

[fdqum08]

the most ironic part of this story is that apple's products are better integrated than anything ms has ever produced. when microsoft says "integration", it means anywhere from flaw to exploit to bad design. when apple integrates, everything works together. i hope history views bill gates as a complete failure...what else could he be to have so much talent under him and to sell so much crap.

Re:OS X

[fdqum08]

i just don't buy the "security through minority" myth. hackers hack for a couple reasons-fame and to show off what they can do. who the hell cares if you 0wn another windows box? but what if you can take over an os x box? what if you can create a self-propogating os x virus? the mac community alone would know of your work overnight. if i were an os x engineer at apple, i'd want to talk to the person writes the first os x virus. windows gets hacked because it can be easily, not because there are so many of them.

Re:OS X

[FunWithHeadlines]

"What would be the motivation for people suddenly liking Microsoft if they 'haven't changed'?"

Cash. That's how astroturfing works. You hire a PR agency with cash and voila! You have hired people to say nice things about you, or try to obscure the words of others who say bad things about you.

Re:OS X

[NanoGator]

"Cash. That's how astroturfing works. You hire a PR agency with cash and voila! You have hired people to say nice things about you, or try to obscure the words of others who say bad things about you."

Heh. I wish MS would pay me to dispute the FUD spread against them. Not sure why else I put up with some of the thick headed people here who still think the borg icon is funny.

Re:OS X

[drsmithy]

The security of a system is not proportional to it's perception.

The number of times a system is exploited is not not a valid measure of its security.

People don't steal cars because there are lots of them.

Which cars are more likely to get stolen - the ones 95% of the population own or the ones 5% of the population own ?

Re:OS X

[drsmithy]

Last time I checked, Safari had RSS support and iTunes 4.9 had podcasting but OSX itself didn't integrate RSS & podcasting into the kernel or os space...

1. Define "OS Space".

2. What on Earth makes you think Microsoft will put an RSS reader into kernel space in Windows ?

Re:OS X

[drsmithy]

And that's why Apple is smarter than M$...by not integrating it into the OS in a stupid and unneccessary way they can avoid some degree of exploitability.

Hate to break it to you, but IE is no more "integrated" into Windows than Safari+WebKit+WebCore is into OS X.

There is zero reason to believe a Microsoft RSS "reader" will be any more "integrated" into Windows than the OS X one is into OS X.

Re:OS X

[drsmithy]

Fanboys? All you have to do in order to become anti-Microsoft is pay attention.

Only if you're a biased 15 year old with a worldview about as wide as a pencil.

Microsoft behave much the same way every other company does in the computing world. The only difference is their actions have a much wider impact than most others (within the computing world).

If you want to get into a global scale and move outside of the computing world, Microsoft are practically a *saint* in comparison to the /real/ "big nasty corporations. Thousands of babies have not died because of a deceptive Microsoft marketing campaign. Wars have not been started because Microsoft wanted to make some more money.

Get some fucking perspective.

Re:OS X

[drsmithy]

Microsoft astroturfing. People who scope out anti-Microsoft talk and mod down accordingly.

Of course, all you have to do to be an "astroturfer" on Slashdot is post sane, balanced, factual viewpoints than don't criticise or blame Microsoft for all the world's woes...

You forgot the 3rd option: more people whose entire lives don't revolve around hating Microsoft are reading Slashdot.

Re:OS X

[AaronBrethorst]

Why do you assume Microsoft hasn't changed? I'm genuinely curious about this.

Re:OS X

[hplasm]

Which cars are more likely to get stolen - the ones 95% of the population own or the ones 5% of the population own ?

The 90% that are left unlocked with the keys in the ignition.

Re:OS X

[FunWithHeadlines]

Aaron,

I will take you at your word that you are a decent guy and that your query was genuine. Can I dislike Microsoft while still liking individuals who work there or who work with their products? Sure. Just as I can criticize the actions of the government while being good friends with my neighbor Joe Civic Servant down the street. We are all familiar with how groups of decent individuals can come together in an organization that then causes them to act in ways that perpetuate the organization, even if those ways wind up being bad.

Has Microsoft changed? I don't see much of a change. Their attack on Linux hasn't gained much traction, so in recent months and years they have occasionally tried the carrot instead of the stick and said nice things about Open Source and Free Software. But since the GPL is antithetical to their business model, it seems to be just words. Their actions continue to show that they have not changed.

I spent 15 minutes with Google to come up with some recent relevant examples that show their current attitude. Is every story below accurate? Maybe not. But when there's that much smoke...

Ballmer: Linux violates patents; use it and you will be sued by somebody

MS Office XML Format licence is incompatible with the GPL

HP Memo: "Microsoft will soon be launching a patent-based legal offensive against Linux"

Microsoft using the WTO as a proxy to fight free software

Microsoft's antitrust offering 'blocks Samba'

Microsoft's New Monopoly

Microsoft remains unrepentant, says antitrust judge

Rivals Say Microsoft Flouts Antitrust Settlement

Re:OS X

[FunWithHeadlines]

"Microsoft behave much the same way every other company does in the computing world. "

That wouldn't excuse a thing, even if it were true. But it's not true. They have behaved shamefully, and to a worse degree than other companies. Perhaps it's only because of the power they wield, but they have behaved in a shameful manner.

"If you want to get into a global scale and move outside of the computing world, Microsoft are practically a *saint* in comparison to the /real/ "big nasty corporations. Thousands of babies have not died because of a deceptive Microsoft marketing campaign. Wars have not been started because Microsoft wanted to make some more money."

Nobody said they were, but we are talking about computers here. This isn't the Politics section. Just because there are awful corporate actions elsewhere doesn't excuse a thing Microsoft has done. "He does it too!" is a kindergarten excuse.

"Get some fucking perspective."

Get some manners.

Re:OS X

[drsmithy]

That wouldn't excuse a thing, even if it were true.

Actually it does, because "acceptable behaviour" is a matter of opinion, not an absolute measure. When "everyone" behaves the same way, at least within their sphere, that makes such behaviour acceptable.

But it's not true. They have behaved shamefully, and to a worse degree than other companies. Perhaps it's only because of the power they wield, but they have behaved in a shameful manner.

Bollocks. They've done nothing worse than any other company of any size. They've gotten into more trouble for it, to be sure, but that's a different issue from their actual behaviours.

Just because there are awful corporate actions elsewhere doesn't excuse a thing Microsoft has done.

The objective is not to excuse, because personally, I don't believe they've done anything that really needs "excusing". They play their business just like most big companies - ruthlessly. If that bothers you greatly, you need to be attacking the entire corporate ethic, not just one particular manifestation of it (ie: Microsoft).

Get some manners.

People who think Microsoft is somehow different to every other company out there don't deserve manners, they deserve to be slapped.

People like the OP claiming "paying attention" is all it takes to be "anti Microsoft" are acting hypocritically, because they're either judging from different standards, or only "paying attention" to Microsoft.

Lots of people here on /. (which may or may not inclide the OP), who seem to think Microsoft is the Great Satan, the personification of evil or the poster boy for corporate misbehaviour need to get some perspective.

What's the big deal?

[rockytriton]

I don't see what the big deal is with RSS, who really cares about it anyway? -------------------- Rocky Triton http://www.dreamsyssoft.com/

Re:What's the big deal?

[Anonymous Coward]

""" ...who really cares about [RSS] anyway?
"""

Ummm... You will when that becomes MS's new Windows Update path.

Remember the "Windows Security Is Now Job #1" speech from Bill Gates? Not only will RSS be turned on by default, but you won't be able to turn it off.

Just imagine the annoyance-factor of the security message pop-ups in Windows XP multiplied by a dozen.

Nemo

Re:What's the big deal?

[pseudorand]

> but you won't be able to turn it off.

Sure you will, you just have to block it at your firewall. Now what we really need is some Linux firewall software that uses RSS to get the latest updates of ports and domains that MS products contact for blocking purposes. Then Linksys and Netgear need to build this technology in to their DSL/Cable Modem routers and switches so home protection is as simple as a checkbox.

Move along...no news here

[mrhandstand]

So what we are being told it that downloading something from a potentially untructed source and then running that data casn lead to bad things? Oh My!

When are we going to stop acting like each new protocol or application vulnerability is a new thing? Until NX (No Execute) and good input sanitization is ubiquitous, these things will contine to plague the networked world.

Re:Move along...no news here

[danheskett]

Ahh..

you are uninformed.

Real systems seperate executable code and data effectively without resorting to things like NX.

Microsoft has this great idea with Windows 95 that things should be "document centric"; you don't open an application to print a document, you drag the document to the printer! Magic! Behind the scenes Windows will silently open the application, feed it the data, and a command telling it to print to the printer. Sounds good, but the problem is that (1) Windows can be told to perform a different action instead of "print" - all actions are created equal. (2) Windows can be told instead to execute the data as code, (3) the "correct application" can be changed, feeding your data to any old app that feels like it should register itself as the handler of that data type, etc.

So in the name conveince MS has created a gigantic system where any thing can be executed as code and nothing is truly data. Then they go and design a huge mass of file formats that contain both data and binary.

Re:Move along...no news here

[mrhandstand]

I understand what real OS's do...I run one. :-D Unfortunately, the VAST majority of people don't, so we get to hope for NX and data sanitization.

Re:Move along...no news here

[danheskett]

The vast majority of people are not OS developers. The only people who have to understand this now are MS people.

COM and it's OLE predecessors is inherently insecure simply because it mixes data and code. Bad. BAD.

Re:Move along...no news here

[John Whitley]

Until NX (No Execute) and good input sanitization is ubiquitous, these things will contine to plague the networked world.

Even these may not be enough. I think it's going to be really hard to get good, ubiquitous input sanitization. Folks will keep generating new and interesting dynamic, networked appplications, vulnerable in new and interesting ways...

A nice tip-of-the-iceberg example are notes on supported Python versions from the Zope team. They recommend Python 2.3.5, not the new 2.4.1, not for stability, but because they haven't had a chance to do a security audit of the new Python features in 2.4 to make sure that no security holes would be inadvertently created by running Zope on the newer Python release.

Re:Move along...no news here

[the right sock]

Real systems seperate executable code and data effectively without resorting to things like NX

These memory segments are separate, but nothing will prevent a CPU from executing valid code in a data segment. Overflow exploits work by diverting execution to code stored in data. The whole point behind NX is to prevent that.

Re:Move along...no news here

[TheRealMindChild]

COM and it's OLE predecessors

You, just like everyone else, seem to be confused on what COM, OLE, ActiveX, etc are and how they relate.

COM is simply a CROSS-PLATFORM binary interface standard. It isn't Windows only, either.

OLE is a SET of defined COM interfaces to Link and Embed Objects in documents (and similar). ActiveX was part marketing gimmick and part new version of OLE. This brought forth the mighty IDispatch interface for Automation.

http://www.orafaq.com/glossary/faqglosc.htm#COM

Re:Move along...no news here

[Punboy]

Then they go and design a huge mass of file formats that contain both data and binary.

I think you mean both raw data and executable machine code. Everything on your computer is binary.

Re:Move along...no news here

[Anonymous Coward]

I'm not a Windows expert, so I'll cede every point you've stated above. However, none of that applies to RSS, as the RSS in Longhorn does not execute anything. Ever. It downloads content and puts it in a store. That's it. If an application wants to come along and import the data, fantastic... it can do that through standard APIs. Input validation and buffer checking of the feed will be the responsibility of the Windows devs, but use of the data will be no different than any other document on the system.

Re:Move along...no news here

[danheskett]

just like everyone else, seem to be confused on what COM, OLE, ActiveX, etc are and how they relate
No, actually not.

It isn't Windows only, either.
Did I say it was?

OLE is a SET of defined COM interfaces to Link and Embed Objects in documents (and similar). ActiveX was part marketing gimmick and part new version of OLE. This brought forth the mighty IDispatch interface for Automation.
SO?

My statement was intended to actually say "COM and it's DDE" predecessors.

Or, "OLE and it's DDE predecessors".

The point, besides your nitpicking know-it-all attitude is that MS's lack of data/code seperation has lead to nasty NX hacks and processor tricks to solve a problem that other OS's don't have.

Re:Move along...no news here

[drsmithy]

Microsoft has this great idea with Windows 95 that things should be "document centric"; you don't open an application to print a document, you drag the document to the printer! Magic!

I find it laughable you blame this UI paradigm on Windows when MacOS and OS/2 were doing it (and advertising it) _years_ beforehand (and the concept itself is even older). Microsoft were 5 - 10 years late to the pervasive drag & drop, sorta-object-oriented, document-centric interface, yet somehow it's their fault ?

For shame - your bias is showing.

Behind the scenes Windows will silently open the application, feed it the data, and a command telling it to print to the printer.

So does OS X. So does KDE. So does GNOME. So does every other remotely modern GUI released in the last 10 - 15 years. What's your point ?

Windows can be told instead to execute the data as code, [...]

If the app has a buffer overflow, maybe - but Windows hardly has a monopoly on buffer overflows.

Re:Move along...no news here

[julesh]

The point, besides your nitpicking know-it-all attitude is that MS's lack of data/code seperation has lead to nasty NX hacks and processor tricks to solve a problem that other OS's don't have.

But data and code are as separate on Windows as they are on any other OS. The problem with Windows has nothing to do with this. The largest problems are:

1. Much of the code was written without concern for security by people who didn't really understand how to make it secure. This lead to things like the RPC service buffer overflow.

2. There has been too much emphasis on making the system easy to use at the expense of security. This lead to things like the default password issue in SQL server, which originated a worm of its own.

3. There has been too much emphasis on flexibility at the expense of security. This led to MS Word viruses, and is possibly the closest to your point.

4. The system has been marketed on the basis that any idiot can use it. While this is true, any idiot can also use it to download and run malicious code without knowing it. There should have been more user education.

5. The system has blurred distinctions between outward facing components (e.g. Internet Explorer's DHTML implementation) and restricted-access inward facing ones (e.g. the extended versions of Javascript that are used for internal scripting purposes only). This has led to many scripting and active-x based security holes, and has in fact prompted MS to switch off Javascript on the local machine by default in SP2. Entirely.

I don't see how COM is to blame for any of these. Or DDE. Or OLE. Or even ActiveX, which is a fine technology if used appropriately.

And NX isn't really a nasty hack, it's something that should have been present and in use from the beginning. And if you really think other OSs don't have any buffer overflows, you're living with your head in the sand. I've had a buffer overflow exploited on one of my Linux boxes before now, although fortunately the worm using it failed to install correctly because it was intended for systems with a different configuration to mine.

Re:Move along...no news here

[Anonymous Coward]

Apart from the PE (EXE) and DLL format, which Windows file formats contain both data and code? A huge mass? Or none whatsoever?

I take it you use Linux most days.

Re:Move along...no news here

[danheskett]

But data and code are as separate on Windows as they are on any other OS.
In a purely technical sense, binaries are binaries, and not not. In the purely realistic sense, it is not. People "execute" documents, data files, etc. They "invoke" commands on non-binaries, and the OS in turn takes an action which it supposes to do what the user wants.

And NX isn't really a nasty hack, it's something that should have been present and in use from the beginning.
It is unnecessary. Other OS's don't have the problems beacuse they are better designed and more simple. Occasional problems pop-up, but nothing on the scale of what happens with MS.

you're living with your head in the sand
I have a server with a stable configuration of OpenBSD. How many buffer overruns do you think I have to patch over the course of a year?

MS's implementation of COM is to blame. For example, take a word file. It's a document. Yet. You can embedd "COM Objects" - really references or code to COM programs - in it. When that embedded object is referenced a program is started and given commands absent the users knowledge or intervention. When you insert a chart from an Excel spreadsheet in a Word document the path between data and code is blurred. When Word encouters a reference to that COM object a new program is started and the data feed to it. That's a huge security problem. Gigantic. Embedding of code inside documents is dangerous!

This is exactly how all those Outlook/Outlook Express problems got going. Why would a mail client execute the contents of a message? Because the difference between code and data has been blurred thanks to COM and MS.

Re:Move along...no news here

[julesh]

In the purely realistic sense, it is not. People "execute" documents, data files, etc. They "invoke" commands on non-binaries, and the OS in turn takes an action which it supposes to do what the user wants.

Yes, but the same is true in almost every other system in common use today. Macs, Un*x with either KDE, CDE, Gnome or just about any other modern desktop, even strange-but-inherently-geeky systems like BeOS or RISC OS work like this. This is a common feature of almost all desktop operating systems, and to single Windows out for criticism because of it is, frankly, bizarre.

[NX] is unnecessary. Other OS's don't have the problems beacuse they are better designed and more simple. [...] I have a server with a stable configuration of OpenBSD.

OK, so you're running a server and comparing it with a complete desktop OS. It's hardly surprising that the desktop system is more complex; it has to cope with a lot more possible use scenarios, not to mention the fact that user friendliness is much, much more important to it. These things do come with a cost.

Oh, and you do know that NX was implemented first in OpenBSD, don't you. Except it's called W^X there. It's part of the reason OpenBSD is so secure -- on most platforms a buffer overrun cannot cause code execution.

Re:Move along...no news here

[julesh]

D'oh. Submitted before I'd finished.

MS's implementation of COM is to blame. For example, take a word file. It's a document. Yet. You can embedd "COM Objects" - really references or code to COM programs - in it.

That's OLE, not COM. OLE uses COM internally.

When that embedded object is referenced a program is started and given commands absent the users knowledge or intervention. When you insert a chart from an Excel spreadsheet in a Word document the path between data and code is blurred.

Not really. The code has to already be installed on the user's system for it to work.

When Word encouters a reference to that COM object a new program is started and the data feed to it. That's a huge security problem. Gigantic. Embedding of code inside documents is dangerous!

But it isn't code; it's data that's intended to be understood by a different program.

This is exactly how all those Outlook/Outlook Express problems got going. Why would a mail client execute the contents of a message? Because the difference between code and data has been blurred thanks to COM and MS.

Err... geenrally these have nothing to do with OLE, or COM. Most of the Outlook problems I'm aware of have been related to dodgy parsing of MIME headers causing the program to believe what it was loading was one data type (e.g. a sound file) when it was actually another (e.g. a script file). It then passed the data to the shell to execute, the shell realised it was a different type, so launched the application associated with the correct type (e.g. the script interpreter). No COM involved, no OLE involved, not even any ActiveX involved. A plain and simple case of the left hand not knowing what the right was doing.

Exactly the same problem could occur on any system that has (1) a way of associating document types with the application to process them [this applies to just about every modern desktop operating system], (2) has a script interpreter associated with its scripts [this is where the link breaks down for many systems] and (3) has an e-mail client that attempts to automatically play multimedia content [this is where everything else breaks down].

So MS's mistakes are:

1. Associating scripts with their interpreter for automatic execution. In Unix-like systems scripts are not generally associated with their interpreter by the user environment, but are executed directly by the OS. This is made possible by the execute bit in the filesystem and a header in the script file that identifies its interpreter.

MS's mistake here comes under the category in my original post of "the code was written without concern for security by people who didn't really understand how to make it secure." In this case, we're talking about the original authors of MS-DOS, and the person who decided while writing NT that backward compatibility with DOS in this matter was more important than security.

2. Making the e-mail client attempt to automatically play multimedia files when displaying the e-mail.

This is a stupid feature, but one that MS's marketing department probably thought would really appeal to the idiots^Wusers. It can be categorised in my original list under "too much emphasis on flexibility at the expense of security."

But, essentially, COM has nothing to do with this. OLE has nothing to do with this. The only thing even closely related to those which is involved is that of associating data files with applications used to manipulate them, and MS are hardly on their own in taking this step, and in itself it isn't a security problem.

Blah! We don't have to worry...

[slapout]

...cause Longhorn is going to be built on secure .Net technology......oh wait....nevermind. :-)

Re:Blah! We don't have to worry...

[Soul-Burn666]

MU.
Longhorn is not going to be built.
Or at least not shipped in our generation.

Re:Blah! We don't have to worry...

[RobertKozak]

You are terribly confused as to what .NET is.

I was tempted to write more but I really don't feel like feeding the troll that you are.

Re:Blah! We don't have to worry...

[Anonymous Coward]

It was a joke. It is based on a couple things:

1) Microsoft's poor security record.

2) The fact that some things in Longhorn where going to be written in .Net and then they changed their minds.

cached links

[joeldg]

in case the articles get nuked:

http://www.eweek.com.nyud.net:8090/article2/0,1759 ,1833035,00.asp

http://www.docuverse.com.nyud.net:8090/blog/donpar k/EntryViewPage.aspx?guid=1bedfa3f-e67f-4d78-8b2d- cff3a9ccf90a

Handy little caching service.

You just know it's gonna get hacked

[nargonne]

MS loves to integrate things deep into their OS and infrastructure so you can bet RSS support will be yet another security hole for them and everyone else to deal/live with. I wonder how firefox, Safari or iTunes is mitigating the risk on their stuff?

Wow.

[NoMoreNicksLeft]

I was actually going to read the eweek article, when this stupid little div popup appears, complete with candy-ass XP style close button. No thanks.

Re:Wow.

[advocate_one]

there was a popup??? not in my browser...

Re:Wow.

[NoMoreNicksLeft]

Not a proper one, I use Firefox after all. A shitty little div, one of those interstitial things they've been doing. Usually see them as flash though.

News?

[zensufi]

1. Is this really news? I mean, Microsoft is putting something in Windows that might pose a security risk. There's this program people use at work called The Internet. The IT people call it Internet Explorer. And I have geek friends who can list more Windows vulnerabilities than they can recite digits of pi. I believe, in news speak, this kind of story is called an evergreen.
2. How hard is it going to be to patch RSS vulnerabilities? It might take Microsoft a couple of years, but how bad is an overflow issue?

Re:News?

[Iriel]

Any Windows problem is an evergreen issue, but the fact of the matter is that it won't be difficult to fix it: It will be time consuming. Some dark and foreboding feeling in my chest tells me that we won't see the end of these 'new security risks' until at least Service Pack 1.

What I think /. really needs is a non-geek-friendly site for the masses to inform those that wouldn't normally be smart enough to know to just use Safari/Firefox/whatever instead of trusting Windows to do anything with any measure of accuracy or reliability. I've learned a lot from some linked articles and other users on this site in a relatively short amount of time, but this is just a "Well DUH!" issue that should be reserved for the M$ developers who need to fix it :)

Re:News?

[k1773re7f]

Those same people would not be smart enough to ever actually find the site. Because Microsoft would never link to it from the MSN start page.

What!?

[jb.hl.com]

What retard decided to put binary data in RSS? Or would allow execution of code linked to by an RSS feed? That is truly the most retarded thing Microsoft could have done with regards to security. It's like a condom with the capability to have semen smeared on the outside. Utterly fucking stupid.

Re:What!?

[DrSkwid]

All data is binary, anything else is an illusion.

Re:What!?

[I confirm I'm not a]

What retard decided to put binary data in RSS? Or would allow execution of code linked to by an RSS feed? That is truly the most retarded thing Microsoft could have done with regards to security.

That would be Adam Curry and Dave Winer, an MTV DJ and a 'net hacker (the guy behind RSS1 and RSS2, IIRC)

Embedding RSS (and, more importantly, the RSS "enclosure" magic that enables podcasting) is right up there with "let's embed the browser right into the OS", but to be fair to MS it wasn't them who decided to put binary data into RSS. Though I bet they're kicking themself right now - "no patents for us!"

Re:What!?

[Anonymous Coward]

What retard decided to put binary data in RSS?

The ones who dreamed up podcasting maybe?

Re:What!?

[StrawberryFrog]

Joe Baldwin is amnesiac? There's one for the E2 rumour mill.

Re:What!?

[jb.hl.com]

Oh no no no, I'm not amnesiac. Wish I was, it's a good username :)

Re:What!?

[justforaday]

What retard decided to put binary data in RSS?

Adam (how's my hair?) Curry, formerly of eMpTyVee fame...

Re:What!?

[RingDev]

No, he was being accurate. The asshat who started this thread doesn't understand how data is transfered. RSS always did transmit binary data, the only difference is that previously it would always resolve that binary to UTF or ANSI text. MS is just adding the option of building the binary to a file of some type instead. -Rick

Re:What!?

[akwebb]

Someone with (R)epetitive (S)tupidity (S)yndrome.

Re:What!?

[hyfe]

It's like a condom with the capability to have semen smeared on the outside. Utterly fucking stupid.

Not be picky or anything..

1. I have yet to see any vendors applying techniques making the smearing of cement on condoms impossible.
2. Smearing a condom with cement would make it useless, although extremely secure. I think would most people would agree that this is not a description which can be aptly applied to Microsoft.

Re:What!?

[Mark of THE CITY]

Actually, it's analog; binary plays only a bit part.

Re:What!?

[I confirm I'm not a]

...the smearing of cement on condoms...

Dude, I am so not having sex with you.

Re:What!?

[uncommonlygood]

True, and the original poster seems to foolishly believe that ASCII text can't be used to exploit a buffer overflow. Firstly, it can (random googled link), and secondly, you can send anything you want over the network, whether the spec says "binary data" is OK or not, unless there's some kind of filter that only lets certain types of bytes through.

Re:What!?

[NardofDoom]

Or, as Fry put it "There's no such thing as two."

(Am I the only one who spotted the two in that dream sequence?)

Re:What!?

[laird]

"What retard decided to put binary data in RSS?"

Dave Winer, for one. He's a lot of things, but he isn't a retard. :-) I'll point out, though, that there's nothing insecure about moving binary data. Many web browsers, nntp clients, mail clients, etc., on many operating systems are known to move binary data with complete safety. The trick is to keep a clear distinction between data, which is safe, and code, which is dangerous.

"Or would allow execution of code linked to by an RSS feed?"

Now, if this were done automatically, this would be really stupid. Of course, nobody (that I know of) is suggesting that RSS readers automatically execute code delivered by RSS. I can imagine some scenarios where an RSS feed of code might make sense (e.g. an RSS feed that delivers the latest version of the installer for a program that you use, so that you can keep current automatically), but for sanity you'd want to only execute code when the user explicitly initiates the action, and put up some sort of warning.

Re:What!?

[Anonymous Coward]

Actually, it's digital. Analog data has no predefined precision the way digital data does. It's the difference between a simple adding machine (digital) and a slide rule (analog).

Re:What!?

[drsmithy]

I can imagine some scenarios where an RSS feed of code might make sense (e.g. an RSS feed that delivers the latest version of the installer for a program that you use, so that you can keep current automatically), but for sanity you'd want to only execute code when the user explicitly initiates the action, and put up some sort of warning.

Like those email attachments the user has to specifically launch, that warn launching them might be a bad idea (with the default set to "don't do it" ?

Re:What!?

[StrawberryFrog]

This got modded up? The world is smaller and weirder than I thought.

Re:What!?

[bill_mcgonigle]

Or would allow execution of code linked to by an RSS feed?

One has trouble even Microsoft would do this on purpose.

Yet, they continue to write software in a language that doesn't have secure bounds checking and they don't use the available add-ons that add that capability to the language.

Was it FC4 or Tiger that's compiled with a stack guard by default? Neither seem particularly slow - actually they're faster than their predecessors.

Which can only lead one to the conclusion that it's done for marketing reasons.

Re:What!?

[Mark of THE CITY]

Binary has signal ranges which the circuit, operating in saturation (contrast linear amplifier circuits), associates with '0' or '1'. There is also a gap between these ranges; operating the circuit in saturation ensures that signals from the gap range are, at most, short-lived transients.

Geez, don't they teach kids the fundamentals of anything nowadays? Oh, wait...

OMG Don Park is Warning!

[Anonymous Coward]

Oh I see,
Don Park is warning!

Glad to hear what Don Park has to say about this story.

I love Don Park, I read every word he writes!

WHO THE FUCK IS DON PARK?

Common sense

[Anonymous Coward]

RSS is a transmission vector. Data can get onto your system through RSS in the same way it can get onto your system through email, through floppy disks, through web browsing, and so on.

Wherever there's a transmission vector, there's possibility for infection if applications that consume that data are insecure.

So basically, this "possible abuse" warning is simply saying "You know those applications that suck up lots of untrusted data? If they are insecure, you may have problems!" Sorry, but there's nothing new here.

In fact, having it built into Longhorn could reduce the likelihood for security holes. All the RSS-consuming applications use their own home-grown parsing routines right now. Switching to one shared library means there's only one place for vulnerabilities to arise in this respect, and when each vulnerability is fixed, it will be fixed for all the applications at once.

On the other hand, this is Microsoft that is writing the shared library, and we all know how secure their coding is. Internet Explorer hasn't had any meaningful updates for four years, and they are still finding holes in it on a regular basis - which means that every application that embeds Trident (Internet Explorer's rendering engine) are constantly in a state of insecurity. It all comes down to the benefits of shared libraries versus the incompetence of Microsoft.

Re:Common sense

[SpaceLifeForm]

Yes it's a vector. And MS wants to control that vector. If you don't see the parallels to how MS pushed IE on the masses, you haven't been paying attention.

When things start getting messy down the road, and the TPTB want to hide the truth from the masses, what better way than to control RSS feeds.

Re:Common sense

[PHP Addict]

Switching to one shared library means there's only one place for vulnerabilities to arise in this respect...

The problem with this is that now, that one place is in the kernel of your operating system.

Re:Common sense

[Anonymous Coward]

No it isn't. You really don't even have the remotest semblance of a clue if you think "built into Windows" means "put into the kernel". Trident ("IE") wasn't in the kernel and this won't be either, just the same way Safari isn't in the OS X kernel and glibc isn't in the Linux kernel. Do you have any idea what libraries are?

Re:Common sense

[value_added]

Switching to one shared library means there's only one place for vulnerabilities to arise in this respect, and when each vulnerability is fixed, it will be fixed for all the applications at once.

So this is like ordering a #4, instead of having to order a Double-Whopper with Cheese, Large Fries and Large Coke all separately? Sounds simple.

May I take your order?

Yeah, we'll each have one library vulnerability, with one Microsoft Security Bulletin, a Microsoft Knowledge Base article, a BugTraq ID, a CVE ID, and if you could, throw some links, -- Shuddup! I don't care if you just wanted a Coke! -- Sorry, no, I didn't mean you. Add some emails, and newsgroup postings with extra napkins, but put it all in the same bag for me, will ya? And that's to go!

Maybe...

[kaellinn18]

This is one reason why Microsoft is looking at purchasing Claria? The guys over there are probably pretty good at finding vulnerabilities by this point.

Perhaps this is _why_ msft is interested.

[team99parody]

One thing we often overlook is that weak security is actually in the interest of Microsoft, because it's a primary drivers of corporate upgrades.

Many businesses are still content with Windows2000; and see little reason to upgrade to Longhorn. One of the easiest buttons to push to get a CFO to approve upgrades is finding security holes in the old systems.

As long as Microsoft's business model is so dependant on bleeding it's existing customers until they're dry; I don't think it's really in their interest to stop security holes. Of course they don't want to launch Longhorn with a bunch of old IE holes that are already exploited, so they need to find new areas for this. Slowly adding new holes like RSS; where the holes may not be found for many years is perfect for the upgrade plan.

[yes, it was a troll; but I think there's a truth to the fact that security weeknesses in Windows is a major driver of upgrades]

Re:Perhaps this is _why_ msft is interested.

[mcwidget]

Many businesses are still content with Windows2000

Unlikely, mainstream support for 2000 runs out this month. Business will be looking to upgrade shortly if they haven't done so already.

Re:Perhaps this is _why_ msft is interested.

[Val314]

there is still extended Support till sometime 2010 (that includes security Updates but no new features)

so there is not really any reason to switch from Win2k if you're happy with it.

Re:Perhaps this is _why_ msft is interested.

[Anonymous Coward]

I think you're re-enforcing the message of the parent post.

Businesses will be looking to upgrade exactly because 2000 will start having security holes in components that will no longer be getting patched.

For a 6-year old OS, the "support" that businesses care about is not the new features that they're hoping for in service-pack-N, it's the security patches. And the more Win2K components that have security holes that "sorry, can't be backpatched", the faster businesses will pay microsoft for subjecting them to this insecurity.

Re:Perhaps this is _why_ msft is interested.

[dioscaido]

Insightful, except for the fact that I'm a developer on Longhorn, and I have to spend endless hours pouring through my designs with security groups within Microsoft. And once my component is ready, the source is shipped to the security group for one final run through for vulnerabilities.

While it may be nice to think these conspiracy theories that we purposefully put in vulnerabilities, the fact is that at least since 2003 MS has kicked itself into shape and now has security as the top priority. We're actually seeing for the first time security concerns trumping 'user friendliness', which is great. Anyway, we have too many eyes from different groups going through oru designs and actual code for people to make such shady business decisions.

Re:Perhaps this is _why_ msft is interested.

[rhizome]

While it may be nice to think these conspiracy theories that we purposefully put in vulnerabilities, the fact is that at least since 2003 MS has kicked itself into shape and now has security as the top priority.

That's fine, but the fact remains that Microsoft is adding new attack vectors just as they are incorporating new technologies to deal with security holes (which themselves qualify as potential vulnerabilities). It may be a stereotype, but the culture of "Uncle Bill" really holds sway here, that Microsoft sets itself up as both the cause and solution to security problems and extending RSS to include executable binary code is just as smart as ActiveX in the browser. That is, "not very," for the majority of users, and "definitely not" for the wild-and-wooly Internet environment.

Keep in mind Hanlon's law here. It's not enough to say that Microsoft is feeding a conspiracy by making shady business decisions because I don't think they are. They just can't help making dumb ones. Refer to the allegory of the scorpion and the frog for further illustration.

Re:Perhaps this is _why_ msft is interested.

[team99parody]

Thanks for the informed response to my troll [argh, I was going for a cheapshot conspiracy-theory-funny and I even said I was trolling yet I still got modded up (go figure)]

"We're actually seeing for the first time security concerns trumping 'user friendliness', which is great."

Is it great? As someone with stock in Microsoft, I wonder if Microsoft's newfound obsession with security is a poor strategic decision that really doesn't play to Micrsoft's strenghts. Computer security is really an area of expertise that really lends itself to small contained systems that are very conservative in the features they include. The bulk of Microsoft's market lends itself to feature rich (some would say bloated) applications and leading edge (some would say beta-quality) features.

Of course security is important - but consider that all businesses in all industries have to make calculated risk/reward calculations when they ballance security with other demands. For example, if Ford decided that security was the overriding principal, their cars would all have 4-point-seat belts; be armored tanks; and go only 10 MPH. Surely there are small niche demands for such features (racecars, infant-car-seats, and military); but Ford strikes a reasonable ballance between risk and reward for the core of the market. Similarly credit companies strike a careful ballance between the ease to use a credit card and the ease to steal a credit card. Much like a credit card company, it seems Microsoft would be better served by continuing to focus on the most profitable segment and like credit companies provide guarantees against loss due to their inevitable security problems.

By saying Microsoft wants Longhorn to be both feature-competitive with Linux and security-competitive with OS/390 & Solaris they're really creating a bizzare racecar+tank+HondaCivic-frankenstein that will fail at all of those goals.

Anyway, we have too many eyes from different groups going through [our] designs and actual code for people to make such[...]

Forgive me from finishing your sentence; but seeing how many features got dropped from Longhorn it seems these eyes are preventing a lot of features from getting done as well.

And of course I didn't mean to suggest that Gates and Balmer are deliberatelly telling people to inject bugs. However they are telling them to inject features (like RSS, and Internet Explorer, etc) that have no place in a secure OS. And I do believe that they are well aware of the security implications of those directions; and that they're smart enough to realize that this will help their upgrade business down the road.

Re:Perhaps this is _why_ msft is interested.

[Anonymous Coward]

I have to spend endless hours pouring through my designs with security groups within Microsoft. And once my component is ready, the source is shipped to the security group for one final run through for vulnerabilities.

Seems it'd be better to post it to something like the lkml, where security experts from academia (MIT, etc) and industry (IBM, etc) would both analyze it in detail and supply you with the appropriate fixes if anything were wrong.

Surely microsoft customers (IBM, HP, etc) would care enough about security to help with this even if it is a private mailing list, wouldn't they?

Re:Perhaps this is _why_ msft is interested.

[Anonymous Coward]

Forgive me from finishing your sentence; but seeing how many features got dropped from Longhorn it seems these eyes are preventing a lot of features from getting done as well.

Those features aren't being dropped from Longhorn. They are being developed alongside Longhorn. The reason is because the developer community stated that while the proposed features are excellent, the time it will take for the necessary critical mass of users exist in order to actually really begin to leverage these features in commercial applications is probably 2-3 years after the release of the OS. Microsoft agreed and decided to take these features and separate them outside of the Longhorn project and backport them to Windows XP. Because the features were no longer tied to Longhorn they no longer constrain each others' deadlines.

Nothing is getting dropped, they're being expanded. Microsoft is providing new fangled features to older OSes for free. That's pretty benevolent of them, all things considered.

Re:Perhaps this is _why_ msft is interested.

[Stauf]

Refer to the allegory of the scorpion and the frog for further illustration.

You're going to have to explain this to me - are you saying that Microsoft is going to pull down it's userbase deliberately because it hasn't or won't consider it's own future?

Re:Perhaps this is _why_ msft is interested.

[Keybounce]

the fact is that at least since 2003 MS has kicked itself into shape and now has security as the top priority. We're actually seeing for the first time security concerns trumping 'user friendliness', which is great.

I'll believe it when I see some sort of restricted execution mode.

I'll be blunt: Windows needs the set-UID system. The only way to prevent abuses of a "hook" system -- registry (windows), input manager (Mac osX), etc -- is to disallow arbitrary access to the hooks, and require hook access to go through a trusted program.

The only way to make sure that the code that is accessing the hooks is the trusted code is to have some sort of "This app runs with special permissions". That's some form of "set permission on execution", either set-uid, or more likely, set-gid (Except that windows, as far as I know, doesn't seperate group and user concepts).

Is microsoft willing to break backwards compatibility to ensure security?

The bottom line: Any time a program is expected, or permitted, to change a hook, means that an untrusty program can change those hooks and install a virus/worm/trojan that can run as the current user, compromising at least that account, and any system that encourages or requires that a normal home user runs as "root" means that the same security flaw will expose the entire system.

The input manager flaw on OsX (described later down on this page)? Fix it by making the input manager directory only writable by a privileged app, that uses the root input manager instead of the user input manager. Now there is no way for a sneaky program to hook itself into arbitrary apps.

Hooking things into IE, the windows shell, etc: apparently trivial if you know what you're doing, a PITA to try to track down, determine what's what, etc.

Heck, microsoft would do a big service just to introduce a tool that looks through the registry, tells you "here is a list of programs that say they handle _x_, choose the one that you want to actually handle _x_". Except that this might not be possible with the current registry design, as there might only be a place to store the "Currently assigned choice is _y_" result, not the list of all possible choices.

Seriously, why should installing program X give that program the permission to say "I will now declare that extension .xyz is xylaphone yellow zero" as well as "I handle this type" as well as "This is the icon for this type"?

For that matter, who says that ".jpg" is "Microsoft office picture document" or whatever it is called after installing office?

Yes, this is security. That trusted program X can do this sort of thing without any double checks means that any untrusted code Y that can run because of a bug can make any changes that they want.

The point being: You can try to squash bugs and holes all you want; that won't stop someone from clicking on a link to killcomp.com, without realizing that it's an executable :-). It's equally important to prevent runaway code from bringing down the account, or the system, by putting in some sort of restriction.

And once my component is ready, the source is shipped to the security group for one final run through for vulnerabilities.

Ok, so your components are tested, and individually secure. Is the whole system -- how the components hook together, and are hooked together -- ever reviewed? Is the group that reviews all this willing to break compatibility to fix security?

Re:Perhaps this is _why_ msft is interested.

[rhizome]

are you saying that Microsoft is going to pull down it's userbase deliberately because it hasn't or won't consider it's own future?

No, I'm saying that having weak software is in Microsoft's nature. Their interests are so separate from their users', and the kool-aid drinking culture of Microsoft reinforces this, that they can't help but put out vulnerable software while offering grafted-on remedies for those faults. Hanlon's Razor tells us this is most likely unintentional.

They put out operating systems which include technologies that are encumbered by security risks and this is part of their business model. They've always done this and I'm pretty sure they always will. Now they're saying they're going to supply utilities to deal with the symptoms of these holes but they're so tied to their method of development that they are incapable of dealing with the source of the problems.

Re:Perhaps this is _why_ msft is interested.

[dioscaido]

When was the last time you used windows? Honestly, the NT4->2000->XP->2003 generation of Windows has everything you outline and more.

Except that windows, as far as I know, doesn't seperate group and user concepts

Windows has groups and users. On top of that, windows has a robust system of ACLs for every resource on your machine. Unlike a unix filesystem model where you are limited to permission for 1 owner, permission for 1 user, and permissions for 1 group, in Windows you can have an arbitrary number of groups and users attached to a resource (say, a file, folder, a registry key, control panel, who can log in and who cant, the event log, IIS configuration, etc...) each with its own security directive.

Want a restricted run mode? Remove the user from the Administrator group. Done.

Almost 99% of all spyware/virus/security issues on Windows come down to the fact that everyone runs as root. That doesn't mean that you can't not run as root. I've been doing it since 2003 and have no problems. For the odd app that's stupidly programmed I just 'run as...' Administrator, which is similar to sudo executing an app.

Re:Perhaps this is _why_ msft is interested.

[Keybounce]

I use XP on a daily basis.

The last time I tried running as an unprivileged user was windows 2000 terminal server. Uggh.

Windows has groups and users
Really? Take "Administrator" and "Administrators" for a moment. I have both of these tagged to my user account. Are they treated as different types, or just two different names, with different security ID's, that are used interchangably?

ACL comment

Unix permissions can do things that Windows either cannot, or are horribly hard to code.

Example: Group cannot do X, owner and world can do X. Assign group name of "Students", and world is the teachers, admins, etc. Now you cannot examine the files of the other students, but the teachers can.

In windows, in order to state that a larger, generalized group can do something, and you cannot, requires listing EVERY other member explicitly. Why?

Because in unix, "Group" means "The rest of the group except me", and "world" means "The rest of the world except my group and except me".

Those exceptions require explicit listing of every user. What happens when the users change?

How can you state "Group X can do this, but specific member Y of group X cannot"?

Run-as administrator? Well, gee ...

#1. You've lost all security. To use that, you have to give the admin password to anyone that wants to use that program. No more "This program is safe for anyone to use". You have to trust everyone with the privileged password, which means that "cmd.com" can be run as that secure account.

#2. Fails for group concept. Lets say I want to have the equivalent of "set-GROUP-ID games" on programs that can access a special shared directory, that is group writable by games.

I want these programs to run as user real-person, group games.

In other words, access ability of the user (so they can load personal save game, or save stuff in their personal folders) and group games (so the game can do things like securly update high score files).

Or, take the "standard" linux / redhat security model. Every person is a member by default of their own group. Files inherit group permissions of the directory they are in. Default permissions are group write.

If 20 people are working together on a project, files saved in the group directory are group writable, tagged to the group that the directory belongs to, and writable by any member of that group.

This model works fine even if a person is a member of 15 different groups. The file is tagged with the creator (which can be ignored), the group (generated by the dictory, checked based on the user that wants to access it).

How do I do that setup in windows?
And Linux does this with 9 bits.

Always report RSS abuse

[stinerman]

RSS abuse has gone on far too long. It may seem unthinkable to some people who long for an RSS of their own (but have had to adopt), but some people do abuse RSS.

If you see your RSS feed has some broken links or other irregularities, report it immediately to your sys admin -- even if the RSS explains it away as random line noise or CRC errors. Protecting one's abuser is a sign of continued abuse.

Only YOU can help stop RSS abuse!

Re:Always report RSS abuse

[shahruz]

I hear that RSS abuse may seem insignificant to some but is a serious issue. It will lead to more serious abuses such as illegal file sharing! :)

Address them!

[Gandul]

This would be a great opportunity to address the security concerns over RSS in very big lab. Using Longhorn as a test platform and counting on Microsoft's dominance of the desktop market might provoke positive reactions from AV and seurity software developers.

Question on Implementations

[BioCS.Nerd]

Am I correct to understand that the difference between RSS as found in Tiger and Longhorn is that the latter integrates it directly into the OS, versus the former which has RSS as a seperate component? If this is true, what sort of moron ... oh, never mind. Obvious answer to that question ;)

Re:Question on Implementations

[Anonymous Coward]

Safari is based on WebKit, which is, for all intents and purposes, as much a part of the OS as the IE engine.

So, no. You're not correct.

Is somebody hungry?

[B5_geek]

...decision to bake RSS into Longhorn... ...on the back burner.

No wonder MS says they can't remove things like IE from the operating system; They cook it all together!!!

Uh...

[Momoru]

I see the comments are already filled with "What do you expect its microsoft!!!" and "Hah! hacked b4 its out!!!" comments... This is just speculation about a potential vulernability, in a feature that is not even in a beta in an OS that is not even in beta. Cripes, at least wait until it's out before rushing to any judgements...you know you all use Windows anyways.

Re:Uh...

[peragrin]

Because MSFT is known for implenting good ideas poorly, and then extending them MSFT style.

When active X was new people were pointing out the potential vulernabilities as well. MSFT ignored those programmers. by 2003 Active X viruses were common place and being launched Daily.

Re:Uh...

[Avohir]

lets make a bet... if after a year of longhorn's release, no exploitable errors in their RSS component have been found, I'll give you all my worldy possesions... deal?

Re:Uh...

[CapnGrunge]

Insightful?

>This is just speculation about a potential
>vulernability, in a feature that is not even in
>a beta in an OS that is not even in beta.

And you have never seen crocks like this make it to releases, right?

The perfect slashdot article

[gowen]

vulnerabilities in iPod codec, then podcasting is a good way to deliver overflow inducing content.

Only on slashdot can people find a way to blame (putative) Apple vulnerabilities on Microsoft.

Re:The perfect slashdot article

[Anonymous Coward]

Could not agree more.

Re:The perfect slashdot article

[Anonymous Coward]

If Microsoft didn't exist, Apple would have a much bigger market share. If Apple had a bigger market share, it could solve world hunger and write 100% secure code with all the extra money it'd now have. Hence, it is Microsoft's fault.

Re:The perfect slashdot article

[masklinn]

The word is Don Park's, and the problem here is that embedding RSS/Podcasting deep into the os allows attacker to use overflows to inject code right into the OS' libs&spaces instead of merely crashing/killing the application.

It's kinda like ActiveX Vs XUL.

Weapon box versus sandbox and that kind of neafty things

Come on guys!

[KrisCowboy]

People have some predefined conceptions and opinions when it comes to Microsoft products. Being crappy, buggy and insecure are some of the deep-rooted features. We just can't say "No" to them. Come on Longhorn guys - I want features that might burn down my computer :)

Why worry?

[alvinrod]

With the brilliant Innovation (TM) that Microsoft is always bringing to the computer world, why should we have to worry about anything.

More seriously, by the time Longhorn actually gets released, the world might have passed RSS by. Either that or there will be several third party applications that will do something similar to what Microsoft hopes to do that will have already been released for XP.

Additionally, even if Microsoft does make an application that is buggy as all hell and hands every virus on the web free access to your machine, you don't have to use it. Unless, of course, Microsoft is tricky and builds it into IE. Even then you don't have to use IE.

So what if people are speculating about how bad this software will be and how insecure it could potentially be. If you don't use any of it, you really don't have to worry about it.

Re:Why worry?

[Alioth]

Yes - you do have to worry about it. Your computer is no longer an island once it's on the Internet.

At home, I do not run any Microsoft software, yet I still have to deal with the consequences of zombied Windows PCs on broadband connections, deluging my email inbox with spam and chewing up valuable network bandwidth. When SQL Slammer made its attack, it completely knocked out one of the ISPs here due to the massive amount of traffic.

Microsoft's insecurity affects everyone - even those who don't use MS software at all.

How else can they make you upgrade?

[Anonymous Coward]

Microsoft has to continually introduce half-baked, insecure, and extremely-hard-to-secure technologies into Windows. Otherwise we would not be forced license Latest-annoyance Scanner 200x which eats up gobs of RAM, bandwidth, disk space, and CPU time. Without this motivation we might all be happily surfing the web on a Pentium 120 running Windows 95. Microsoft's continued licensing revenues depend on them being able to slow your PC bit by bit. The HW manufacturers do something similar but they do it by changing formats of everything so you can't upgrade your old computer since you can't find parts for it at a retail store.

Re:Not IF there are vulnerabilities but WHAT they

[peragrin]

In 1999 people discussed the security problems of ActiveX. 3 years later MSFT was having a nightmare over those said same problems.

Embrace Extend poorly, an extinguish everything seems to be MSFT's philosophy.

MSFT wants locking so badly it forgets to look for the simple errors.

Sweet........

[ARRRLovin]

We'll get to test this in what........2 years? Maybe more? I heard OSX might threaten linux, any creedence to this?

There are no overflows in .NET architecture

[Anonymous Coward]

That's the whole point behind it. If the RSS interface is built entirely in .NET, then there's no security problem.

Re:There are no overflows in .NET architecture

[Reverend528]

So, there's really only one kind of security hole that can exist in software (overflows) and .NET makes such exploits impossible? I can't wait until everything is written in .NET so I won't need to use passwords anymore!

Re:Not IF there are vulnerabilities but WHAT they

[insert cool name]

let's not be obtuse - we know there are vulnerabilities, MSFT just doesn't want to fix them in a way that won't let them steal the underlying patents from the public and others.

?

If you can describe a mechanism by which fixing a bug in my code can result in me owning a patent I'd love to here about it.

if ( i = 0 )

apply magically process x and it becomes . . .

if ( i == 0 )

. . .and I now own the patent to creating documents by typing.

Software patents are pure evil, but they've got nothing to do with this.

Mod parent up

[Animats]

That's exactly what Microsoft tells the huge number of business users still running Windows 2000. It's not a troll; it's reality.

Microsoft keeps adding stuff to Windows that allows external programs to initiate activity from the network. Windows Messenger Service. Universal Plug and Play. Windows Update. Active Management. AutoPlay. Now, RSS. And they consistently have them turned on by default. This guarantees a large supply of future security holes.

In ten years, they haven't even been able to secure Outlook.

Easier way

[Anonymous Coward]

Can't MS just develop a specific API for people trying compromise windows machines, it would be less work for everyone.

Re:Easier way

[shutdown -p now]

They did. It was called ActiveX, but is now being deprecated in favor of .NET.

Re:Easier way

[monopole]

That's not how M$ works instead they are going to buy Claria and incorporate their API

This just in!

[RingDev]

Floppy disks, hot swap drives, CD/DVD-Roms, thumb drives, jaz/zip/spark drives, internet connections, etc, can be used to deliver worms and worse to the desktops. The point is not that RSS is a security vulnerbility, but that the OS and related sub systems must be up to the task of preventing the bad things that come across from doing damage. -Rick

Preach to the converted...?

[SamQ]

Anyone who's been using rssreaders will already be aware of this. The guys behind the excellent Rssowl disabled 'execution of active content' quite some time ago. So if you executed some unknown quantity whilst reading Dilbert, it was your own fault (for not vetting the source of the feed in the 1st place). The average PC is already filled to the gills with xml configuration files. As long as the developers and eventually the users don't do something silly...Doh!!!

OMG!!!

[oneeyedelf1]

In other news Internet Explorer automatically downloads pictures linked to in HTML. Images could contain worms. And be executed by possible buffer overflows when image is displayed. Personally I would love rss intergration for most programs, an easy way to integrate things like changelogs in newer version notifications to decide if updating is worth it, etc etc. I have a feeling lots of cool stuff could be done with this power. I am all about delivering content formated how you want it, where you want it, when you want it. Microsoft looks like its on the right direction here.

Re:Not IF there are vulnerabilities but WHAT they

[Anonymous Coward]

I also spotted the IF in "If there are any vulnerabilities in iPod". Come on peeps, this is a non-story, every piece of code in every service running has a huge great IF attached to it. What IF ssh has a buffer overflow bug!? Oh, I hear you say it could never have? Were you saying that in August 2003?. You can take it for granted bad code WILL be found in RSS streaming clients, and to integrate them into a system with high level privilages, and without years of testing is extremely foolish.

RSS is seriously overhyped

[suitepotato]

I barely use it to collate doings on the web and look at the skimmings on my Yahoo home page. It merely takes up space on Trillian and I don't even use it there. I can't think of anywhere else I bother. The only thing I can think of this being any good for is the aformentioned headline collecting and for web sites to automate their advertising yet another way.

Does every new webified format have to generate all the buzz it does? Or is it just because it touches on the (currently) new hotness iPod and podcasting?

Re:RSS is seriously overhyped

[Anonymous Coward]

its just another XML tag based data structure variation ie.

<element>
<subelement>
<subsubelement>
</subsubelement>
</subelement>
</element>

and it came into popular usage because people where fed up of visiting advert laden websites and sifting through pages of advertising to find a spec of content, RSS data is usually just the content without all the cruft, popups, javascript etc
its just a bandaid solution, it doesnt cure the disease and by this article it seems the disease is spreading via RSS now too

Re:RSS is seriously overhyped

[generic-man]

Thanks to overzealous users of RSS readers, some web sites actually embed more advertising into their RSS feed than they put on their HTML page!

Any binary data - exe, zip, pdf can be enclosed

[BoyBlunder]

Can we get back on topic and discuss the potential issues with RSS instead of the gratuitous MSFT bashing? All MSFT has done is bring this to the front burner.

RSS enclosures can move anything. Corrupt the underlying XML (or the data it is trying to move in the enclosure) and all your victims will pull it onto their desktops automatically. An analog is having HTML email and using a preview pane. You wouldn't do that, but RSS enables it. Got a PDF that exploits an Adobe vulnerability? Add it as an enclosure. Got an image? Same deal. Got a zip? Go ahead. It's not just the currently trendy podcasting and audio files that pose threats. Worse yet, there are many RSS clients our there, not just a few (unlike browser or email). Many opportunities to find holes. Most clients use IE to render the HTML, so there's also the risk of phishing, embedded script, moveable code and other standard HTML malware. What are the vendors doing to mitigate this? Good question. Anyone from feedburner, say, care to comment?

RSS doesn't stand for Really Scary Security - yet. MSFT just made it a much richer target - let's save the guesswork about the quality of their implementation for when it actually shows up.

Script Kiddie Support API...

[__aaclcg7560]

I wouldn't be surprised if Microsoft is doing this on purpose to show that only their new anti-virus program will be effective against these new threats since the Script Kiddie Support API is undocumented for outside anti-virus companies.

So Let Me Get This Straight

[DanielMarkham]

Because RSS allows enclosures, and because enclosures contain songs, and because songs can be ill-formed to allow overflow attacks -- therefore there is a weakness in RSS?
Perhaps a weakness in the codec, sure. Or a weakness in who you decide to download files from. Or even a weakness in your firewall applicaiton allowing sneaky code to talk to outside IP addresses. But a bug in RSS itself?
I must be missing something, because that doesn't add up, unless the goal is to change RSS somehow, simply because Longhorn is going to implement it?
Perhaps the unwritten story is that Microsoft is going to allow auto-code distribution and execution, in which case, I would humbly suggest, Microsoft has a problem, not the standard.
My two cents only

Can Chickens Swim? Find Out Now!"

Can't it wait until it's close to a release?

[mac123]

Gee, a potential security risk in an OS that isn't anywhere near release.

Yeah, that'll impact...lemme count....uh...carry the one...NOBODY.

How about writing about something a bit more relevant instead of wasting cycles speculating about security risks that may/may not exist in components that may/may not be included in an OS that is due for release in what...3 years or so?

Re:Can't it wait until it's close to a release?

[Anonymous Coward]

I agree. Too bad you were trolled.

Re:Not IF there are vulnerabilities but WHAT they

[lcsjk]

Owns a LOT of M$FT stock!

Re:Not IF there are vulnerabilities but WHAT they

[lukewarmfusion]

So why would it be Microsoft's fault if there is a potential vulnerability in an arbitrary software product delivered by RSS?

Scenario - iTunes uses RSS to support Podcasting. A hole in iTunes allows a malicious user to attack the user's computer via the RSS feed. What part of that is due to MSFT?

I'll offer a bounty of $1,000

[putko]

For an RSS-exploit in Longhorn that:

Uses a priviledge escalation to become administrator and then downloads a new and more secure operating system (e.g. OpenBSD) to replace Longhorn.

Re:I'll offer a bounty of $1,000

[Anonymous Coward]

Since every Windows user is administrator by default and doesn't bother to create a non-admin user account, the priviledge escalation part can be skipped.

MS vs Apple

[Anonymous Coward]

I'm far from an MS fan, doing all of my work for the last few years on Linux, and being currently in the process of moving to OS X. But I have to ask, why is /. reporting a possible vulnerability in an unreleased OS, whereas a serious flaw in the design of OS X (here, today, right now) has not been talked about at all.

Re:MS vs Apple

[Jumpin' Jon]

All together now...

"You're New Here, Right?"

Re:MS vs Apple

[earthbound kid]

Yeah, but if you have write access to arbitrary locations, you could always just write over applications with your own stuff. This isn't any more dangerous than usual. There's no remote or even local exploit here, just a good spot for trojans to lurk, which can always be done anyway.Well, at least until we get a per-application security model to replace the per-user one.

Re:MS vs Apple

[julesh]

Because this is nothing new. You can achieve the same effects with LD_PRELOAD on Linux, or by installing your own ActiveX classes in place of some of MS's in the Windows registry, or, probably, with quite a few other techniquees.

The only real difference is that the dynamic OO framework of OSX makes it easier to achieve useful results with it. Malicious ones are easy enough with the existing frameworks on other platforms.

so what?

[MatD]

Is this really any worse than all the open services that a windows box runs by default? Or using IE with the security settings turned down, or using IE at all ;) How about using outlook and having it set to autodisplay emails (including running activex controls etc embedded therein)? Sorry, but this isn't really news, until some company that makes an RSS reader sues MS for building RSS into the OS :) Mat

Re:Not IF there are vulnerabilities but WHAT they

[WillAffleckUW]

So why would it be Microsoft's fault if there is a potential vulnerability in an arbitrary software product delivered by RSS?

Sorry if I was obtuse, but I meant to say that they will probably choose to "fix" it, but in such a way that they "extend" it as a MSFT software patent and thus "own" it.

History shows us this tends to happen.

[caveat - I own MSFT shares]

Lovely...

[Guppy06]

Will it come with a new filesystem? No.

Will it come with a new command line interface? No.

Will it come with risk-laden RSS support "integrated" into the OS so that it can't be uninstalled? Yes.

Nice set of priorities there, Microsoft. I hope you aren't too surprised when I prioritize my cash in such a way that I stick with NT 5.x.

Re:Lovely...

[vcv]

Will it come with a new command line interface? No.

Yes it will.

Re:Lovely...

[Guppy06]

"For example, we are changing the command line environment in Windows using a new object-oriented command line technology, code-named "Monad," that will exceed what has been delivered in Linux and Unix for many years. It will take three to five years to fully develop and deliver."

--Microsoft VP Bob Muglia on 2005 June 7

Unless Longhorn is also on that 3-5 year timetable, it's heavily implied that the new CLI has officially been axed from Longhorn.

Re:Lovely...

[vcv]

"For example, we are changing the command line environment in Windows using a new object-oriented command line technology, code-named "Monad," that will exceed what has been delivered in Linux and Unix for many years. It will take three to five years to fully develop and deliver."

Now if you weren't just another slashdot troll, you would have actually watched the video where the quote came from yourself. And if you had done that, you would have heard Bob also state that Monad would be shipped with Longhorn as version 1 on their roadmap. They would then continue to develop it with more features and better integration for version 2, which to finish completely will take 3 to 5 years.

But Monad will still be quite usable in Longhorn, just not what they FULLY invisioned. Because, you know real software developers follow things called roadmaps. They have limited time, and try to implement only what they can in that time. Like how Firefox has different features slated for 1.1, 1.5, 2.0. Why don't they just put everything in 1.1?! huh???

New karma whoring technique?

[Anonymous Coward]

Parent wrote : "yes, it was a troll"

And he got modded +5 insightful!

Damn, next time I need to get a post modded up I'll mention that it should be modded down.

(BTW: despite being Offtopic, this was insightful or at least funny, wasn't it?)

Bonzi!

[Dolda2000]

It seems that Slashdot isn't the only ones covering this. :-)

Um...whatever

[Chanc_Gorkon]

I FAIL to see how RSS can be a dangerous vector for viruses. Why do you ask? Well, first off, it's no worse then a web browser or e-mail which both happen to have the same ability to download executable binaries. Second, Mozilla Firefox, iTunes, Safari and proabably IE 7 currently have no way of automatically running code. I have seen more iPodder clients (iPodder itself did have the problem but does not any more) that have the ability to open the media file upon download. The problem is much worse if Microsoft decides to do something brain dead with it. Now, if a virus is downloaded in a enclosure, there's still no danger.....you have to click on it for it to run. Plus the automated features of most podcatchers will save us. If your podcatcher, safari or IE7 downloads a virus in teh middle of the night, your nightly virus scan should catch it before it's too late if it doesn't catch it as soon as it's written to the disk so am I worried about RSS being a vector for this stuff? No more then I already worry about idiot users....means I don't loose sleep over it.

Not that big a deal

[iabervon]

Integrating RSS into the OS is a bad idea, but not nearly as bad an idea as integrating a web browser, which has all the same issues and more. RSS doesn't fundamentally do anything more than a web browser, aside from automating revisiting a site. It doesn't deal with local files, so there's no trusted files going through it to complicate authentication issues. It's also much more limited in the expected control of the user experience, so there's less chance to spoof things.

Re:Not IF there are vulnerabilities but WHAT they

[Ryosen]

The RSS enclosure tag (which contains the url to download) is associated with MIME types, not an iPod. You can use RSS for distributing software updates, for example, and it is certain that it will be used for this purpose. It is moronically easy to put an executable (or similar) into an RSS feed. Given that the majority of people that get podcast feeds have little to no understanding of how it actually works, you can bet that this will be exploited. They might be safe using their run-of-the-mill RSS feed consumer, but that's not what the article is about.

The story here isn't that the protocol can be exploited, it's that RSS processing is being embedded into the **operating system**. Once more, we see a vendor (Microsoft) including superfluous functionality into an application system that should not be there.

From the article:

Microsoft plans to embed an RSS (Really Simple Syndication) platform to automatically distribute feeds into Windows applications, both its own and those from developers. The plan is for Longhorn to provide a common feed list of subscriptions and a common feed store of data in Longhorn, which will be available to applications through Windows APIs.

One compromised source server, be it Microsoft's or a 3rd party's, will immediately push out malicious code and do more damage than any email-based trojan or website-installed spyware could ever hope to do. And while some folks like to think that their servers are impervious to attack, we all know that is simply not the case.

It's is not a question of "IF" [sic] but "when". By bringing these issues to light now, rather than after the fact, it is hoped that Microsoft can be pressured into reversing their decision to integrate RSS-based APIs into the OS.

Separating software from OS

[Anonymous Coward]

It all comes down to separating OS from software. Something MS just don't seem to understand.

On a sarcastic note, maybe it comes from them wanting to sell more software. If it usnit emmbedded in the OS you have to pay for it (DOC reader/writer, decent image editor etc. etc.). No one is going to buy an RSS reader from them, so they have to make it part of the OS.

Keep the EU lawyers busy

[subl33t]

This is something else the EU could sue MS over. Will Longhorn be available in the EU WITHOUT the RSS built in? They already got nailed for embedding Windows Media Player...

overflow inducing content

[SlashDread]

Most people here would -welcome- that kinda content..

Re:overflow inducing content

[essreenim]

Yep, I believe if he knew what he was talking about it would be "delivering content via overflow"

The bug is the developers

[Anonymous Coward]

Seriously, the guys working on the Longhorn RSS project are the biggest collective bunch of choads ever. Don't believe me? Here's an hour long video of them talking about Longhorn and RSS, and how they're going to make RSS great... in a few years, you know, when they get around to releasing stuff.

The Video

If you don't want to kick someone in the head after watching that, you're not breathing.

RSS Isn't A Security Risk...

[bigBlackSabbath]

... anymore than a browser - as long as RSS is implimented so that the user chooses the RSS feeds to subscribe to.

Email often is the source of malware because email is passive - people are sent email, they don't choose it. Peer to peer as well is often a source of malware - people are exchanging files they believe have content they want and either are unaware of the risks or are willing to take them.

RSS is different than both of these. Unlike email the user has to CHOOSE to receive content via RSS, whereas email is directed towards the user. While it is similar to peer to peer software in that people may exercise poor judgement in selecting sources for RSS, I would think people would ultimately select from far fewer separate sources of content with RSS as opposed to peer to peer scenarios, and there are many sources of good RSS content from well known sources (e.g. Reuters, Slashdot, NYT, Air America, etc.).

How is this any more of a risk than a person visiting a questionable website which downloads malware?

If people are dumb enough to subscribe to questionable feeds without the proper precautions, RSS doesn't make this any easier.

Re:RSS Isn't A Security Risk...

[MrPink2U]

You comclusion assumes that the RSS source hasn't been compromised. What if someone hijacks the slashdot, CNN, NYT, etc. rss feed?

Re:RSS Isn't A Security Risk...

[bigBlackSabbath]

And how is that different than if they hijack the website? Which, by the way, I'd assume would be the case in many scenarios like that since RSS feeds are often served by the same web servers serving a site. It's still an http server.

They're either hacking a server, or hijacking DNS or using some exploit which would still apply to a regular web site - just because the content is received via RSS does not necessarily make any of those scenarios unique to RSS. If somebody hacks Slashdot, and set up a lookalike site which sent malware to unsuspecting readers with lousy browsers and inadequate protection, the result would be the same - RSS itself doesn't present the problem.

Just because RSS readers often fetch content at regular intervals, does not substantially make it different than a user's set of bookmarks which are used frequently - if the source of the content is compromised, it may already be too late if the user isn't aware or is inadequately prepared.

RSS as a format doesn't require all attached enclosures to be automatically downloaded - that would have to be done by a poor implementation of RSS.

MOD PARENT

[Anonymous Coward]

EOM

Re:LAST POST

[ThJ]

? BabelFish says Natural Donkey Cat.

the problem isn't RSS, it's Longhorn Architecture

[v3xt0r]

RSS is not exploitable, the software that renders it is.

Microsoft needs to focus on a secure RSS aggregation engine w/ secure algorithmic filtering, and then stfu.

RSS is a potential attack vector

[vonoech]

In this instance RSS represents a particular attack vector (or a transport mnechanism) that an exploit (like a virus or a worm) can take to attack the host system.

I think it is interesting that Microsoft is using a well known protocol in Longhorn, especially one that wasn't developed at Microsoft. If RSS in Longhorn is exploited then the folks their can point back to the open source RSS development community and look for help getting the vector or the exploit addressed.

It will also be intersting to see the kind of impact that Microsoft might try to have over RSS development going forward.

Well

[Beefslaya]

How is this any different than IE?

MS users are used to an OS and Internet Browser blown full of security holes.

Keep up the good work guys.

Re:Not IF there are vulnerabilities but WHAT they

[masklinn]

I also spotted the IF in "If there are any vulnerabilities in iPod".

Way to miss the clue train, the phrase was "if there are any vulnerabilities in iPod codec or any MP3 player hooked up to podcast sync client codec then". The issue here is that the codecs may have vulerabilities to buffer overflows (even images formats ain't immune to that) and that integrating RSS & podcasting deep into longhorn may unleash yet another way to fuck it up.

Worrmcasting?

[Scott Byer]

Using phish for bait?

This Is Why a Secure Windows is Impossible

[Prototerm]

This latest bit of news exemplifies why Microsoft will never be able to secure Windows -- why, in fact, it will never be able to even come close. Microsoft has this philosophy of supporting features like RSS in the lowest levels of the OS, in ways no sane person would even consider, never mind implement. Programmers always make mistakes. That's a given. All it takes is one small mistake to compromise the entire system. You don't add this sort of feature without being very careful (and we all know how successful Microsoft has been in this area).

I don't care what Microsoft says in its Get the FUD campaign, this design philosophy is the reason Windows will always be inferior to Linux when it comes to security, not the relative popularity of Windows and Linux.

As I've ranted before: using Windows is like having unprotected group sex with a roomful of complete strangers. This latest hare-brained scheme of theirs will like inviting even more people to the sex party. Ugh! Time to become a Monk.

Re:This Is Why a Secure Windows is Impossible

[amliebsch]

Microsoft has this philosophy of supporting features like RSS in the lowest levels of the OS

Eactly. That's why systems like Linux or OSX have absolutely no systemwide API libraries.

Re:This Is Why a Secure Windows is Impossible

[drsmithy]

Microsoft has this philosophy of supporting features like RSS in the lowest levels of the OS, in ways no sane person would even consider, never mind implement.

For example ?

Re:LAST POST

[PhoenixPath]

lmao... Did the same thing... One word: Wha??

Re:LAST POST

[Khakionion]

I think it's his user name, poorly translated...

Can someone tell me: why the name "longhorn"?

[Anonymous Coward]

what the hell?

"Push" redux

[wiredlogic]

I'm telling you. Push ^D^D^D^D Active Desktop ^D^D^D^D RSS technology is the next big thing...

Re:the problem isn't RSS, it's Longhorn Architectu

[Anonymous Coward]

RSS is not exploitable, the software that renders it is.

Exactly the reason I don't use Thunderbird for RSS feeds. My Firefox installation has been about:config-ed to the hilt over time for the blend of security, privacy and functionality I prefer. I wouldn't know where to start with setting TB's vanilla rendering of pages to an identical standard. (Not that FF's implementation of RSS is much to write home about, I'm a Sage person myself)

Oh Seamonkey, where art thou?

It isn't even available yet

[HermanAB]

and people are already talking about security holes?

Windows really raises interesting expectations.

Re:Not IF there are vulnerabilities but WHAT they

[xmedar]

I'm sure they'll have dumb stuff like ActiveX scripting in RSS feeds, plus I'd expect the feeds will have to be served by IIS, the security Swiss cheese of web servers, expect CodeRedRSS real soon now!

Re:LAST POST

[ThJ]

By Babelfish itself, I suspect. XD

MSFT wants to upgrade RSS...

[flunkee]

...to include a post ranking for feeds, so 'important' articles can be pushed ahead. I see it now: RSS Spam! Ads littering the top of your feeds! shoving all other feeds off of the screen: "Everybody Loves Baklava!!!!" Click a fake article and get porn trojans that add endless sex links to your RSS feeder. It will be the same fiasco as IE. And, of course MSFT won't see the problem.

Meta-Mod

[Anonymous Coward]

This isn't Flamebait; it's a proportional reply to the parent.

Accordingly, I have meta-modded the 'Flamebait' mod 'Unfair'.