Slashdot Mirror
Microsoft vs. Computer Security
ArieKremen writes "The Slate has a piece written for the average user attempting to explain why Windows is `still` grappling with security issues. Although Gates made security and privacy top priority four years ago, not much progress has been made." From the article: "Microsoft customers haven't stopped worrying. A year later, Windows was hit with several nasty worms, including Slammer, Sobig, and Blaster. The viruses caused major traffic bottlenecks throughout the world, which cost tens of billions of dollars to clean up. Vulnerabilities deemed 'critical' have forced the company to release an almost unending stream of patches and fixes to the Windows operating system, Microsoft Office, and Internet Explorer." An interesting look at the whole issue.
Some kind of anti-microsoft site?
Their solution about how to shore it up: don't use IE, Media Player, Outlook, etc.
I hate to sound like a kid, but DUH!
Given, I use Firefox, Thunderbird, and other non-Microsoft programs because I like them better and they tend to work better, but the fact that they're less likely to compromise my system is also a consideration.
Note, though, that I say less likely. We have had bug/security fix releases of Firefox and there was a brouhaha with the GreaseMonkey extension inducing a vulnerability, BUT for the most part it seems the fixes were less frequent than with IE-related patches, plus they usually only compromised the browser, not your whole PC.
That's the big problem with many of the Microsoft glitches. They're not limited to the vulnerable Microsoft application. The vulnerable app provides a gateway for compromising the whole PC.
- Greg
Start a happiness pandemic
i must agree: the very "constant stream of patches" is in fact great progress; to have that kind of rapid support, delivered by an automated update system that for me at least works seamlessly, is incredibly good!
Computer security will get worse before it gets better. It's the second hardest problem in computing, coming second only to DRM; which is provely impossible to do properly.
The problem comes from many quaters: some theortical, some practical, some managerial. For example:
I could go on for quite sometime.. the point to appreciate here is that it isn't all Microsoft's fault but they could do a whole lot more. If we could just get rid of the overflows that would be a good start!
Simon
The article is advising people: "Besides avoiding Microsoft products, one way would be to use substitutes whenever possible. If you run Windows or the upcoming Vista, use a different e-mail program, browser, and/or media player than the ones that come in the box. Stay up to date on patches and anti-virus software."
I thought most importantly users should be responsible enough not to simply click on or open anything in front of them.
Virtual Betting on Facebook for non-geeks.
will be under these kind of attacks all the time. Geeks, like everyone else, wants to stick it to the man. The man in this case is Gates and Windows. While this does not excuse the flaws and lack of attention at times, it does present another angle. To make a OS as robust as windows without things like this happening is hard to imagine honestly. If Macs were what windows is today, the story would be the complete opposite I assure you. You see the SAME thing in popular games as well. The most hacked games are the biggest and best, not because it is easier, but there are far more people attempting to exploit the system.
Invexi - a Phoenix, AZ based web design and web development company.
Gates urged that new design approaches must "dramatically reduce" the number of security-related issues as well as make fixes easier to administer. "Eventually," he added, "our software should be so fundamentally secure that customers never even worry about it."
Fair enough, but regardless of what is happening in the way of "new design approaches", the current installed base is the problem. The best ways to show dedication to the reduction of security issues would be a) rigorous code review + pre-emptive bugfixes and b) more rapid response to issues that are found elsewhere. There have been improvements, but the sum of the successes will not outweigh the sum of the failures.
I want to drag this out as long as possible. Bring me my protractor.
Considering where they started, just getting to BAD is a tenfold increase! And to be honest, they have come a long way. They just have a VERY long way to go.
FTA:"With the company's security problems still monopolizing the news, you might have expected that Bill Gates would address the vulnerability at the Consumer Electronics Show in Las Vegas. Instead, he boasted how Microsoft's new operating system, Vista, would extend the company's tendrils into your living room. Sure, it might be nice to connect your computer and your television set. But is it worth it to give hackers access to your television?" LOL!!! My prediction? One week after "tendrils" are extended, we have Goatse pics on all of the network's broadcasts- gaping across screens all over America...IN HDTV!!!!!LOL!!!!I can't wait, then maybe will start to wake up about security after getting "spammed" with Goatse on their tv's! HaHaHaHaHA!
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
From TFA: "...Microsoft is still the dominatrix of the desktop..."
Yeah, baby. Tie me to your platform and make me pay.
That's "Mr. Soulless Automaton" to you, Bub.
That ought to teach Microsoft not to get rid of a publication they owned for a while...
-JMP
tens of billions of dollars to clean up
you know we as a tech community lambast the **AA whenever they (and the media) say a "hacker" did millions of dollars pirating
why do we not do the same when crap like this gets printed?
tens of billions? prove it, thats our job, thats what we do
The More Knowledge you have the Luckier you Get- J.R. Ewing
Perhaps more accurately, users of windows have made no progress. Quite a few of the worms that have made big headlines over the last few years are ones that make use of exploits for which patches were already available. It's long been said that people are the greatest security problem. And I believe that applies to Microsoft's security problems as well. As long as the education of Microsoft's user base is neglected (or actively refused by some), MS's efforts (feeble as they may seem at times) will have limited success.
The only thing worse that "Windows" in the common OS versions in use... is the orphaned version of XP called "XP 64 bit edition" that doesn't work with all the tools normally used to resolve security issues. Many applications that we use here in the shop just flat dont work with 64. It looks like MS just took Server 2003 slapped an XP theme on it, and then broke all the strengths of both OS's. As a result, I've got a number of issues over here that I can't get resolved. As soon as I get a decent copy of the latest Vista Beta, I'm just going to make that switch. XP x64 is just about useless because of the security issues. This box is getting hit left and right, and is constantly stumbling. I'm not looking forward to all the new issues with Vista, but at least I won't still be using XP64 any more. (Yes, I've got a Linux partition... but that's not the point)
MadOgre.com
I don't know if I'd chalk this all up to lazy sysadmins. While that's a factor, there's also the IT director at whatever firm who wants "stability." Sure, some of it is sysadmins not paying attention. But some of it is also sysadmins at war with the suits because, "that system cannot go down... not even for maintenance. I don't care if nobody uses it between 1 and 4am or on the weekends." (Yes, I've seen shops like that... those are VERY costly errors on management's part.)
Critical patches should ALWAYS be installed as soon as it is feasible. You should have a test system available where you can install them and run your regression testing, if you're in software development. If all you do is use your computers for word processing, data entry, specific applications, etc, you should, for the most part, be installing those critical patches as they come out. I tell family and friends to do that. My seldom-used windows box here at work gets done by corporate IT, and they seem to stay on top of a lot of that.
OCO is Loco
Well, some may call that progress, it's really a band-aid solution to a much larger problem Microsoft appears to be addressing already. Their codebase is OLD, not to mention poorly designed. NT was written as kind of a test bed for new technology. It wasn't originally designed to be a production system. Now, you've got a million people doing a billion different things to who the hell knows how much code. It's hard to make much in the way of progress if you're trying to swim up a waterfall. I think the only way they're going to make progress is to change directions.
There, I've just saved you from having to RTFA.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
I have never read a more scathing remark of Bill outside of /. :
And the next time Bill G. promises to make software that is so fundamentally secure that customers never have to worry about it, ask him what decade he plans to release it.We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
It was noted elsewhere that Microsoft spends six billion a year on R&D. If they hired mathematically-inclined software engineers at 100,000 a go, they'd be able to keep a small army of 10,000 such programmers. You can probably reverse-engineer a specification, prove, then re-engineer the code for about 10 lines an hour. Assuming a 40 hour week, that means they could formally re-engineer 208 million lines of Windows per year. Even with all of the standard applications, libraries and utilities, the team should have an iron-clad damn-near-bugproof Windows within 2-3 years. It wouldn't cost them any more than they're already burning on patents for stuff nobody else cares about, and would save three times the total cost of the bugs to the country within a single year.
The overflows are easier. You compile all the applications with something like ElectricFence, dmalloc, or some other debugging malloc. A few tests at Microsoft should then collect a lot of the overflows. You then recompile such that the debugs won't cause fatal errors but will still generate alerts. You have the Windows error reporting tool collect all those alerts and either notify the user at the time & allow them to send, or send in bulk on the next major error. Microsoft can then fix the overflows BEFORE someone exploits them, because the odds are high that they'll be accidentally triggered long before any black hat learns about them. If only because there are several hundred million users, and most will be trying to do things that are impossible or - at the very least - seriously warped.
Of course, they could also get a copy of the Stanford Code Validator, or even just download a copy of splint off the Internet. Both would pick up the majority of coding errors and allow Microsoft to fix them.
Regardless of which of these solutions is used, a company the size of Microsoft should be able to completely and utterly clean their software of 98%-99% of its defects within three to four years. As the article noted, it has now been over four years since the proclamation of taking security seriously, but yet there is no sign of any kind of rigorous campaign to really erradicate faults. Rather, there seems to be much more of a campaign to make users more accepting of the fact that there are faults.
Not everyone can guarantee 99% fault-free software within a reasonable timeframe. There aren't the mathematician/software engineers, for a start. However, maybe it would be possible to have a standards authority that could certify a software product as "mid-grade" (50% bug-free), "high-grade" (75% bug-free) or "mission-critical" (99.99% bug-free). Software providers could elect whether or not to be certified and consumers would then be free to decide how much quality they want to pay for, because they'd know how much quality was there. Consumers would also be in a stronger position to interpret the lack of such certification.
Thoughts?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
It makes no comments as to why Microsoft stuff is any better or worse than anything else. There's no mention, let alone a comparison between Microsoft and Linux, Apple, or anything else beyond just a mere fluff sentence.
But beyond that, my biggest issue is there are no FACTS in the damn piece. Everything is anecdotal. How are Microsoft product's better/worse? Why? By what measurement?
All this article does is pick on Microsoft because it's the biggest and easiest target, so any flaws make the news. It's like saying Wal-Mart still offers only low wages and busts up unions. Duh - so do a lot of other companies, but Wal-Mart gets the attention because they are the biggest.
Explain how they are better/worse/the same as the mean, or average, or some kind of realistic comparison. This is just a rant, nothing more.
Somedays it's just not worth chewing through the restraints...
Microsoft made the choice to tie things closely to the OS. In particular, their Netscape killing plan was to essentially make IE part of the OS. Outlook also requires the presence of IE to render html mail, or at least it used to. Similar decisions were made regarding hooks to the OS for other Office programs. These decisions were made for reasons of competitive advantage over competing software such as WordPerfect and Lotus.
The consequences of these decisions is an OS with fundamental security issues. Microsoft has an opportunity to change this with Vista, but I'm betting that they haven't.
Some mornings it's hardly worth chewing through the restraints to get out of bed.
An insane amount of progress has been made on Windows security. Automatic updates ensure even the most retarded of end users has a chance of being patched, built in firewall has resulted in a significant chance of end users having a firewall, the security added to IE in SP2 has given a whole lot of protection.
It doesn't matter who the dominant OS / company is, the biggest threat to security on anyones computers is the person sitting in front of it.
You can't win a fight against ignorance, misunderstanding or plain stupidity. Microsoft has made some pretty damaging blows and that is commendable.
I think it's time the end users' took just a little bit of responsibility for their security issues. It's callous to assume (and blame) Microsoft when so many 'issues' are avoidable with a little common sense.
God help the *nix world if they ever get bundled with the masses of ill-informed, ill-prepared and irresponsible people who use Microsoft software.
I like this whole "versus" thing. It encourages the idea that Microsoft is against or competing with the idea of Computer Security in general.
putting a nappy on a baby can't be thought of as "progress" in stopping it from shitting itself.
The popularity argument is pure bullshit. Non Microsoft runs most of the web and anything that's mission critical. Those foolish enough to try making M$ do things live to regret it and it has nothing to do with popularity, Geeks and Nerds but everything to do with marketing and crappy software. Apple, Sun, Linux and every other kind of software works better and non have had the kind of automated worm problems M$ has.
From the above, you can imagine that the functionality and features excuse is also bogus. Operating systems robust enough to provide services over the network can also be made with pretty GUIs that are equally robust. There is nothing a Windoze user can do that I can't do better with free software and many things that I can do that they can't without lots of effort and money. I share my classwork with anyone who's interested and I share my music and movies with myself without any of the problems Windoze users suffer just connecting to a network, reading their email or browsing the web.
When is the big Linux worm coming? Never, thanks to the diversity of excellence that a truly free market for software provides. Free software writers also don't make the mistake of mixing content with executable code, unless they are copying someone else's bad implementation for compatibility sake. Still everyone makes mistakes but that still won't do to free software what it does to M$. As an example, imagine Firefox had a problem. It would get about 1/3 of GNU/Linux users. Why? because the rest of them are using other browsers and all of them can stop using the browser with a problem until it's resolved one or two days later. Because Free Software is all about code, binary problems don't automatically propagate across distributions. A Red Hat exploit might not work on Debian and probably won't on Gentoo and won't do anything to a BSD box. The Free Software fix is always easier too. When things go wrong on a free software box, the user downloads the latest and greatest to fix it. The worst case is a rebuild, which preserves all user data and takes less than 20 minutes. In the Windoze world, the user takes out their "original CDs" or blows a few hundred bucks at the computer store for software that's at least two years old and probably has the same problems. Things are much much more difficult for crackers outside of the M$ monoculture of binary crap.
Friends don't help friends install M$ junk.
There IS reason to believe that Mozilla's coders are that much better; The most serious hole found in Firefox in some time actually ended up being a hole in Windows.
FF has gone through more versions because they don't release incremental security patches, and because their code is subject to public review. Microsoft does release patches, meaning there are less versions, and their code is not subject to public review, meaning they fix problems only when someone finds one accidentally.
Your arguments are universally specious.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The whole article is a troll.
n -us/dnsecure/html/sdl.asp
Its filled with 'feelings' and 'impressions' by people cited as experts, without examination of their claims - nor an inquiry to factual matters. It describes a dislike, without addressing the basis of the problem, nor posing any other solution beyond disliking Microsoft.
The fact is, you still have millions of Win9x and NT boxes, hanging their gut out on the 'Net. This is and has been the principal problem. Slammer worm? Christ, I blame the crappy network border management, that allowed a local service-discovery broadcast protocol to come in from the Internet without being blocked.
I trust Rich Forno on Unix security. To use him as a source on Windows secuity is ridiculous. He is anti-Microsoft in bias - irrationally so. Microsoft could buy OpenBSD tomorrow, stick IIS6 on it, and Forno would still rant about the thing.
The WMF problem is a legacy file format. Let's not give MS a free pass on this, but seriously. It's like the zlib problem we had across distributions, a couple years back.
There are some other gross inaccuracies claimed by 'experts' and 'analysts' in this piece. "It is still built on the same legacy code, it is still written without adhering to secure coding practices, it is still thrown to the masses without adequate security testing." That's an assertion without supporting evidence. It doesn't have a factual basis. The MS SDL is a very good security development and testing process, implemented company-wide in 2003. Don't take my word fo it. Read the damned thing. This is how to do it in commercial software.
http://msdn.microsoft.com/library/?url=/library/e
I wish I saw similar efforts from Oracle, or any of the other major commercial software vendors.
It remains to be seen if this methodology is well-executed. Server 2003 is the first full-blown OS released thouh a full SDL cycle. So far, it has been a reasonably secure system, with limited exposure of default "attack surface", and intelligent choices about vunerable service and connectivity configurations.
Vista will be the first full SDL derived client. While I may not like the policy enforcement of "Digital Rights" and whatnot in userland, as a system I expect that it will be difficult to exploit or escalate privileges - and that attacks will be localized at isolated in effect. Let's hope so.
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
NT was designed to replace VMS at DEC.
It was written to be "OS/2 v3", once Gates poached Cutler's development team.
It was grafted onto the Windows shell as a long-shot, after tensions between MS and IBM began to manifest themselves over the success of Windows 3.0, the failure of Presentation Manager and the differing visions for the future of OS/2.
Drivers for NT were still alot like drivers for VMS, from the API point-of-view.
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
Their overall conclusion that MS products are still vulnerable to security problems is correct, but it is not accurate to suggest that Microsoft has done nothing to address buffer overflows. Now it is clear that they have not done all they could. Specifically, they have not started writing their applications in type-safe languages, and they have only recently starting trying to apply automated static analysis to detect buffer overflows in existing code (A technical report about their efforts can be found
here ). And of course, they haven't even vaguely considered requiring that drivers carry safety proofs (using the proof-carrying code stuff from Peter Lee and George Necula, for instance).
However, they have added support for computer architecture features which guard against this sort of attack, such as flagging data memory as non-executable and requiring jumps into code be word-aligned, features which is available in most new processors. They've also begun loading libraries to random addresses making it much harder for worms to know what address to jump to. Although none of these is a silver bullet which prevents all buffer overflows, they have definitely made it significantly more difficult to exploit buffer overflow errors in both operating system and application code. These features even have benefits to third-party applications.
So although the battle is certainly far from won, suggesting that Microsoft is doing nothing is ridiculous. These sort of features are not going to be visible to the user in any obvious way, but they are very good steps in the right direction. I'm certainly no Microsoft lover (I have a Mac and a Linux box and tend to avoid MS products), but if you actually keep up on Microsoft's security research and what from that is making it into the operating systems, it's obvious that they're taking buffer overflow attacks very seriously and making progress. The simple fact of the matter is that the reporter has not done his research.
Keith
Apart from anything else, most Linux geeks I know see contributing to open source as a more than sufficient two fingers to Microsoft.
For the love of God, please learn to spell "ridiculous"!!!
One thing to help would be a default account type in the Users group, and if currently an admin, switch your group to Users. Third parties need to fix their programs that requires more privileges (not necessarily admin) after the program is installed because of write access to system folders and HKEY_LOCAL_MACHINE. Vista fixes this, but if you ask me I think MS is only encouraging the bad behavior of alot of third party programs by providing this method of keeping non-compliant applications compatible with least privilege. (Keep in mind, there are a$$holes like Even Balance who purposely wrote their anti-cheat to require true admin privileges)
Sure they have a firewall... you're screwed as admin because the code that launched can also create an exception for itself via netsh command or damn it all to hell and disable the firewall via "net stop". Malware does do this today, and sad how easy it was stopped.
Don't want to run as non-admin? XP can run specified apps automatically with User privileges even if you are admin (and I am not talking about Run As with a lower privileged account). And for fuck's sake, don't take the default of "SYSTEM" for your apache or whatever server software services.
Blame the user, not the software.
Actually the article is a lot of the same old "what's wrong," and darn little "why." Accurate enough, but nothing new—waste of a Slashdot posting, if you ask me.
I figure by 2030 or so my 6-digit UID will be something to brag about.
"Although Gates made security and privacy top priority four years ago, not much progress has been made."
Excuse me? No Progress? Including a firewall with Windows is no progress?(emphasis mine)
There's this thing called reading comprehension. There was never the claim that there was no progress made, only that there was not much, ie little, progress made. Considering how many and how deeply worms have been able to attack in spite of said firewall, I'd have to concur. Feel free to try to disprove his "not much process" claim, btw, because if you argue against the actual point you might be able to point at things with put at least some weight behind your counter argument.
Eurohacker European paranoia, gun rights, and h
I tend to prefer the question, why are Windows customers still grappling with security issues?
Relax. Don't worry. Be happy. Your daily stress will be less if the main server crashes.
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
Excuse me? No Progress? Including a firewall with Windows is no progress?
Of course that is progress but the real problem with Windows is the fact that it carries a burden of bad design decision at a fundamental level made for all sorts of business and marketing reasons. Why does a process like Microsoft Internet Explorer (Which is mainly a bigger gateway for malware than Firefox because it is badly written not becaue it is a Microsoft product) have to run with admin privileges? There is a reason why that is going to change in IE7 on Vista. Come to think of it, why the hell does the normal Windows user even have to have Admin privileges for day to day work to begin with? Thousands of Linux and Mac users get along just dandy with restricted user privileges apart from the occasional annoyance of having to either log in as root or in the case of OS.X feed a nag window the root password so that the occasional installation program can touch sensitive parts of the OS. You can try to write this off as *NIX evangelism but it is hard to deny that in the ancient past this sort of shoddy design work solved complicated problems for MS quickly and cheaply and for that reason it was allowed to happen without contemplating the long term effects. Unfortunately MS has since learned the hard way that thinking ahead sometimes pays but now they are also learning that back-pedaling is hard work.
Only to idiots, are orders laws.
-- Henning von Tresckow
You're confusing the layers, there. There are parts of Windows that Microsoft WANTS people to use, and those are reasonably clear. Then there are those part that Microsoft doesn't want people to use, and those parts ARE obfuscated. I only need name 2, ".doc" and "ntfs", both under vigorous attempts to reverse-engineer ***for the legally protected purpose of interoperation*** by third parties, for YEARS, with only marginal success.
Arguably, a clearly, concisely, well-defined data structure or format would also fall to reverse-engineering fairly readily. Many people have long suspected that Microsoft has deliberately complicated their formats, for the specific purpose of hindering interoperation. There have even been statements *from Microsoft* about "rich binary" data formats and protocols in order to protect their products. But the sword cuts 2 ways... Last I heard, there was no engineering or programming document describing ".doc", the documentation was the source code of the ".doc" reader. Maybe that's ok for a minority-share product, or a SOHO product. But about the time they're insisting that government institutions should use ".doc" as their archival data format, IMHO it just doesn't cut the mustard. Excess complexity also makes it difficult to get all the bugs out - just the thing you want in archival data storage - or a filesystem.
Microsoft may not be guilty of every sin that everyone would like to pin on them. But they DO have plenty of sins that do stick, and to not pin those is a disservice.
The living have better things to do than to continue hating the dead.
Microsoft is no different than many other large publicly traded companies. They hire inexperienced programmers right out of college who have little or no programming experience background. These people wind up writing insecure applications that become widely exploited by external individuals, groups, corporations and the very programmers that Microsoft hired. Its hard to sit back and assume that these programming errors are indeed actual mistakes. A whole cottage industry has formed around these programming mistakes, the "anti-virus industry".
Microsoft is driven by profit, has made private agreements with other companies behind closed doors. I would not be surprised if in years to come it is exposed that Microsoft has purposefully made their various software insecure to allow the anti-virus industry to thrive and prosper. I'm sure that put in the same position of a powerful software company, most people would do the same thing. Whoever said capitalism was supposed to be moral?
Besides this, Microsoft is in no rush to fix their software problems. Why should they? You already paid for their product. They have your money. It makes no sense for them to fix it after they have already been paid.
Ubuntu quite frequently tells me there are updates available for a large variety of packages I run, so what's the difference. This close-minded MS hating mantality gives me the shits. Everything is fallible to some degree, it's just a question of how much that degree affects you.
Anonymity of the internet is responsible for the views expressed in my post.
well for starters
why wasnt the Firewall on by default in the first place
i never needed a firewall on Windows 98 or 2000 for that matter
why did a firewall become such a necessity on XP?
a firewall is a bandaid solution to a deep seeded problem issue.
it is not absolute progess.
Can you name me which modern OS shipping made a MARKETING decision to put their video drivers in the kernal? When NT went from 3.51 to 4.0 and they tossed in the Win32 widgets and they FORCED the kernal team to put the video driver in RING ZERO. They did not like the numbers they were getting. Was the user going to pick another VENDOR'S OS? :-) They wanted a reason for the user to PAY for an upgrade. Nobody pays for a SLOWER OS. Those just don't sell well.
;-)
:-)
;-)
:-D
Want another example?
How about 'priority boosting'? That is where only MS boost the thread level of the actively running application so it 'appears' to run faster to the user. This has created all kinds of fun problems for developers but 'hey' it SELLS upgrades baby.
Here is a fun one for you.
Why is it when I go into my CMD shell I can do a 'NET STAT'? Where did that stuff come from?
That would be when they put it in the NT kernal to compete with Novell. They have just been too busy helping the customer to take it out. All of the NET commands came from MS Lan Manager. I'm sure there isn't a Netbui stack that has kernal access either.
And people wonder why Linux runs so much quicker? I mean has anybody bothered to empty the garage lately that we all call the XP kernal? I mean what else is running at ring zero these days? Seriously if MS Basic hadn't been in the EPROM I bet the LOAD command would still work.
You think I'm kidding right?
Has anyone tried to nuke the msmsgs.exe task? That would be MS's Instant Messaging application. This is STUCK in your toolbar and if you TRY to remove it you are told
OTHER applications are USING it! Don't we call other programs that do this viruses or trojans? This is a very rich example of why an OS vendor should NOT be allowed to compete in the application space. But hey it allowed them to KILL Netscape even when they had 80% market share. This might have been OK when MS DOS was seen as a HOBBY only used by kids but NOW IT IMPACTS every companies BOTTOM LINE!
Final point. Anyone ever bother to read what the findings of fact were in the MS anti-trust trial? I mean we all paid several million in taxes for that one and it makes GREAT bed time reading.
Are you aware that MS MANAGEMENT STOPPED the release of Windows 98 UNTIL AFTER Christmas so key DLLs could be part of the kernal? Since this statement sounds like I'm on a narcotic I'm going to PROVE IT IS TRUE.
BTW
Not one other company could pull this kind of crap NOT EVEN IBM. MS has created their own monster. The reason their kernal has SOOOO many holes in it is because the product managers HAVE DRILLED them there in the first place. I mean even a blind guy can fall into ring zero and take over your system. Why is it folks can READ the code for the kernal in Linux and it is SAFER but I can blind fold you and you 'might' get admin rights in XP?
MS could never allow you to read their kernal code. You would see how too many of their APPLICATIONS work.
The link for the DOJ trial doc is here: <URL:http://www.usdoj.gov/atr/cases/f3800/msjudge. pdf>
From page 83 of the above link:
Allchin followed up with another message to Maritz on January 2, 1997:
You see browser share as job 1. . . . I do not feel we are going to win on
our current path. We are not leveraging Windows from a marketing perspective
and we are trying to copy Netscape and make IE into a platform. We do not use
our strength -- which is that we have an installed base of Windows and we have a
strong OEM shipment channel for Windows. Pitting browser against browser is
hard since Netscape has 80% marketshare and we have <20%. . . . I am convinced
we have to use Windows -- this
I would guess it should be obvious that Windows evolved by random chance. There's certainly no evidence of Intelligent Design there...
If you disagree with me on social issues, then it's pretty clear that you are a narrow-minded bigot.
How much privacy has been violated in the last 15 years using this exploit?
Before info on the exploit was splashed on news websites, it may very well have been known to intelligence agencies, Microsoft, and organized crime. We will likely never know. However, it is the window of time between when an exploit is privately found and it is made common knowledge that the real mischief occurs. For the WMF exploit, that window may have been 15 years!
It's not hard to see how this simple exploit could have been used for corporate espionage, perhaps against you or your company, and you would be none the wiser today. Government agencies at every level use Windows. Your doctor probably does. Your bank probably does. Someone with knowledge of this exploit before it was widely known would have been in "god mode" in the monoculture of Windows. They could have made a ton of cash rooting a few stock brokers.
There's LOTS of nasty things that could have happened, that it is just as reasonable to assume happened as to not. We'll never know, because digital tracks are very easy to cover up. Why the press isn't asking the bigger question: how could Microsoft (or someone else) NOT have known about this, and how do we deal with a world where some people, right now, might know about the next WMF exploit and might currently be using it to make a quick buck.
So let's not focus totally on the cost to clean up the mess once the problem is known to the script kiddies. The unknown cost of the undetected zero-day exploits is quite possibly much higher.
(And for those who say "there's nothing we can do about that!", I suggest you compare Windows security to something like SELinux.)
Perhaps more accurately, users of windows have made no progress.
Perhaps even more accurately, windows application designers have made no progress. Windows has supported multiple users & permission sets for quite some time, but it's still considered acceptable for normal applications to spew garbage into the registry and write to system folders. Until its easy (not merely 'possible') to run limited accounts & control permissions, we're going to see major problems.
I was wondering why the fact that they keep releasing a "constant stream" of patches is a bad thing, since the OSS community does the same thing (Now, I'm not trying to compare the quality or the type of patch).
It's funny this should come up. I wrote a response to someone's newsletter earlier today.
Here's what amounts to a primary copy|paste:
As far as things loading slowly, a lot of it has to do with the code which is being loaded. In many shops, things such as code reviews are non-existent. And when they occur, they're cursory at best. Programs written in Visual Basic don't have "Option Explicit" (requiring you to declare variables) and when you force someone to add it, it won't compile. One of the biggest gaffes Microsoft made was for programmers to make declaration variables in this fashion. It should be the other way around: force the declaration of variables unless you turn this off. This is a subtle, but crucial indicator of their internal decision-making system and vision.
And speaking of Microsoft, "Patch Tuesday" would be a shadow of its former self if they learned one thing in programming: buffer overflow For those unfamiliar with the term, it means permitting someone to type more than a variable is allocated to handle. The extra characters then alter the program's execution, including turning scenarios turning complete control over to someone running the software. There's a lot of humor about the questions Microsoft asks in their interviews; "Why are manhole covers round? How many gas stations are there?" My joke has become, "Demonstrate code which handles buffer overflows [because we don't know how to do it]".
Gates attempted to demonstrate the priority of security by publicly declaring all software development to be put aside and focused entirely on security issues in February 2002. (Google has started a new event known as "Summer of Code". Students are tapped to gain real-world experience and write OS (Open Source) code during their Summer breaks. I've since referred to Microsoft's dedicated activity aas "Month of Code". Has the error profile changed? No. Has the number of errors changed? Yes. More software on the market with the same error foundation means there are more copies of that problem in everyone's hands. It's not a trick question. Were their code architecture to prevent retro-fitting the solution, they could build it into each no product to hit the market and you'd see the patch count drop over time as new products were released with the underlying fix. This is not a particularly difficult technique to implement and wouldn't add a significant change to their schedule. In fact, the time factor would approach the current schedule as they become familiar with the mindset.
Why don't they do it? No one knows. Programmers with no more than three or four years of experience have learned this shortcoming is the reason Microsoft software is so buggy. And this is without access to Microsoft's source code. No one has put the question to Microsoft. Put their foot down and asked why this is company-wide shortcoming exists. Everyone (media) seems focused upon where Microsoft is going and perhaps afraid they'll commit seppuku (suicide) if they really push it. And if they requested time to investigate it, they should have an answer after a reasonably short period of time, removing, "We'll have to look into why this isn't done" as a response. Were this single issue to be addressed across their product line, I would estimate 98% of the currently reported errors would vaporize. That's not to say a new class of bugs wouldn't develop, but almost all of the reported errors today have a big gathering at every family reunion. We're not dealing with sudoku here; besides, standard sudoku is single digits.
Shortcomings aside, Microsoft has started one internal program: "Blue Hat" - annually bringing hackers in and showing how easy it is to peel open their vaunted software. Apparently, they expected a rah-rah session the first time and it was heard the gasps increased as the spirits fell.
Today's Quiz.
Name each quotation's author.
1. "Success is a lousy teacher. It makes smart people think they can't fail."
2. "People
You have provided zero evidence to support your claims that:
* Windows NT is poorly designed.
* Windows NT was written as a "test bed for new technology"
* Windows NT wasn't written for production use
There is no argument Windows NT and VMS have very similar architectures. They were both designed by the same development team. But that's completely irrelevant to the claims you have made.
Until its easy (not merely 'possible') to run limited accounts & control permissions, we're going to see major problems.
The use of limited accounts only goes so far. It will prevent a virus from doing damage to some areas of the machine; it will not prevent the creation of "zombie" DDOS networks, infection by spyware, or OS exploits. Correct me if I'm wrong, but the WMF exploit will work regardless of whether or not you're running with full or nil permissions.
DATABASE WOW WOW
Quite possibly. But since you go on to agree with him, it all works out in the end.
I was just providing reading material that shows a few minor facts.
Trouble is, it doesn't show any relevant (or disputed) facts.
NT is poorly designed.
Why ?
In fact it wasn't designed (from the ground up) at all. It borrowed(depending on your use of the term borrowed) heavily from VMS, [...]
NT was designed and written from scratch by the same team who designed VMS when Microsoft gave them a blank cheque after hiring them awat from DEC. It's hardly surprising they have very similar architecture.
[...] and then was jury-rigged to float a GUI on top of it.
What "jury rigging" are you talking about ? Why would any remotely well-written OS even need any sort of "jury rigging" just to run a GUI ?
With the problems the OS had from the initial release, as well as all subsequent Windows OS releases, you can tell that NONE of the Windows OS releases were ready for production use. They may have been written, and then later used for production, but none of them were actually ready for production when released.
Funny, millions of people managed to use them in "production".
Including a firewall with Windows is no progress?
After four years of effort and $40,000,000,000 worth of revenue from their long-suffering customers, Microsoft succeeded in including a simple firewall with their operating system.
You're right, it is progress but somehow - and I can't quite put my finger on why - I'm feeling a little underwhelmed.
"I've got more toys than Teruhisa Kitahara."
Microsoft security.
.wmf file format security hole, a real gapping maw of a hole. The following Monday, YESTERDAY, _two_ (2) more .wmf flaws are reported and posted with exploits.
That Microsoft has security like a cheese grater has bouyancy is a very well known fact, but the interesting point underlying the well known fact is _why_ Microsoft has such lousy security.
I suggest it's their attitude towards security. For example, last Thursday Microsoft released a patch for the
This is the way Microsoft does security: They wait for users to get hammered and scream, _then_ they might fix it, but just that one thing, anything else related is ignored until the cycle starts again with users getting hammered and screaming about it.
After the past two years of Microsoft "security," the only people who still run that junk are the ones locked in by their PHBs and the clueless pubic who buy PCs based on what they see on TV. Oh yes, and the willfully locked-in Microsoft fanbois who are out in droves today defending their sinking ship against the crush of reality.
Microsoft fans are much like the "Intelligent Design" people: They believe and insist their belief is the same thing as knowledge. This gives them the excuse to ignore reality with it's rather unpleasant (to them) consequences.
Face the reality of the situation with Microsoft products: They want your money first and foremost, anything and everything else is, at best, second thought. This includes security, quality -- everything else.
That's your reality, deal with it in a constructive way by getting off the Microsoft Gerbel Wheel from Hell (tm): It's the only way to be sure.
Cheers.
Everything in the Universe sucks: It's the law!
Yes, because this is oh so different from the way Apple handles everything, right? *rolleyes*
I'd say Apple is indeed doing something different, since it's five years and counting without a single instance of OS X-specific malware being seen in the wild.
And if you think it's because nobody's trying, you're deluded. There are plenty of assholes out there who would love to be the first guy to come up with genuine OS X malware. Any fool can pwn a Windows box, but you really have to be 1337 to crack a Mac. So far, nobody's measured up.
OS X was designed to be secure from day one. Until Microsoft give up, chucks everything they've got and starts fresh, Windows will always be betrayed by its roots as a completely unsecure, single-user OS that had the security (and everything else) bolted on later-- it's like a straw hut with a steel door.
Requiring a reboot after every update is not my idea of "seamless"
There is no belief, however foolish, that will not gather its faithful adherents who will defend it to the death.-Asimov
I work at Microsoft.
The other day, we had to have a little talk with one of our developers; he didn't understand why it was bad that his application generates an error message that writes the administrator password to the Event Viewer logs. What was that I heard about every developer being thoroughly trained in secure coding practices?
Even though security is supposedly top priority, we find ourselves unable to force our developers to adhere to policy and write code that can run under a non-admin or non-system account. The higher ups steam roll over us when we fight the fight.
The problem is that there are two groups at MS; the business side, and the technical side. The business side calls the shots, and they don't listen to the technical side.
Sure, there's plenty of talk about security, but no real action. PR is cheap.
"The whole article is a troll....Its filled with 'feelings' and 'impressions' by people cited as experts, without examination of their claims - nor an inquiry to factual matters."
The article is correct. The reason it is not filled with objective evidence is because there currently no objective, agreed upon method of measuring code or system security. In the absence of objective data, the opinions of experts are the best thing we have.
Little troll, the facts are obvious and all your silly games are useless. There's a new M$ nasty every month, and it has a half life of 12 minutes on any network. People who don't use M$ junk don't have problems, people who do get popups and corrupted files and machines that don't boot. As much as you would like to blame the users, admins or anyone but Microsoft, the only thing people with computing problems have in common is Microsoft. Replace M$ with Apple, Sun, Linux or BSD and 99.9% of the problems vanish. It's not the users. It's not the people who have to fix Microsoft's problems, it's the software they use.
Don't give me any bull shit about how much people hate M$ or how M$'s popularity is the cause of all the problems. Sure, anyone who's used computers for more than a year or two knows that M$ sucks. It's the Quality, stupid. Most people have no clue about the ethical problems the company has. Yes, there are many people who actually hate M$. That's what you get when you sue public school systems, lie about competitors and do all that other "sharp" business crap. Only a small percentage of the population keeps up with that kind of thing, but a small percentage of many is a lot of people and sooner or later, everyone will know. Performance alone and broken promises are enough to make many people others without a clue hate M$. You can contrast this hatred with the love people have for about any other OS and see what a turd M$ really is.
In short, Microsoft has EARNED it's reputation and all the apologies in the world won't change a thing. After four years of "Security is job 1" and no real changes in system behavior, the public has had enough.
Friends don't help friends install M$ junk.
In the meantime we (I use XP) are all beta testers...
I wont tell you where I work. ;-)
In the field - you know, where the 'rubber hits the road' - it has been incredible progress in dealing with the security issues around MS software.
My background is as an assessment/penetration tester, and a remediation analyst for infosec. My toolset and personal choices are 'Unixy'.
I have yet to see anything as onerous as admin passwords written to logs - and I don't even BELIEVE it can be done. You can pass a hash, not text. No API will give you a plantext from either AD or the LanMan cached credentials. You need a refresher course.
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
For everyone who doesn't use OS X: The main difference between an administrator and a normal user under OS X is that the administrator may sudo. When using shell programs as a normal user sudoing will fail (because the normal user is not in /etc/sudoers) and Aqua apps that require administrative access will ask you for both the name of an administrator and the corresponding password. As an administrator manual sudo works and Aqua apps will only ask for your password.
/etc/sudoers.
root has much greater (and usually unnecessary) privileges than an administrator and is locked by default. I have only had to use root twice, in both cases because I had broke
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
No, the WMF problem is an incredibly silly code insertion technique that was designed in - deliberately allowing the image to embed its own arbitrary code - in the days when anything on a machine was deliberately put their by the user and could arguably be trusted. There's no buffer overflow or anything here - just a windows object which is insecure by design.
This kind of code shows how little windows was designed with networking in mind. It wasn't a problem in 1985, but still working that way 20 years later shows how Windows still includes horribly insecure legacy code that should have been revisited if they were serious about 'secure by design'.
Justin.
You're only jealous cos the little penguins are talking to me.
Fixed that for you.