Slashdot Mirror
More Headaches from Vista Security
Michael Cooney writes to tell us Windows Vista may have some serious headaches in store for corporate users with third-party authentication systems like VPNs. From the article: "ISVs say rewriting their code for the new architecture will produce headaches that will extend to their customers that have deployed strong authentication such as biometrics or tokens, enterprise single sign-on and a number of other systems integrated with the Windows authentication architecture."
I have the feeling that at this point the managers in Redmond care less about security and more about actually _shipping_ the product.
Maybe even sometime this year.
What are these ISVs whinging about? This is almost the perfect opportunity to convince their clients that it is time for another upgrade. But wait, that's not all, as mentioned in the article, the upgrade also requires extensive testing, so it's doubly good news.
Programming wise, I guess this would teach these ISVs a lesson that, if they want to develop custom code, they should probably have a more flexible architecture to accommodate any OS changes, or even make it compatible across different OSs.
I don't think Bridgestone can ask Ferrari to slow its F1 cars down because Bridgestone tyres cannot perform at high speed.
Please stop entering code 2,2,7,6,6,4
Wasn't it just a couple weeks ago we were lamenting "what could have been"?
Microsoft capitulates and disables large chunks of Vista security by default in order to appease corporate customers. People are up in arms.
Microsoft rewrites architecture to make things more secure. People are up in arms.
Me, I'm with the "Good!" crowd. Make things more difficult for me when I transition. It'll make things easier later on.
ACs are modded -6. I don't read you, I don't mod you, I don't see you. Don't like it? Don't be a coward.
A couple of interesting paragraphs in the article:
Concerning "good news for users", I doubt it. Nothing good has come of Microsoft's perception of "what is good" for users, from the crippled layering of a multi-user paradigm on top of what started out as a single user design (NT/XP over Windows/DOS) to their constant and misguided attempts to create intuitive GUIs (dancing paperclips, self-altering menus with chevrons anyone?). Security is typically hard, and Microsoft will screw this up too.
As for the second paragraphs, could Microsoft again be forcing the hands of third party vendors? Seems they could (indeed, it almost seems likely) wiggle their way into the security market and start charging for different mechanisms of security. Of course that can only happen after they've provided it "free" long enough to get rid of pesky competitors like SecurID (GREAT product, btw) and VPN providers.
I'll fight Microsoft's practices til forever, but I must admit, I'm glad I'm near retirement as far as having to deal with this crap anymore.
IANSE (I am not a software engineer), but this might not be a "feature" not a "bug".
It's expected that migrating to a new architecture would require, well, rewriting of existing code that worked with the old OS. Wouldn't there be more cause to worry if Vista supported all of the OLD authentication mechanisms as well as its own ones, since maintaining backwards compatibility seems like it could introduce unnecessary security holes?
US Democracy:The best person for the job (among These pre-selected choices...)
Meanwhile, I hope the 3D Studio Max users are prepared for the impending headaches (same w/ anyone else that uses all kinds of software-based tokens and registration schemes like C-DILLA, if it's even in use anymore).
I wonder if dongles will come back?
On the upside? Umm, there's probably no upside.
Quo usque tandem abutere, Nimbus, patientia nostra?
If you are going to drink Bill's Kool-Aid, you shouldn't be surprised if there are undesirable side effects.
Yep. Any time you're interfacing with the OS at that low a level, you have to consider that new versions of the OS might be different under the hood.
I used to run PCAnywhere on a Windows NT 4 server. We had to dance around on one foot while swinging a chicken around our heads, singing voodoo chants backwards to upgrade the OS and PCAnywhere at the same time, all so that we could get PCAnywhere to (a) work and (b) not crash the server on boot once we upgraded it to Windows 2000.
Here's a great idea:
Don't upgrade. You don't need Vista anyway.
There's 3 problems here.. all Microsoft's.
first, this is not enough notice for heavy duty security testing. Things like log in script changes should have been final with the first beta. Trivial changes would be OK, but at this point nobody should have to expect sweeping API changes. ID security products expect to have long term testing completed by the time Vista is on the shelf... that's not a starting point for testing key security features.
Why didn't Microsoft work with providers to solidify the API first, then maybe tweak it if necessary? Apple gives Devs a 3 - 6 month start for stuff like this at WWDC with the new features... why can't MS? I understand this is a huge change.. all the more reason to DOCuMENT it up front!!!
Lastly, if security is so important, why are they still mucking about with login changes 6 months before release?! Authenticating to networks is the core of security! cutting out the key providers of enterprise level stuff is just embarassing. All the more reason to look for MS on the way out soon.
> I mean, come on, it's hardly news that *EVERY* Windows breaks random stuff.
And that's hardly news considering it tries to be backwards compatible all the way back to at least DOS 2.1; Can you imagine how hard it must be to NOT break more stuff, seriously?
The fact that people have to rewrite core drivers etc to support this model is a sign that Microsoft is finally putting security ahead of compatibility. This is a Good Thing.
- Oisin
PGP KeyId: 0x08D63965
Hasn't Microsoft announced that Vista will be available for business users in November?
- availability.html
http://www.helpwithwindows.com/WindowsVista/vista
from link:
In a press conference call last Tuesday, Microsoft's Platforms & Services Division co-president Jim Allchin announced that Windows Vista will be available to business in November 2006 and broad consumer availability in January 2007.
Love 'em or hate 'em, Microsoft's historic strength was that they made it very easy (many would say TOO easy) to write software for Windows. Because Windows' genesis was in the pre Internet days, they designed it in a way that made it powerful for developers but insecure. Now that they're finally GETTING IT and making Windows Vista more secure, the people who have been writing software for Windows are going to have to do a little more work to make their stuff work. This is probably all for the best but it may open up opportunities for other platforms during the transition to secure Windows.
XP was invariably a block of swiss cheese...Their answer was Service Pack 2 that made everyone feel like a Grad Students in Kindergarten. Firewall this, Firewall that, AHH your virus scanner is out of date!! Let us patch our holey weak assed code for you.
Again, Microsoft because of their past transgessions will undoubtably fill this new OS with tons of weak assed apps to create a false sense of security.
Hey Microsoft, do us Sys Admins a favor. Stop what you are doing...because it's not what we want. Just look at the *nixes, and how their OS is structured. THAT's how you do security. And don't release another form of Windows until you get it right. I won't buy it. My company can't afford it, and I don't need the hassle.
Yes, these vendors are stating a fact. A new security system will mean a rewrite of the code that was dependant on the old system. That's to be expected. But what they're really doing here is starting the opening salvo in their justification for new versions of their software that they'll foist on the enterprise customers and no doubt make a nice profit. They'll reduce features and blame it on rewriting for Vista. Their will be bugs... and every one of them is going to be, as much as is possible, blamed on Vista. Vista's a scapegoat that the vendors are going to use to shift blame and scrutiny away from themselves and their products.
Windows may be breaking things for RSA Tokens that are expensive and expire in three years, but they are adding in much native support for smart cards that are much cheaper than RSA Tokens and do not expire in three years. US Department of Defense, US Federal Govt and big corporations like HP and Sun have adopted Smart Cards. I am not a MS fan, but re-architecting their login and vpn for native smart card support does not seem a bad idea. We should at least look into the economics of smart cards, they may save IT money in the long run.