Windows Vista still Rife with Insecure Code

osxpetition writes "As noted in a News.com article, Symantec researchers have been testing the latest Microsoft Windows Vista build (Beta 2), and have found that the code is 'complete with new corner cases and defects' in the networking component. Symantec describes how Microsoft scrapped the old networking stack code from Windows XP in favour of newer, rewritten code. 'Microsoft has removed a large body of tried and tested code and replaced it with freshly written code.' Since January 2002, Microsoft has put a stronger emphasis on protecting PCs by attempting to implement stable, secure code into Windows XP and their new operating system. This latest report from Symantec brings attention to Microsoft's trustworthy computing campaign, and shows how it will be a long way before it is ready for the mainstream."

Comments

beta

[baldass_newbie]

It is still beta, right?

Re:beta

[__aaclcg7560]

No, it's the super-alpha-beta-gold-release-candidate build.

Re:beta

[Anonymous Coward]

Isn't all Microsoft sofware ?

Re:beta

[edmicman]

I prefer the hyper-super-saiyan build of Vista, personally.

Re:beta

[Alkrun]

I wonder... if the same report was written about a 2.[Odd] version of the Linux Kernel that was 6 months away from release would the title of the /. article be quite so harsh? Of course not. But this is /. where penguins rule the skies.

Re:beta

[jocknerd]

Yes, but once its released, then the buggy code from the beta miraculously fixes itself because Microsoft would never let buggy code get shipped.

Re:beta

[DSW-128]

You're thinking Google. (Almost funny how Google calls their offerings "beta", but they're generally pretty darn usable and stable, whilst Microsoft stuff probably ought to never come out of beta.)

Re:beta

[Da_Weasel]

I prefer the Super-Mega-Ultra-Zord build of Vista.

Re:beta

[powerlord]

I try to only use the Vista Vapourware-2005 Edition.

Its the only one I've found to be compatible with Duke Nukem Forever RC1.

Re:beta

[Da_Weasel]

Of course not! The 2.[Odd] version of the linux kernel would not be this unstable. The kernel devs are way too proud to let horrible code get released even when its a "unstable" version. Not to say they are perfect and never write bad code, just that they don't release half cobbled together code like MS does.

Oh...yea...penguins rule, and you suck!

Re:beta

[Rethcir]

Not redundant, insightful! This program isn't complete, why are you inflamatory bitchy linux geeks bitching about obviously incomplete code?

Re:beta

[NSIM]

The article is also incorrect in stating that the testing was done with the latest version. The testing was done with build 5270 which was a CTP build from back in March. At the end of the day, I'd have been amazed if Symantec hadn't found security problems with a interim build dating to before the public release of Beta-2.

Re:beta

[CaymanIslandCarpedie]

FTA:Symantec researchers put the networking technology in Vista under a magnifying glass to determine its exposure to external attacks. The team said it found several flaws in build 5270 of Vista and even more in earlier test versions. However, these were all fixed by Microsoft in build 5384, the version of the operating system that was publicly released in May as Beta 2.

For those too lazy to read the article all it really says is. We found a few issues in early releases of Vista. They've already all been fixed by Beta 2, but we are guessing there are probably more.

Re:beta

[RobertLTux]

umm "But this is /. where penguins rule the {skies}." ------please replace with the word [seas] (penguins don't fly but they do swim very well)

Re:beta

[kubevubin]

You should respect the fact that Microsoft is opening up its beta software to the general public. They're seeking feedback, and I feel that they're handling it quite well. Of course, no matter how good the "final" version is, I'm sure that many Slashdotters will continue to spread lies about experiencing a blue screen every ten minutes upon trying it out. Honestly, I haven't experienced a blue screen on my own computer in well over four years. Granted, I'm running a clean install of Windows that isn't littered with all of the "free" crap that comes pre-installed on many store-bought computers.
In either case, it's no big secret that the public beta for Windows Vista isn't all that great. If you happen to wander over to a site that actually posts Microsoft news on a regular basis and actually has a category specifically set aside for such news (You know, like...not Slashdot. And no, Slashdot's tagging beta, with its "duh" and "obvious" tags for anti-Microsoft posts honestly don't count. Grow up, subscribers.), you might actually realize that the newer builds of Vista are shaping up to be quite nice.
I didn't have any driver-related issues with the beta, honestly. Yes, the performance was lacking a bit, but I was expecting far worse. Linux users need to stop comparing their OS' state to that of a five-year-old version of Windows. Where was your beloved Linux at that point? Quite far from where it is now, that's where.

Re:beta

[kimvette]

Linux users need to stop comparing their OS' state to that of a five-year-old version of Windows.

Okay, compare it to the current release of Windows.

Oh, what's that? The newest release is Windows XP OEM SR2? Essentially a five-year-old OS with a few patches?

I guess it IS a fair comparison then, after all. Come make that same argument this same time next year if both:

a) Vista has shipped
AND
b) Folks are comparing Linux to XP rather than Vista

at that point. Until then, XP is the only valid comparison, unless you want to talk servers in which case Windows 2003 would be the logical comparison point.

Re:beta

[rblancarte]

You raise some very good points, all of which I agree with.

I think what I have gotten out of this is the whole is a damned if they do/damned if they don't issue taken with Microsoft. Before this article came out, people blasted MS for the fact that they had such bloated and bad code. Now that MS is in the practice of trying to replace all this "bloated" code, but are now being attacked on the front that they have untested code.

IMHO, this was something that was going to come regardless of what MS choose to do. Eventually, they were going to have to get their code (be it network, kernel, etc) out of the code base and move to new code, or suffer from really bloated code that was years old.

I think this is where the whole being Beta and their Beta program comes in. So long as they have these issues fixed BEFORE their commercial software is out, I think MS is fine. Now, if they let Vista go and it still has a bulk of untested code, then there are problems. (And I get that the article does point this out in a a single paragraph, but the point is, if CNET really thought about this, then you might think they would have realized maybe the article shouldn't have been written).

RonB

Re:beta

[jlarocco]

The article is also incorrect in stating that the testing was done with the latest version. The testing was done with build 5270 which was a CTP build from back in March. At the end of the day, I'd have been amazed if Symantec hadn't found security problems with a interim build dating to before the public release of Beta-2.

Yeah, it may be an old release, but if Vista is as secure as MS wants people to believe, there shouldn't be any security problems with any of the released builds. For two reasons. They don't want the public seeing articles like this, for one. And security isn't something you add in after the fact. If they're going back, "adding security" to the code they've already made, they're more fucked than they know. Especially since they claim to have rewritten major portions of the code. At least the old code had years of security fixes.

Re:beta

[kubevubin]

The current version of Windows XP is, as you described, nothing more than a five-year-old OS with a few [hundred] patches. As such, no, it isn't a valid comparison. Despite what you may think, however, comparing Server 2003 is a rather valid argument, as it is used quite extensively as a desktop OS (usually pirated, of course). In fact, it's even more sensible to use Server 2003 in this comparison, because Vista is based on Server 2003. Longhorn was based on XP, and it was pretty much falling apart; XP's kernel simply wasn't robust enough. Server 2003, on the other hand, is quite robust.
A common gripe about Windows (other than the obvious blue screen BS and security issues) is the fact that its out-of-the-box driver support is far inferior to that of Linux. Again, seeing as how the current version of XP doesn't have much (if any) added driver support out of the box, how is that even fair? It offers security patches, nothing more. Any driver support is included by the respective hardware vendors.
So, if you don't happen to have a copy of Server 2003 handy, why not just wait until a better build of Vista is released to the general public? I have a feeling that, despite what the majority of Slashdotters believe, Windows Vista is gonna be a great release for the average user right off the bat. Note that I said "average" user, however, as I don't really see all that much that appeals to me with the additional features. Why? Because I use other applications already. Why should I change?
Say what you want about Windows. The fact of the matter is that it's obviously not bad enough for most people to even bother searching for an alternative. I work at CompUSA, and the Apple hardware is very well represented there. As such, I highly doubt that people have no clue that other options exist, and I've even told many of them about the alternatives. I've even helped out with peoples' Linux-related inquiries, and I've even done my good deed by recommending that they download them for free to allow them to try several distros.
I realize that my needs aren't identical to everyone else's needs. As such, I'm understanding of what other people look for in an OS. I remember talking with a customer who had just purchased a Windows PC, as her Mac had recently died, and a friend had recommended that she get a Dell. (Ouch.) She was shocked at how bare-bones Windows XP was when compared to Mac OS. I honestly had never thought about that, and I suppose that I took my knowledge of Windows for granted. I now recognize Windows' bare-bones nature as a legitimate flaw, but Microsoft seeks to change that with Vista. They're improving their product, but they'll never escape the criticism of those Linux users who can't seem to fathom the fact that the "s" in Microsoft isn't actually a dollar sign. It's quite tragic, really.
And let's not forget the fact that they tend to have a lawsuit thrown their way for every single feature that they attempt to add to Windows. Despite what you may think of Windows, do realize that Microsoft isn't free to do whatever it likes with its OS; a lot of businesses have been built on Microsoft's past mistakes, and it would seem that Microsoft isn't able to simply correct those flaws without facing legal retribution.

Re:beta

[Anonymous Coward]

*sigh* i guess ill never learn to not argue with m$'s cronies, owell, im a slow learner :D

>Windows Vista is gonna be a great release for the average user right off the bat.

WOW, since when did the avarge luser learn what a OS was? I guess m$ isent doing their jobs at dis-education as well as it used to. Nah, users arent that smart, most dont never know what a OS is, let alone how to install one. And thats face it, installing windows is hard work, and that its known to have installation problems at random, most people dont know that, so they will assume windows is uninstallable if they dont try to reinstall it untill it works (well, as best at windows ever can work). Maybe if people buy new computers, but thats face it, most people dont have that kind of money for a new computer with a $$$ expensive OS that requires more hardware power then they need, and power that costs even more $$ money. Vista might catch on in a few years, but only if people have it in their mindset that its nessesary (which isent to hard, but still, with the specs it requires, it might make people more open to alternatives (assuming they know about there existence)).

>I now recognize Windows' bare-bones nature as a legitimate flaw, but Microsoft seeks to change that with Vista

m$ wants to fix the "bare-bones" problem? Thats a good laugh. People make a good amount of money patching m$'s shooty work in every area of programs, even m$. They have nothing any user would want to use for more then basic things (REALLY basic, to the point where if they really want to do something, they cant). m$ hasent even provided [nessesary] configuration dialogs that get windows ready for the real world, you have to download them from 3rd parties. To top off m$ history at lack of providing, thats look at what would happen if they shiped things people could use for more avarage work. Lawsuits, and lots of them, and it really is m$ falt, they can ship whatever products they choose, and for some reason, happen to only ship their products, so if they bundle, they are out of luck. The only realy option is to ship other companies products, rival products, but thats not good bussines since, and to top that off, it couldent possibly work with the way windows currently install software (that is, no central repository like any Linux distro ment for a desktop/home computer).

>They're improving their product, but they'll never escape the criticism of those Linux users who can't seem to fathom the fact that the "s" in Microsoft isn't actually a dollar sign

They cant escape because they already pissed on most of those users. That, and unless they fire the entire head of the company (execs, top managers, anyone who could make a polic desinion, etc) we all know they will continue to just do one thing, go after money. Since the start of the company, its been run by very greedy people who cant stand competition. This is also why '$' is used instead of 's'. And dont bother trying to point out how m$ gives away products, it dosent. It only does that to trap people into their product line, and/or to try and prevent them from leaving their product line. M$ has never done anything that wasent for money, or to protect a long term investment (which itself is money motivated).

>Microsoft isn't able to simply correct those flaws without facing legal retribution.

Which is again their own falt. They built there products to make money, others hopped on and begun competeting with them. M$ is now the proud owner of a platform monopoly, and this cant be disputed. This means they now have to play by the rules they set up on windows, that is, they dont bundle rival software, so now that they can leverage a monoply on its OS, why should it be allowed to include its own software? m$ needs to be grateful if they are allowed to keep IE bundled, but only because its nessesary to download new software. Every other application (even mspaint, msdos (because its no longer part of the OS), word, etc, are

Re:beta

[Anonymous Coward]

"m$"

Ah yes, I remember my days going through puberty. You'll make it lil fella.

Re:beta

[Anonymous Coward]

"A common gripe about Windows (other than the obvious blue screen BS and security issues) is the fact that its out-of-the-box driver support is far inferior to that of Linux."

You have got to be fucking kidding, right?

Re:beta

[Memnos]

If the truth in advertising laws had any teeth, if would be properly named Vista Rife. Has a nice ring to it, though Vista Bloat comes in close.

Re:beta

[Jesus_666]

[...] Vista is based on Server 2003. Longhorn was based on XP [...]

Vista is Longhorn. Longhorn was the internal development name for what is now known as Windows Vista. See Chicago/Windows 95, Whistler/Windows XP or Yukon/SQL Server 2005.

Re:beta

[NSIM]

SO your saying that all development code from all source should come out with zero security problems, no matter waht stage of development its in? Can I get some of what you're smoking?

Re:beta

[fbjon]

If you mean s/skies/seas/ then say so! :)

Re:beta

[kubevubin]

WOW, since when did the avarge luser learn what a OS was?

Hahahaha...when did I even mention that? I simply said that Vista will be a great release for the average user. I never said that they had any idea as to what an OS is.

I guess m$ isent doing their jobs at dis-education as well as it used to.

Oh, nice of you to show me how mature you are. Nice dollar sign for the "s" there. Wow, I didn't see that coming. And were you trying to spell "isn't" there?

And thats face it, installing windows is hard work, and that its known to have installation problems at random, most people dont know that, so they will assume windows is uninstallable if they dont try to reinstall it untill it works (well, as best at windows ever can work).

Umm...despite what you may believe, Linux has installation problems at random, as well. Nothing is perfect. What's your point? Say what you will about Windows, but it installed quite nicely on my cousin's old hard drive, despite four different Linux distros failing to install. (DSL was the only distro that would install properly.)

Maybe if people buy new computers, but thats face it, most people dont have that kind of money for a new computer with a $$$ expensive OS that requires more hardware power then they need, and power that costs even more $$ money.

If you'd bother to leave your parents' basement (or even assuming that you're old enough to drive) and visit a computer store sometime, you'd realize that there are some very affordable Windows Vista Capable computers. And I mean computers that're even as little as $500 and are pretty decked out as far as power goes. Yes, open your eyes; they do exist.

Furthermore, Windows Vista Beta 2 isn't nearly as taxing on older hardware as you'd think. My computer, being five years old, gets a whopping 1 out of 5 on Windows Vista Beta 2's included performance rating feature. However, the Aero interface performs very well, with the only slight lagger being the window contents itself. If the beta is as bad in relation to the newer builds as I've heard, then I have no worries whatsoever about the final build.

Vista might catch on in a few years, but only if people have it in their mindset that its nessesary (which isent to hard, but still, with the specs it requires, it might make people more open to alternatives (assuming they know about there existence)).

I've already stated that I've mentioned and explained the alternatives to many people. Do realize, however, that most employees at computer stores know absolutely nothing about Linux. I don't claim to be an expert on it, but I gave it an honest effort for two months straight quite some time ago. I messed around with plenty of distros, from Ubuntu to Gentoo. What did I find? Well, Linux distros are usually more complete out of the box, but I found myself uninstalling a lot of software, anyway. Why not just start with a bare-bones OS, such as Windows, and save myself the effort?

And yes, I realize that there are distros that allow you to start from scratch, but those are far too difficult for Linux newbies to screw around with. And distros like Ubuntu see fit to hide features to a point that it's insulting. I mean, I'd much rather risk running an .exe file that is downloaded from the manufacturer's Web site by double-clicking it than having to enable "restricted" packages in Ubuntu in order to install decent video card drivers.

m$ wants to fix the "bare-bones" problem? Thats a good laugh. People make a good amount of money patching m$'s shooty work in every area of programs, even m$. They have nothing any user would want to use for more then basic things (REALLY basic, to the point where if they really want to do something, they cant).

You're basing this on XP; try Vista Beta 2. Still, I probably won't even use the additional

Too secure!

[eth00]

They figured out that the old network stack was starting to get too secure and not something they could live with! Not wanting to break the trend of security problems they went ahead and rewrote the code from scratch

Re:Too secure!

[Anonymous Coward]

Don't forget, this is probably their deal with Symantec and all the other security companies: Microshofts security holes in windows are how they make their money.

So, the reason Symantec really sued them over the Veritas or whatever thing, was because Vista was coming up too slow.

Now we aren't hearing anything about that, as microsoft have added further security holes in the latest vista builds.

Thats my £0.02

And we...

[vwjeff]

have a solution that will "protect" you.

Re:And we...

[Elektroschock]

I understand, that is the way 3rd party business creation works.

Ms will fix its worm problems and as a compensation the antivir guys get a new insecure IP stack.

Re:And we...

[jellomizer]

It is a real interesting buisness Symantic. Their Job is to protect your computer. But if your computer system is more secure then normal systems (e.g. Running a better OS) they will do a P.R. Campain to make the other OS look just as bad or worse at security as the bad one. So you use the sucky OS and be more volnerable even with their tools then using a good OS without it.

While I am sure there are people at Symantic doing good reshearch to find and maybe fix security problems on different OS's when it gets to P.R. People it all gets out of porportion.

Making people think Proof of concept is the same as actual volnerability, local hole is the same as a remote exploite, causing an application to slowdown or crash is the same as getting remote access to the system. It makes them so scared about everything that they are afraid to try something new.

You know it is kinda like the moffia who you need to pay protection money so you will be a little safer then without but you are still in a lot of trouble.

Re:And we...

[Anonymous Coward]

Should I go stand by the stairs?

I would like to know

[giorgiofr]

I would like to know If the so-called shatter attack still works in Vista. If it does, no amount of privilege limitation can help you.

Re:I would like to know

[kevin_conaway]

I would like to know If the so-called shatter attack still works in Vista. If it does, no amount of privilege limitation can help you.

Since you didn't provide any useful context to your question, allow me. From here:

Chris Paget says there is an irreparable hole in Win32. Any application can send a message to any window on the same desktop regardless of whether or not the window is owned by the application, and there is no authentication mechanism to prevent this from happening. Paget has published a white paper describing a "shatter attack" which allows an attacker to gain control of a system by elevating his or her privileges. Microsoft says this does not fit their criteria/definition of a security vulnerability.

Re:I would like to know

[NutscrapeSucks]

Shatter attack are a configuration error, not a OS issue. They are roughly similar to running xterm as root on Unix and then complaining that users can execute root commands.

But apparently Vista has entirely removed the idea of an "interactive service", so they won't work. Info here: http://blogs.msdn.com/larryosterman/archive/2005/0 9/14/466175.aspx

Re:I would like to know

[A beautiful mind]

Microsoft says this does not fit their criteria/definition of a security vulnerability.

Technically, it is true, since it is a grave design error. The impact is much worse though, as it is not something that can be easily fixed. They missed the boat again with Vista.

Re:I would like to know

[YU Nicks NE Way]

Actually, it is not a "grave design error". A properly designed service should have no window handlers in the privileged process, and should communicate with any other process through a shared memory interface. The desktop is the security boundary on Windows for window messages, not the window.

Re:I would like to know

[truthsearch]

How is a shatter attack a configuration error? Any application can send a windowing message to any other. Period. No configuration or security setting can prevent it. The windowing system is most certainly a core component of Windows, making it an OS design flaw.

Re:I would like to know

[Derek Pomery]

Even if running as an unprivileged user, doesn't windows offer a bunch of system notification stuff in the taskbar?
Are any of those running as privileged, or communicating with the system services in an unsafe manner?

Re:I would like to know

[Opportunist]

Hush! Don't wake them, this is my hope against treacherous computing!

Re:I would like to know

[A beautiful mind]

Actually, it is not a "grave design error".

Yes it is. Quoth:

A shatter attack takes advantage of a design flaw in Windows's message-passing system whereby arbitrary code could be injected into any other running application or service in the same session, that makes use of a message loop.

Re:I would like to know

[mrchaotica]

I think what he means is that secure processes shouldn't be accepting windowing messages (i.e., shouldn't be running privilaged code in their event handlers).

Re:I would like to know

[giorgiofr]

The stuff in the taskbar usually runs under your account; the problem is that the Network DDE service always runs as system and owns a transparent window on the desktop that can be passed arbitrary params by any other app on the same desktop - such as that nifty little hack you wrote...

Re:I would like to know

[cortana]

Buh? How can this not have been fixed yet!

Re:I would like to know

[NutscrapeSucks]

How is a shatter attack a configuration error? Any application can send a windowing message to any other.

The security model is built on "window stations" -- If you put a privileged window into an unprivileged window station, then you have made a configuration error. Period.

The author of the paper stated that *nix/X11 is just as vulnerable to these types of attacks, BTW, so *nix is just as irrevocably mis-designed as Windows. The only difference is that *nix programmers are smart enough not to write interactive software that runs as root.

Re:I would like to know

[ThinkFr33ly]

This "shatter attack" has been known about and acknolwedge for MANY YEARS. (Long before the 2002 paper cited in this thread.) Every once in a while people will bring it up as proof that Windows has design flaws.

This was a design decision with known trade-offs. Attaching security tokens to window messages would result in MAJOR overhead that would, even on today's beefy hardware, kill performance. Having to do a permissions check every time the mouse is moved is not feasible.

So Microsoft decided that they would rely on "best practices" information as apposed to enforced security in the OS to prevent "shatter attacks". The best practices are pretty simple: If your service/application is running with elevated permissions (such as SYSTEM), do not display a GUI on a desktop owned by a lower privledged user.

There have been examples of applications, in particular some poorly written anti-virus applications, that liked to display GUIs to the user despite the fact they were running as SYSTEM. For the most part, however, very few major applications exist today that have this issue.

Applications that run with high privs that need to display a GUI typically launch their GUI with the privs of the user, or display the GUI on a secure desktop. (Like Winlogon.exe.)

This is really a non-issue and hasn't been for a very long time. Please, ignore the FUD.

Re:I would like to know

[jacksonj04]

Because it would break a lot of apps. Vista has been set as somewhat of a milestone in the "This *will* break some compatability" aspect, with new permissions, directory structure etc. etc. it's a good point for MSFT to put the foot down and say "Follow these procedures or your app won't work."

Whether they will or not is yet to be seen.

Re:I would like to know

[ThinkFr33ly]

Ah, so a wikipedia article proves that it's a design flaw in Windows?

In that case, I'm going to post a wikipedia article stating that your a midget. It's gonna be tough living out the rest of your life as a little person.

"Design flaw" suggests that they didn't consider this scenario. This is false. They absolutely did consider this scenario and decided it was still a good decision due to the performance implications. The developer documentation clearly warns against displaying high-priv GUI on a low-priv desktop.

You would be very hard pressed to find a major/popular application available today that makes this attack possible. It wasn't that common to begin with, and after Microsoft's warnings, it's virtually non-existant.

Re:I would like to know

[Anonymous Coward]

I agree, if you currently have software running that is trying to perform a shatter attack then your computer is "owned" by the hacker and getting ownership back is more important then worry about privilege elevation. Its kind of like closing the gate after all the horses have escaped.

Re:I would like to know

[giorgiofr]

Please, learn about the Network DDE service. Thanks.

Re:I would like to know

[jcr]

Ah, so a wikipedia article proves that it's a design flaw in Windows?

Clever dodge, but can you refute the quoted statement?

That's OK, we'll wait.

-jcr

Re:I would like to know

[Asztal_]

I haven't heard of any programs that follow Winlogon's example, and I have seen a lot which haven't, which is a shame. In the case of firewalls and unsigned driver warnings this is pretty serious no matter what user displays a GUI on the user's desktop, since the offending program can still just simulate a click of "Okay", or "Allow".

A better way, perhaps, would be to place an alert on the user's desktop, then once it is clicked, create a secure desktop which is owned by SYSTEM and can't be accessed by programs on the user's desktop–à la Winlogon.

Re:I would like to know

[Keeper]

The reason why it isn't considered a security flaw is that you can only send messages to windows that are in your current desktop session -- ie: you can't gain privleges that that user doesn't already have. Or put another way, whatever you sent via window messages could have been done in the calling process.

Re:I would like to know

[Keeper]

A shatter attack won't lead to an escallation of privlege on Vista. Windows with a given IL can only send messages to windows of an equal or lower IL.

Re:I would like to know

[kimvette]

Ah, so a wikipedia article proves that it's a design flaw in Windows?

The fact that it's on Wikipedia does not automatically mean it is false or quackery. Don't be so quick to write off Wikipedia on every subject - if in doubt, check the sources. Much, if not most, of Wikipedia's content is actually quite good. Just be willing to check the cited works in the footnotes, or verify against other, more authoritative sources. For a free up-to-the-minute encyclopedia, one cannot get anything much better than Wikipedia. Its greatest strength (anyone can edit) may be its greatest flaw, but at the same time its greatest flaw is its greatest strength. If you spot an error, you can correct it on the spot. :)

Re:I would like to know

[plague3106]

Hmm, appears to me this service is disabled, and Allow Service to interact with desktop is unchecked. What was your point again?

Re:I would like to know

[man_of_mr_e]

No. UIPI fixes this supposedly "unfixable" bug.

Re:I would like to know

[ThinkFr33ly]

I completely agree with you that it's a problem that security related dialogs in XP are clickable by malware even if it's running as the current user.

But you have to remember that the only way that dialog will affect the entire system is if the user is running as admin, and if the user is running as admin the malware likely is to... so they don't really have to simulate clicks to do their damage.

Re:I would like to know

[giorgiofr]

Hey you know what - it is disabled on my box too! AFTER I disabled manually.

Re:I would like to know

[ThinkFr33ly]

I did refute the statement, not to mention the fact that the statement is called into question in the very same wikipedia article that was cited.

Anybody familiar with Windows programming knows about the security issues surrounding window messages. They know that the security boundary is at the desktop level, not the window or application level.

Re:I would like to know

[amliebsch]

It's not a flaw because there is no reason to put a window with escalated privileges on a non-privileged desktop. It's the exact same "flaw" as opening an xterm window logged in as "root" on a low-privileged X desktop.

Re:I would like to know

[mrsbrisby]

"Design flaw" suggests that they didn't consider this scenario. This is false. They absolutely did consider this scenario and decided it was still a good decision due to the performance implications. The developer documentation clearly warns against displaying high-priv GUI on a low-priv desktop.

How the hell do you know what "Microsoft" was considering? There's no documentation on this distributed with the Windows 3 SDKs, nor with Microsoft OS/2, or if there is, I can't find it.

I'm not sure what's worse! That they knew programmers couldn't tell it was a bad idea, and kept it secret, or that they didn't have the forethought and just got caught with their pants down.

I suspect they didn't know about it simply because a lot of Microsoft software was succeptable to this problem, but hey, if you're saying that they knew about it and just hate their customers and developers, well then I'll just have to take your word for it, because you're clearly on the Internet.

Re:I would like to know

[DamnStupidElf]

The security model is built on "window stations" -- If you put a privileged window into an unprivileged window station, then you have made a configuration error. Period.

Each application should get its own secure window station to run in, then. I don't want Claria or any other software running on a desktop to be able to see any other application, because that allows unprivileged software to act as a keylogger. That's just unbelievably stupid. X probably has the same problems. Basically, applications should not run as the user who's using them, instead they should run with limited permissions and only access files the user has granted permission to. What modern operating systems need is a capability approach to security instead of a user+acl approach. Programs are not users, so it stands to reason that individual programs should not have the same rights as users.

Re:I would like to know

[plague3106]

I didn't disable it. Nor did I disable it on any of the Windows XP machines I use, at work or at home.

Maybe you should install SP2, since you seem worried about security vulnerabilities.

Re:I would like to know

[EvanED]

Do YOU want to go through and tell the system what files each and every program you want to run may access?

Because I sure as hell don't...

Re:I would like to know

[NutscrapeSucks]

Each application should get its own secure window station to run in, then

This would break copy-n-paste and a million other things. You don't really want this.

Re:I would like to know

[init100]

Do YOU want to go through and tell the system what files each and every program you want to run may access?

The suggested solution sounds a lot like SELinux, where such information is part of the security policy. Each program can be supplied with such a security policy, specifying exactly what files it will need to access. I'm sure that a similar system could be implemented for Windows.

Re:I would like to know

[DamnStupidElf]

Do YOU want to go through and tell the system what files each and every program you want to run may access? Because I sure as hell don't...

Thankfully, you don't really need to. Should a program be able to read your letters to your mom? Not unless you want it to. System libraries? Sure, with read only access. Basically, the only rights a program should have when it starts are basic read only rights to the system files it needs to run, and nothing else. If you want to open a document and print it, you can grant permission to that document and that printer. Granting permissions does not need to be difficult if it's structured properly. The biggest problem is designing a secure interface for using the operating system. Ideally, the operating system would provide open/save/delete/print menus directly, which would automatically grant the necessary permissions. If you have a letter you want to print, you select the file containing the letter, and tell the OS to print it. Call it object orientation or type awareness or whatever you want, but the OS should be configured so that every type of object has a list of possible actions that can be taken on it, and for each action a program called to perform that action. Permissions are defined on the actions that can be performed by a given program on a given object. Defaults can be specified for objects, object types, programs, etc. so that you rarely have to manually choose which permissions to grant to programs.

Re:I would like to know

[GigsVT]

And how exactly would I take control of that X app running as root from an unprivledged window?

Linux has a few SUID applications, some in X even. If anyone can exploit them for privledge escalation it's considered a bug, and fixed in less than a day.

No one says "well, just don't run those and you'll be ok" like you Windows weenies are saying.

Re:I would like to know

[jcr]

I did refute the statement

Nope, you just dismissed it on the basis of it being in a Wikipedia article.

-jcr

Re:I would like to know

[ThinkFr33ly]

Nope, you just dismissed it on the basis of it being in a Wikipedia article.

No. I first made a jab at the original poster treating something in wikipedia as if it were fact, and then then gave a specific reason why I dismissed it. My reason for dismissing it had nothing to do with wikipedia and everything to do with it being wrong.

I said:

"Design flaw" suggests that they didn't consider this scenario. This is false. They absolutely did consider this scenario and decided it was still a good decision due to the performance implications. The developer documentation clearly warns against displaying high-priv GUI on a low-priv desktop.

I also posted a more complete response here: http://slashdot.org/comments.pl?sid=191497&cid=157 38363

Re:I would like to know

[spagetti_code]

I dont necessarily agree with you. I have a commercial app out there that relies on this funtionality - for good reason.

The application I do this to does provide an API for remote control, but they left out some obvious things. They are not going to add them in, so I take control of their window. Works a treat.

Point is, its not a design flaw. Its damn useful.

However it should be secured in some way - so as a suggestion, have the OS pop up a window: "app A is trying to send messages to or control app B, is this ok? (Generally its a bad idea)"

Default to no.

Re:I would like to know

[jcr]

Try again. A design flaw is a design flaw, even if the incompetent designer thinks otherwise.

-jcr

Re:I would like to know

[Dolda2000]

I still don't really get it. Probably, that's because I'm not very good with Windows, but how does being able to send arbitrary window messages hurt? From what I remember from Windows programming, window messages are basically just input being sent to a window. How does fooling a window into thinking that the mouse is being moved constitute an attack?

I'd imagine that this could be a problem if a trojan were running in the same session as a window with administrator privileges, but is that all?

Re:I would like to know

[Anonymous Coward]

Window Stations have to be around to allow for accessibility programs for handicapped users. That said, in Vista, applications running under different security contexts can't be placed in the same Window Station, and the priveledge escalation dialog is in its own private Window Station that is not accessible by applications.

Re:I would like to know

[drsmithy]

The suggested solution sounds a lot like SELinux, where such information is part of the security policy. Each program can be supplied with such a security policy, specifying exactly what files it will need to access. I'm sure that a similar system could be implemented for Windows.

This relies on application developers doing the right thing to make it work. Therefore, it won't.

(Exhibit A: any and all programs <5-6 years old that still needlessly require Administrator privileges to run.)

Re:I would like to know

[QRDeNameland]

I think there's a difference between whether or not it's a "security flaw" vs. a "design flaw". It was (and maybe still is) in many ways a security flaw, in the sense that it provides a vector for one application to send data to another without its cooperation, and possibly cause unintended behavior in a poorly coded target app.

But it WAS a conscious design decision, not a flaw due to incompetence. The main benefit of it from the user perspective was universal C&P, where the user can cut/copy any selectable text from any window on the desktop and paste it to any other, all without any code needed on the part of either application. Lack of universal C&P was a longtime usability issue for Linux where the gap has only recently been closed, so it's not like they didn't have a reason to design it that way.

Re:I would like to know

[Anonymous Coward]

just checked my machines, Network DDE is disabled by default. I certainly didn't disable it myself. So I guess that makes what your saying FUD or more likely an outright lie.

Re:I would like to know

[ThinkFr33ly]

So it's a design flaw because it's a design flaw? Or is it a design flaw because you say so?

I've given reasons why I believe, and the majority of people who have a clue believe, this is not a design flaw.

You, however, have just relied on circular logic and "because I say so" reasoning.

I feel sorry for people like you... trapped into a corner by your own bias and intellectual dishonesty.

Re:I would like to know

[NutscrapeSucks]

And how exactly would I take control of that X app running as root from an unprivledged window

Well, you could send it some combination of event messages that causes a buffer-overflow and allows you to execute arbitrary code.

Or you could just click on it and start typing.

Re:I would like to know

[NutscrapeSucks]

AFAIK, the only program that ever used Network DDE was "Hearts" from Windows for Workgroups. No wonder it's disabled.

Re:I would like to know

[DamnStupidElf]

This would break copy-n-paste and a million other things. You don't really want this.

You mean the copy and paste where any program can pull and push anything it wants to and from the clipboard at any time? Oh yeah, that's a great idea. A much better method would be for the clipboard to be a resource managed by the OS, essentially just a FIFO with a backing store. To copy or paste something, the user would activate the function at the OS level (it doesn't matter how, it could be a button click or key combination) and the currently active program would receive the signal to copy or paste along with the capability to perform the operation. The capability would be limited in duration and to one use, with an indicator to let the user know when the operation was finished.

No functionality is lost, and in fact every program has to respect the copy and paste commands that you use (ctrl-v versus shift-insert versus ctrl-y versus right-click-paste, etc...), and no program can violate the security policy of the clipboard.

Re:I would like to know

[Keeper]

A security flaw requires some escallation of privlege -- the flaw must enable an attacker to perform an operation they would otherwise not be able to perform.

A shatter attack doesn't permit that. An attacker can't perform any new operations; they're just running in the context of a different process. In fact, there are far simpler ways for a process running on the machine to inject code into other processes, such as the CreateRemoteThread API.

I should probably qualify my previous comments a bit; if you're one of the 10 people on the planet that don't logon to XP as an Admin AND you start some process as Admin, then a shatter attack can result in privlege escallation on XP. With Vista, privlege escallation is no longer possible (processes can only send messages to other processes of an equal or lower IL).

Re:I would like to know

[Allador]

You can't prove or disprove (or refute) an opinion. The author of that sentence in wikipedia was expressing his opinion. Since there is no absolute metric by which you can define a 'design flaw', this is simply an opinion piece.

Re:I would like to know

[YU Nicks NE Way]

Actually, no, the Network DDE service had such a window back in 1998. That bug -- which was a real excalation of priviledge defect, found by the author of BackOrifice -- was fixed back then. The original shatter vulnerability was found two years later, and, amusingly, didn't involve any Windows component; rather, it had to do with a third-party virus scanning application.

COM was restructured so that DDE didn't a service-associated window, avoiding the privilege attack.

Re:I would like to know

[YU Nicks NE Way]

If you look back at the original NT 3.1 documentation, there's an extensive discussion of how different window messages are handled (it depends on their WM_ value, FWIW.) The fact that any window can be a target for any message is documented there, along with the security consequences of that decision.

Bottom line: shatter is real, but only for incorrectly designed applications.

Re:I would like to know

[throx]

Actually, that model loses a lot of functionality. Applications rarely put the entire data on the clipboard - they write a stub there and wait for the paste operation, when they dump in the data in the format requested by the app that is receiving it. If you have to write your clipboard model so that you need to put every conceivable format on the clipboard then you seriously reduce your system's usability.

Essentially, security and usability are often at odds and you need to chose one over the other. That's just a fact of life that extends way beyond computer systems.

Re:I would like to know

[init100]

This relies on application developers doing the right thing to make it work. Therefore, it won't.

I know, I know. In Linux this is more of a packaging issue, since only some distributions use SELinux, while others don't, and different distributions have different preferences about where certain files should be placed. But in Windows, AFAIK it is very rare to have different packagers and developers (not referring to people, but rather organizations).

But in theory, it could work even in Windows. :)

Re:I would like to know

[jcr]

So it's a design flaw because it's a design flaw? Or is it a design flaw because you say so?

No, it's a design flaw because it renders the system unsecurable. Try to keep up, will you?

-jcr

Re:I would like to know

[master_p]

No, Unix is not as mis-designed as Windows, because Unix apps do not have a single global message queue that everything goes through. The X-Windows event queue only delivers mouse and keyboard clicks and focus events from the server to clients and not messages sent by anyone to anyone.

That's a design flaw of Windows: Win32 defines an object-oriented message-passing window-procedure-based GUI system, thus coupling the GUI with application functionality, and ultimately provide a back door for anyone to hack anything running on the computer.

Re:I would like to know

[master_p]

Please mod parent down.

The idea to have applications communicate through a message queue is fine and has been widely used in many systems, including microkernels.

But the idea that:

1) each application has ONE queue only,

2) everything goes through that queue, including GUI messages,

3) there is no security mechanism

is a HUGE DESIGN FLAW.

There are solutions:

1) different queues for different tasks: GUI messages in one queue, app messages in other queues.

2) check security on the first access. You don't need to check security each time the mouse moves.

3) use an abstraction with a unified security mechanism like FILES instead of queues, like Unix does. Your queues can easily be files which are treated as streams by applications.

The Win32 messaging system is a huge design flaw. In fact, Win32 IS A HUGE DESIGN MISTAKE. Please Microsoft, DROP WIN32 and write something that makes sense!

Re:I would like to know

[ThinkFr33ly]

3) there is no security mechanism

But there IS A SECURITY MECHANISM. It's just not at the level of the window or application. It's at the level of the desktop.

different queues for different tasks: GUI messages in one queue, app messages in other queues.

I'm not sure I understand what you mean by GUI messages vs app messages. Is a WM_SETTEXT a GUI message and a WM_TIMER an app message? Please define the difference.

check security on the first access. You don't need to check security each time the mouse moves.

But you do. The mouse move message was an arbitary example of a window message that happens very frequently. What about WM_NCPAINT, WM_DRAWITEM, WM_SETCURSOR, or WM_MyCustomMessageHere? You can't tell if the message is dangerous because what the message does is different on an app by app basis, and you can't simply do a security check "on the first access" because that statement is meaningless.

use an abstraction with a unified security mechanism like FILES instead of queues

Windows has a security subsystem that allows you to assign security to many kinds of objects, far more than just files. They could have easily assigned security to window messages. The point is that it would KILL PERFORMANCE. In Vista, Microsoft has taken a different approach and dramatically restricted the way that messages can be sent from application to application in general. They still didn't apply ACLs to window messages, but this will effectively elliminate any threat, despite the fact that virtually no application expose this problem.

The Win32 messaging system is a huge design flaw. In fact, Win32 IS A HUGE DESIGN MISTAKE. Please Microsoft, DROP WIN32 and write something that makes sense!

So now not only is the windows message system a huge design flaw, but the entire win32 api is? Wow, quite the jump.

Re:I would like to know

[mattgreen]

Why should someone moderate the parent down? Because you don't agree with the way Win32 is designed?

Each application has 0 to N message queues, where N is the number of threads in an application. In other words, message queues are lazily created on a thread-basis. As for which messages get put in these message queues, that is up to the application programmer.

So are you going to advocate moderating me down for telling the truth as well?

Re:I would like to know

[master_p]

But there IS A SECURITY MECHANISM. It's just not at the level of the window or application. It's at the level of the desktop.

But that's what I said: there is no security mechanism at where it is supposed to be.

I'm not sure I understand what you mean by GUI messages vs app messages. Is a WM_SETTEXT a GUI message and a WM_TIMER an app message? Please define the difference.

Both are app messages. On the other hand, WM_LBUTTONDOWN is a GUI message. Look at X-Windows to see the difference: the window manager sends only mouse, keyboard and focus events, and nothing else.

But you do. The mouse move message was an arbitary example of a window message that happens very frequently. What about WM_NCPAINT, WM_DRAWITEM, WM_SETCURSOR, or WM_MyCustomMessageHere? You can't tell if the message is dangerous because what the message does is different on an app by app basis, and you can't simply do a security check "on the first access" because that statement is meaningless.

Messages are passive, they do not "do" things. They are data aggregates. One of the reasons Win32 is a mess is because it does allows application logic to be accessed from anywhere through SendMessage. In other words, separation of concerns is not something Win32 does well.

Windows has a security subsystem that allows you to assign security to many kinds of objects, far more than just files. They could have easily assigned security to window messages. The point is that it would KILL PERFORMANCE. In Vista, Microsoft has taken a different approach and dramatically restricted the way that messages can be sent from application to application in general. They still didn't apply ACLs to window messages, but this will effectively elliminate any threat, despite the fact that virtually no application expose this problem.

Complexity is the enemy of security. A simple system like the one Unix uses is more than enough to do any communication between servers, processes and the kernel.

So now not only is the windows message system a huge design flaw, but the entire win32 api is? Wow, quite the jump.

Yes, because it is a piece of non-modular spaghetti.

Re:I would like to know

[DamnStupidElf]

Actually, that model loses a lot of functionality. Applications rarely put the entire data on the clipboard - they write a stub there and wait for the paste operation, when they dump in the data in the format requested by the app that is receiving it. If you have to write your clipboard model so that you need to put every conceivable format on the clipboard then you seriously reduce your system's usability. Essentially, security and usability are often at odds and you need to chose one over the other. That's just a fact of life that extends way beyond computer systems.

Nothing says the clipboard can't be a pipe that gets connected on one end to the copying program and on the other end to the pasting program, or even a secure RPC handler set up to send and receive data of different formats. The important point is that *access* to the clipboard is controlled directly by the user via the OS, instead of the clipboard being fully accessable to every application.

Security and usability are not at odds. In fact, because of the lack of security, people are having usability issues with viruses, worms, botnets, and keyloggers. What I've described so far does not need any user interaction with the security system to be able to cut and paste, unless of course the user wants to do something smart like protect passwords by setting a higher security level on the clipboard when copying from a certain program, like a password safe, and then prompting for a dialog when pasting just to make sure that they really mean to paste their password where they clicked. Security can increase usability by helping the user stay secure instead of forcing them to be constantly thinking about the security of their actions. Even on Linux I have to protect sensitive passwords by not leaving them laying around in the command history or visible on a console or copying them into web pages via the clipboard. I don't like thinking about having to use the same passwords from Windows boxes.

I wish I could mod this story -1 Redundant.

[BlackCobra43]

Windows still buggy? What's next, "Sun has risen again this morning"?

Re:I wish I could mod this story -1 Redundant.

[__aaclcg7560]

You mean there's still hope for Sun Microsystems?

Re:I wish I could mod this story -1 Redundant.

[andrewman327]

You beat me to it. Absolutely true. Just about any extremely popular piece of software will never be completely secure, especially if it is from Microsoft. To be fair, however, the new networking code has not had any attacks yet, and should momentarily (long enough for the PR machine to take advantage of it) benefit from security though obscurity as hackers scramble to find its holes.

Re:I wish I could mod this story -1 Redundant.

[mrchaotica]

Just about any extremely popular piece of software will never be completely secure, especially if it is from Microsoft.

I don't know about that; I think once a program is "mature" (which would be very, very far in the future for almost all software) it's possible for it to become completely correct. The only example of this that exists so far is TeX (although some UNIX utilities like ls might be close), but that doesn't mean other software can't eventually be improved to the same standard.

Re:I wish I could mod this story -1 Redundant.

[andrewman327]

"I think once a program is 'mature' it's possible for it to become completely correct."

I hear that Win 3.11 is almost there.

Re:I wish I could mod this story -1 Redundant.

[Richard Steiner]

The bad news is that the most mature variant only runs as a DPMI client under OS/2's VDM subsystem. :-)

Re:I wish I could mod this story -1 Redundant.

[timeOday]

Besides, there is no way to thoroughly and objectively evaluate the security of software anyways, especially something as large as XP. Just let that sink in for a minute. All that can happen to Vista is some people will say it's less secure, others will say it's more secure, and the market will consider it a wash and make buying decisions based on features and appearance, as usual.

Re:I wish I could mod this story -1 Redundant.

[mrchaotica]

No, Windows isn't there because Microsoft keeps adding new features. If they had just spent the last 14 years only fixing bugs in 3.11, it might start getting close...

...maybe.

Re:I wish I could mod this story -1 Redundant.

[CrossChris]

You'd be very wrong to label this as redundant - there are several exploits using this approach already out there, and they all work in the latest iteration of Vista.

Microsoft HAVE NOT re-written much code at all - they've reused the same old cruft that's been there for over 10 years, because nobody left at Microsoft understands how the legacy code works! I was one of the last there with any real insight into, and understanding of, the stolen BSD code that was (and still is) used for the TCP/IP stack and in other fundamental places. Don't believe the bull about a "new" stack - they don't have anyone there capable of really writing low level code.

The current generation of Microsoft "Programmers" are point-and-click merchants who think that Visual Basic is a programming language!

And the solution?

[Anonymous Coward]

Symantec products wil lsecure it right up! How convenient!

Re:And the solution?

[PhxBlue]

Symantec products wil lsecure it right up!

You misspelled fsck.

Is this news?

[brennz]

Marketing deadlines always trumps everything else, except for OpenBSD and maybe Linux kernels. Curiously, both have dominant but benevolent personalities in charge......

Re:Is this news?

[elzurawka]

Marketing Deadline? I dont see deadlines having much to do with Vista anymore. They are already 3 years late, and no one seams to be too concerned. I think that M$ has realized that they control the majority of the IT world, and if they say you have to wait 3 more years for our next OS, then people will wait. Mr. Gates has already said that if there is a need, they will delay Vista again, so dont think that Deadlines drive software devel, atleast not with such a huge company like M$. They have enought money/market share/influnce to do whatever they please.

I dont think writing it from scratch is the ideal situation. It would have been more efficiant if they took the win32 stack, and added/fixed problems with it. this way all security issues that have been reolved, remain resolved. Now that its written from scratch, your going to have an entirly new set of issues to deal with.

Re:Is this news?

[just_another_sean]

Curiously, both have dominant but benevolent personalities in charge...

That's the nicest thing I've ever heard anyone say about Theo! :-)

Re:Is this news?

[Anonymous Coward]

What're you saying about my hero Bill, again?

Re:Is this news?

[init100]

That's the nicest thing I've ever heard anyone say about Theo!

At least I don't think he throws chairs.

Sorry, couldn't resist. :)

Re:Is this news?

[mutterc]

This is basically what I think the cause of OSS's better reliability is.

In my opinion, it's not so much the personalities, it's the lack of commercial taint. When was the last time an OSS project released something half-done to make quarterly numbers look better?

Before the MSFT bashing commences

[SeraphimXI]

Lets all remember that this is still Beta code. It's not suppossed to be perfect. If it was perfect it would be released now.

Re:Before the MSFT bashing commences

[TrappedByMyself]

If it was perfect it would be released now.

If that's the criteria, then no complex piece of software would ever be released.

Re:Before the MSFT bashing commences

[Timesprout]

Friedrichs noted that in the Linux networking stack, vulnerabilities and stability issues continue to surface well over five years after it was first released.

Apparently nothing is secure according to Symantec

Re:Before the MSFT bashing commences

[catbutt]

Wow that's pretty bad logic. The parent said "if it was perfect it would be released now", not "unless its perfect it won't be released". Big difference.

Re:Before the MSFT bashing commences

[pilgrim23]

the perfect opsys, for the perfect application: and an application that will ebready just intime: Duke Nukem Forever!

Re:Before the MSFT bashing commences

[WilliamSChips]

Except for Symantec's own software. I want a virus that only infects computers with Symantec products installed.

Re:Before the MSFT bashing commences

[Cal Paterson]

You idiot. You do not rewrite a whole networking stack in the time between beta and release. The whole "it's only beta!" excuse only holds up for fixing trivial mistakes, not poor design concepts.

Please THINK before you post.

Re:Before the MSFT bashing commences

[Cornflake917]

Where in the article does it say that Vista's networking stack uses a poor design concept? Let me answer that question for you. NOWHERE! I'm not saying Vista is going to perfect, but people are blowing this article way out of proportion. Here are the issues that that Symantic talks about:

-They found several security bugs and determined that Vista's networking technology will be less stable, at least in the short run, than Windows XP's, the report said.
-Support for IPv6, something that will eventually be a requirement for OS's in the future, will create some security issues. Wow, Microsoft made such a poor choice here!
-The technology that underlies Vista's peer-to-peer collaboration features, much ballyhooed by Microsoft, could also pose a security threat, Symantec said.

Even if you can somehow derive that Symantec is implying poor design concepts with Vista, employees at Symantec admit the following things:

"We're not saying that Vista's network stack is going to be inherently insecure when it is released..."

"We expect many of our results to be invalidated by changes made prior to its public release..."

Furthermore, the article even states that Symantec and Microsoft are competing now. Symantec NEEDS Microsoft OS's to be unstable and insecure, so of course they are going to make these kind of comments. The title of the story is B.S. "Windows Vista still Rife with Insecure Code" my ass. I bet if you saw a /. aritcle about security flaws in Linux, it would say "Very Minor unexpected feature found in Linux Code" or something. Get a brain and stop looking at stuff from one point of view, slashdot.

Re:Before the MSFT bashing commences

[Anonymous Coward]

Shouldn't the code be DESIGNED to be secure ?? If it should then a beta would be quite secure too... it however seems (to me at least) that several sw. firms are designing something that works and then they try to wrap security around it afterwards... and they are failing over & over again...

Re:Before the MSFT bashing commences

[TouchOfRed]

The network stack wasnt re-written post-beta, it was one of the most significant changes in longhorn next to the new driver model.

Re:Before the MSFT bashing commences

[TrappedByMyself]

Wow that's pretty bad logic. The parent said "if it was perfect it would be released now", not "unless its perfect it won't be released". Big difference.

Look at the OP for the entire context:
Lets all remember that this is still Beta code. It's not suppossed to be perfect. If it was perfect it would be released now.

He's saying that it's not supposed to be perfect because it's still Beta code, implying that the release code is supposed to be perfect.
I should have quoted the whole thing.

Re:Before the MSFT bashing commences

[kamatsu]

Windows Live Messenger Gamma 1 featured a totally different GUI to Windows Live Messenger Gamma 2.

Visual Studio 2005 Beta 2 included a total rewrite of the ODBC system as opposed to Beta 1.

However

[also-rr]

This may not be a bad thing.

I am much happier with well laid out, structured and simple code that has X rate of defects than well polished over the years, old, cruddy and complex with X rate of defects because with the former:

Fixes will be faster.
Fixes will be easier/cheaper.
Fixes will be possible!
Bug fixes will have less chance of introducing new bugs.

Given time we can then be sure that we will end up with... err well polished over the years, old, cruddy and complex. But it probably won't be as bad as if the process never happened in the first place.

Re:However

[Goalie_Ca]

Because IT's much easier to fix a square wheel than a round one!

Re:However

[Yohimbe]

Actually the old code might be better. And I don't defend blindly.

It has been my repeated experience that "Cruddy and complex" code is that way because the problem space is cruddy and complex and thats what bugfixes do to code.

You throw out that complexity and you throw out accumulated knowledge. I have yet to see a second system or third or fourth that managed to keep the bugfixes of the previous system. These issues return and they are accompanied by new ones.

In this case there might be a reason to thow out this particular baby with this particular bathwater: the only thing that new code gives you is resident experts on the new code. If you have staff turnover (Which MS always does), they may have already lost the resident experts on the previous design.

So that brings up the next point: MS may now be jumping its proverbial code shark: They've not increased in price in 3 years: stock options are worthless, they're losing people, and the hardware vendors are saying "When are you going to get us a decent 64 bit system?". They can't seem to ship secure code and now they throw out working subsystems, possibly because they've got a brain drain. MS owns the office market, but they're starting to really fall behind in shipping modern security at the OS level.

Re:However

[aneurysm36]

another supporting opinion on this subject
http://www.joelonsoftware.com/articles/fog00000000 69.html

Re:However

[Tim]

It has been my repeated experience that "Cruddy and complex" code is that way because the problem space is cruddy and complex and thats what bugfixes do to code.

Yes, yes. Cruddy and Complex code is cruddy and complex because it needs to be cruddy and complex (not because it was hacked together on an impossibly short schedule, or written by a novice developer using a fundamentally bad design. Or both.) And you should never rewrite code. Ever (except when you should).

There are no absolute rules in software engineering. Part of the art of the game is knowing when to toss code that is so impossibly bloated that it would take many times longer to "re-factor" than to "re-write." And despite the fact that many (most?) people are bad at making this decision, it is not automatically true that code should never be re-written.

Re:However

[mav[LAG]]

But the track record of Firefox vs IE disagrees with Joel. Paradoxically I think his stance is still generally right but this is a special case: in the long run Netscape's code benefited from being opened up and IE's was deliberately allowed to languish.

Re:However

[mypalmike]

It has been my repeated experience that "Cruddy and complex" code is that way because the problem space is cruddy and complex and thats what bugfixes do to code.

This is often the case. However, I've also seen many cases where "cruddy and complex" code can be refactored into cleaner, better working code by viewing the problem space from a different perspective. Sometimes perspective comes from just rethinking the problem. Other times, it emerges from newly available technologies. For instance, ConcurrentHashMap in Java 5.0 allows safe and efficient multithreaded access to a Map, obviating the need for complex thread synchronization in many cases.

As an example of the former, I recently refactored some code that involved two complex, intertwined finite state machines which implemented an algorithm to determine which set of a large number of objects was in the "ready" state. Objects not in the "ready" state were in all sorts of limbo states, many of which were designed as transitory states to other limbo states. There were about 20 states in all, and an enormous number of transitions. The code was mired in "HACK" and "WORKAROUND" comments, revealing numerous bug fixes. As with many poorly-documented FSMs I've seen in code, there were hacks that intentionally broke the FSM-ness, e.g. by forcing objects to be in a particular state temporarily, etc. Stepping back, it was clear that the finite state machines were not only cruddy and complex, but an awful solution to the problem. It was largely a prioritization problem. From that perspective, each object had a priority and a couple of additional orthogonal attributes. During refactoring, a lot of messy code just withered into nothingness because it was written just to support the FSM pattern. The new code has been rock solid, without the random bugs we'd been seeing prior to the code change.

I'm not arguing that all hairy code should be rewritten. But there's a lot of code out there that could benefit from a change in perspective.

Re:However

[Anonymous Coward]

I've found that cruddy and complex code is usually that way because 90% of everything is crap and the guy that wrote it was inexperienced and under tight deadlines. You know this because there are no comments telling you what all the hacks and bugfixes were for, or else you'd be able to easily duplicate a majority of them in new code.

That said, you don't throw out the old code. That would be stupid. You use the old code as a reference for what things work well and what don't.

OTOH, quite often YOU are on a tight deadline and not as experienced as you think you are...

So

[kevin_conaway]

So they're saying that beta software still has bugs in it?

I don't think its particuarly fair to be making these public accusations at this time. I'm sure the developers appreciate the testing, but an article to CNET seems a little too much

Re:So

[Anonymous Coward]

"So they're saying that beta software still has bugs in it?"

No, they are saying that the new network stack for Vista is a security problem and probably will remain one in the future.

Really, this "but it's still a beta" excuse is incredibly lame and stupid. MS wrote a whole new network stack for Vista, symantec now tested it in a beta that is very late in the release cycle and found severe problems.
And your reaction is to simply whine because it's a beta? How silly can you get?

Re:So

[LocoMan]

To be fair, they found several flaws that were all fixed in the new version of the beta that was released in May. Their reasoning is that it's insecure becasue if they found the flaws, the new flaws will continue to be found (which isn't that unreasonable considering that there are still flaws being found for XP)

Re:So

[Jugalator]

So they're saying that beta software still has bugs in it?

They aren't even saying that. Symantec is saying:
1. Vista may not have an "inherently insecure network stack" when released.
2. It can be bad to replace tested code like a network stack for security.

They aren't even saying Vista's network stack is flawed.

They aren't even saying something in Vista is flawed.

They're waving a warning flag and Slashdot spins the whole thing 180 degrees.

Am I right?

Re:So

[Jugalator]

Sorry, I missed they at one point do name some bugs discovered that could make its networking technology "less stable" (whatever that means) in the short term. But the question is when they found these, and how/if they'll even affect the Vista release. For all we know, these bugs may already have been fixed, as there's a lot of work on Vista at the moment.

Unless they point us to a report with these bugs and their status on a bug tracking service like Secunia, I can't really see much use of this information.

Mistake?

[Billosaur]

"Microsoft has removed a large body of tried and tested code and replaced it with freshly written code, complete with new corner cases and defects," the researchers wrote in the report, scheduled for publication Tuesday. "This may provide for a more stable networking stack in the long term, but stability will suffer in the short term."

On the one hand, you can see thier point. The XP code has become more mature and has all the latest fixes and is more or less stable, as Windows goes. On the other hand, the hackers and crackers have a pretty good bead on it and are capable of exploiting it more easily than they would a new and unknown body of code. There will be the inevitable bugs in the new code, but you have to admit, Micrososft has a lot of experience now at finding and fixing exploits. I figure the breaking in period for Vista won't be quite as long as it was for XP.

Re:Mistake?

[aymanh]

I was going to moderate but after reading your comment, I decided to reply. Why are you assuming that it's not possible to write secure code from the start? The networking stack is a vital part of an OS's security, can't MS fork enough resources to create a relatively secure networking stack for Vista?

Crackers will become familiar with Vista's net stack soon or later, either by reverse-engineering the new not-so-secure stack, or by utilizing their familiarity with the XP stack (in case MS didn't replace it), it's a cat and mouse game, just like how they found exploits in the first one, they will find ones in Vista's stack, the solution is to write a secure networking stack, not to replace it with another vulnerable one that hasn't been reverse-engineered yet.

Re:Mistake?

[Billosaur]

Why are you assuming that it's not possible to write secure code from the start? The networking stack is a vital part of an OS's security, can't MS fork enough resources to create a relatively secure networking stack for Vista?

That's not my assumption at all; given Microsoft's track record however, you have to wonder if that will be the case. Symantec is saying it isn't based only on their review of the beta software, but you can't take that as gospel, anymore than you can accept MS's assurances that Vista will be secure.

Microsoft has the capacity to make a secure stack, the question is do they have the capability? Since this is new code, one can assume that resources used for XP aren't as of much help as Vista developers, so it depends on the kind and amount of resources they chose to task to this. Personally (and I know this will draw the ire of some), I've found that with each succeeding generation of Windows, the product gets more reliable, though always somewhat less secure. I'm hoping MS can at least maintain quality with Vista while at the same time improving security.

Outrage!

[Kesch]

'Microsoft has removed a large body of tried and tested code and replaced it with freshly written code.'

How dare they! Just when I know all the exploits in the old code, they make me go and have to discover all new bugs in their new code. Being a hacker is hard some days...

Re:Outrage!

[Frightening]

Ah yes, but think:

Now instead of having virii that move windows around rapidly(and pwn u), we'll make virii that spin windows around rapidly(and pwn u)!
It's worth the wait if you ask me.

Re:Outrage!

[Gleng]

Don't worry too much. Vista is to XP what the Deeper Dungeons add-on was to Gauntlet.

You know how the game works, but here's some new levels to explore. Just remember not to shoot the food!

new networking stack

[Anonymous Coward]

I believe its better to have a long term security with the new stack rather than keep patching decades old code, and now that MS and Symantec are at loggerheads, statements like these will be common.

The new windows anti-virus protection

[Sweeman]

As part of Microsoft's new anti-virus system they will replace old bugs with new bugs to keep one step ahead of hackers. Genius!

Re:The new windows anti-virus protection

[Kadin2048]

That's kind of how the closed-source patch process works.

When a vulnerability becomes known, you patch it; if the result of the patch is that you create a new vulnerability somewhere in exchange, this is still acceptable, since you're trading a known vuln for an unknown one. When somebody finds the new hole, you repeat the process, ad infinium. Nobody does enough testing to verify everything, and particularly when you're in a rush to release a fix for a security exploit there's even less time for regression testing.

In an open development environment, it's tougher to fix something if you create a new hole in the process, since the holes are more immediately visible. While this might concievably mean that severe holes take longer to fix (although in practice I don't think they do), because you have to find a fix that doesn't create new holes, the overall quality ought to get higher over time, instead of just staying basically constant. In effect, the open development model puts far more emphasis on code review and regression tests than would ever be practical or economically feasible for most commercial closed-source development efforts.

Re:The new windows anti-virus protection

[ClosedSource]

"In effect, the open development model puts far more emphasis on code review and regression tests than would ever be practical or economically feasible for most commercial closed-source development efforts"

Is there really any evidence that extensive code review and regression testing is taking place in most OSS projects? This is the sort of effort developers really hate even when paid to do it. It's hard to imagine that volunteers are spending hours and hours performing this boring chore.

Funny how slashdot titles work

[Anonymous Coward]

Note that if this were about linux, it would read: "Symantec claims Linux Still Rife with Insecure Code"

Since this is a Microsoft product, it reads "Windows Vista Still Rife with Insecure Code"

I guess many Linux advocates still believe anything they read on the subject of Microsoft criticisms.

Re:Funny how slashdot titles work

[metasecure]

mod parent insightful...

Re:Funny how slashdot titles work

[Anonymous Coward]

Funny... mostly 'cause the only ones claiming that Linux is insecure are... MS, the union of MS-fanboyz and the association of trusthworthy corporations financed by MS.

As evidenced by...

[Cherita Chen]

I have been using Vista (Build 5381), and I've personally seen the effects of their new networking internals - in my opinion they have got a long way to go. I wish anyone who attempts to use this version on a machine with the Intel Pro Wireless 2200bg lots of luck... I've had an easier time using this card w/Linux (no surprises there).

Re:As evidenced by...

[MSFanBoi2]

You really should try a more recent build. The 5400 series is MUCH better... 5472 was released on late Sunday night and its leaps and bounds over anything from the 5300 series.

Sometimes its easier

[ingenuit]

Occasionally when programmers leave a company that were in charge of projects like this its easier to rewrite the code instead of having a new set of programmers wade through years of hack and slash patches. Hopefully they will hire some that knows tcp/ip stacks well enough to write some decent code that doesn't have some of the most basic vulnerabilities.

Re:Sometimes its easier

[gnuman99]

In larger software companies, software programmer or coder != software designer or architect. The designer is responsible for the the way code behaves. The coder is responsible for following the design. That is why you can outsource lots of programming jobs to India. They just write the code based to some specs. Therefore quality of the software is not directly related to the quality of the coder but the quality of the designer and corresponding QA (unit tests, code reviews, etc..)

It is like in construction. The design is not done by the people that do the actual hammering.

Anyway, this is the way MS works. And no, it is not the way that Linux works where designer == architect for most of the time. The latter is better, but more expensive.

Re:Sometimes its easier

[swissmonkey]

The thing is, the people who wrote this TCP/IP stack have been working on the existing stacks for the past 4-5 years for most of them, and for some working on TCP/IP for more than 10 years.

There aren't many people in the world who know better than these guys what a TCP/IP stack should look like.

I've worked with most of them in my previous position at MS and these people are sharp, very sharp.

And needless to say, all existing attacks which the previous stack was protected against are taken care of in the new stack, they didn't erase their existing test suites when they started writing the new stack.

Re:Sometimes its easier

[Anonymous Coward]

You sir, are truly a dumbass.

Conflict of Interest

[Ryan C.]

OK, so Symantec makes money selling products that patch up problems with Windows OSes. Microsoft trying to put them out of a job. I'm not saying Vista is really achieving this goal, but what sort of report did you expect from Symantec? "Wow, this Vista really makes our products unnecssary"!

FUD. At least they learned Microsoft's greatest marketing strategy.

Re:Conflict of Interest

[Anonymous Coward]

From TFA:

"Microsoft has removed a large body of tried and tested code and replaced it with freshly written code, complete with new corner cases and defects," the researchers wrote in the report, scheduled for publication Tuesday. "This may provide for a more stable networking stack in the long term, but stability will suffer in the short term."

I've come to terms with Slashdot becoming an MS-fanboi site but I still expect submitters to RTFA before making accusations of FUD. Would Symantec make these accusations if the legal situation didn't support it?

Re:Conflict of Interest

[telbij]

I've come to terms with Slashdot becoming an MS-fanboi site but I still expect submitters to RTFA before making accusations of FUD. Would Symantec make these accusations if the legal situation didn't support it?

The legal situation? Whu-huh?

It's funny that you call /. an MS-fanboi site while others complain about reflexive anti-Microsoftism. Then there's the ever-popular 'slashbot' theory that only popular opinions get modded up. It just goes to show that every whiner views the world through their own eyes and only sees the things that confirm their theory of universal and conspiratorial ignorance. If you can't see that Symantec might have an incentive to say Vista security will suck then you are truly a sucker and you deserve what you get in life.

Re:Conflict of Interest

[Anonymous Coward]

Oo, that looked like fun, let me try one: I once heard someone say that Faux News was too liberal. See, it just goes to show, they truly are perfectly fair and balanced, it's just that no one but me can see it because everyone else is a whiner!

Re:Conflict of Interest

[Anonymous Coward]

"The legal situation? Whu-huh?"

If Symantec's statement was patently unfounded and false, could they say it? That legal situation. Simple enough. Also simple enough, change your threshold in prefs to view only +5 rated posts and 'confirm your theory of universal and conspiratorial ignorance' yourself. Save for a single 'Funny' about having to learn new exploits two are cynical of Symantec's motivations, two discuss technical aspects of 'shatter attacks' in Vista's defense, one makes fun of Sun. For maximum enjoyment repeat with future stories about Microsoft. It's not hard, save for the part of overcoming comforting preconceptions.

Re:Conflict of Interest

[miffo.swe]

The correct way would have been if Vista didnt NEED an antivirus app. Microsoft is just cashing in on its own shortcomings wich in all eyes is just plain wrong.

Re:Conflict of Interest

[telbij]

If Symantec's statement was patently unfounded and false, could they say it? That legal situation.

Just because something is technically true or at least ambiguous enough to not be false does not mean that its purpose is not FUD.

Another way of saying it

[Aqua_boy17]

and shows how it will be a long way before it is ready for the mainstream

In other words, wait until at least SP2 is released before even thinking about upgrading. That's how I read it anyway.

Semantec's attempt to reassure stockholders

[Bill_the_Engineer]

Isn't it to Semantecs best interest to generate demand for their product by creating uncertainty when it comes to OS security. They did this to linux too...

Granted Microsoft may be using new code, but that doesn't necessarily mean it's more insecure than the current network stack.

Let's see what the non-beta software looks like, and see what a independent lab reports.

Bill

Re:Semantec's attempt to reassure stockholders

[asuffield]

Let's see what the non-beta software looks like, and see what a independent lab reports.

I wasn't aware that any independent labs existed in the security field. Certainly Microsoft try to prevent it (any 'independent' group will be a prime target for their convert-or-crush strategy) and most places want to push their own products anyway.

Two of the funniest sentences today.

[rowama]

Since January 2002, Microsoft has put a stronger emphasis on protecting PCs by attempting to implement stable, secure code into Windows XP and their new operating system. This latest report from Symantec brings attention to Microsoft's trustworthy computing campaign, and shows how it will be a long way before it is ready for the mainstream.

This reminds me of the secret language I've read/a> supervisors have when discussing sub-par employees.

Re:Two of the funniest sentences today.

[rowama]

Aarrg! Who swapped the Preview and Submit buttons?

Put up or shut up

[Fefe]

So, Symantec, let's see the vulnerabilities you claim to have found.

Oh, you have none? It was just fearmongering to scare people into buying your products? I'm shocked, I tell you. Shocked!

This would be half as funny if Symantec products didn't open more holes than they close.

Shatter attack

[Kadin2048]

I had never heard of such a thing before (actually, initially I thought you were just punning on Windows + 'shattering', har har).

It would seem that Vista allegedly fixes the design flaw that allows for the attack, by not running system services in the same session as the user. At least, that seems to be what the Wikipedia article on the topic is suggesting.

The key to shatter attacks is that Windows allows processes running in the same session to pass messages between each other, the result of which is that via code injection, any process can escalate up to the level of the highest process also running in its session. MS is quoted in the article as saying "[This is not] a flaw in Windows. In reality, the flaw lies in the specific, highly privileged service. By design, all services within the interactive desktop are peers, and can levy requests upon each other. As a result, all services in the interactive desktop effectively have privileges commensurate with the most highly privileged service there." (Which is amusingly doublespeak-ish; they're saying "this isn't a design flaw, we designed it that way!")

This blog post by a member of the IE7 team would confirm that they've at least tried to address this in Vista (but of course that's what you'd expect them to say). It says: "User Interface Privilege Isolation (UIPI) blocks lower-integrity from accessing higher-integrity processes. For example, a lower-integrity process cannot send window messages or hook or attach to higher priority processes This helps protect against "shatter attacks." A shatter attack is when one process tries to elevate privileges by injecting code into another process using windows messages."

Yet another nice legacy "feature" from the single-user-OS days.

Re:Shatter attack

[dioscaido]

In Vista, a window can only send messages to windows at the same or lower privilege level, eliminating shatter attacks.

You joke, but

[Anonymous Coward]

There may be some truth to that. God knows how many of the security holes are actually back-doors from the DHS, or CIA, or NSA, or any of the similar organizations in other companies where Microsoft employees people.

I'd bet that every single country in which Microsoft has a devlopment team has at least one back-door programmed into their code -- perhaps more in countries where they have more than one security agency that don't share info with each other.

Re:You joke, but

[Anonymous Coward]

I'd bet that every single country in which Microsoft has a devlopment team has at least one back-door programmed into their code -- perhaps more in countries where they have more than one security agency that don't share info with each other.

Considering that they even have legislation to require wiretappable telecom infrastructure, I wouldn't be surprised.

In fact, I think it's the only way to explain how many security bugs are in Windows. Don't buy the excuse of it taking a lot of resources -- Microsoft has a *LOT* of resources including billions of dollars in the bank; and the OpenBSD group have a near perfect track record with a better performing OS with a budget thousands of times smaller than what Microsoft pays as dividends to shareholders.

If they wanted to fix their security problems, they could and OpenBSD is proof of that. The fact that instead they pay out dividents to shareholders (which is what a company does when it can't think of a better use for the money) means that they have some reason not to want to fix the problems.

Clearly it's not a marketing decision - it's bad press every time another one of these backdoors is exposed -- and it's not a feature corporate customeres want -- so it most likely is a policy decision with governments.

Re:You joke, but

[HoboMaster]

Jeez man, paranoid much? You really think Microsoft could care less about most of these countries? They won't respect their court rulings, but they allow not just one, but multiple, back doors to be programmed in? And why would they do that? What is Microsoft getting out of the deal?

DA GUBBERMINT WANTS MAH TEEFS!!! RUUUN!

Re:You joke, but

[Clover_Kicker]

> hey won't respect their court rulings, but they allow not just one, but
> multiple, back doors to be programmed in? And why would they do that? What
> is Microsoft getting out of the deal?

(dons tinfoil hat)

A free ride on the court rulings?

Re:You joke, but

[Anonymous Coward]

You really think Microsoft could care less about most of these countries? They won't respect their court rulings, but they allow not just one, but multiple, back doors to be programmed in? And why would they do that?

In most cases they never know. Of the thousands of Microsoft programmers in China, what are the odds that not one works for the PLA or of the thousands in India workingn for any of these agencies. I bet every one of those agencies has at least one Microsoft employee, at least some of which are interested in back-doors.

What is Microsoft getting out of the deal?

The only thing Microsoft knows is that they hired a top security expert for less than market rate -- which is exactly what they wanted when they were looking into offshore employees to begin with.

Re:You joke, but

[HoboMaster]

Pshh, they're already ignoring the rulings anyways. Like it matters.

Oh, and tin foil doesn't work, You have to go with LeadHat if you REALLY want security.

Re:You joke, but

[Anonymous Coward]

I'd bet that every single country in which Microsoft has a devlopment team has at least one back-door programmed into their code -- perhaps more in countries where they have more than one security agency that don't share info with each other.

Considering that they even have legislation to require wiretappable telecom infrastructure, I wouldn't be surprised.

In fact, I think it's the only way to explain how many security bugs are in Windows. Don't buy the excuse of it taking a lot of resources -- Microsoft has a *LOT* of resources including billions of dollars in the bank; and the OpenBSD group have a near perfect track record with a better performing OS with a budget thousands of times smaller than what Microsoft pays as dividends to shareholders.

If they wanted to fix their security problems, they could and OpenBSD is proof of that. The fact that instead they pay out dividents to shareholders (which is what a company does when it can't think of a better use for the money) means that they have some reason not to want to fix the problems.

So it's not a technical decision. Clearly it's not a marketing decision - it's bad press every time another one of these backdoors is exposed -- and it's not a feature corporate customeres want -- so it most likely is a policy decision with governments.

Re:You joke, but

[plantman-the-womb-st]

And why would they do that? What is Microsoft getting out of the deal?

Money, gigantic piles of money.

Tax shelters, endless government contracts, being able to laugh at convictions for monopolistic business practices, export law loopholes... ...did I mention tax shelters and endless contracts?

Some law maker probably made a decision that he passed to an aid that got typed up by an assistant and passed to another department where it was review and edited then typed up again and handed to another department where the boss hands it to a coordanator to find a field agent who doesn't want to bother so he hands it to the guy under him who has cool sunglasses and has seen waaay to many "James Bond" films who thinks he's doing something "covert". That guy goes to see the company flashes a badge and the receptionist dials up the project head who's in a meeting so he sends an engineer who can tell the G-man is a loser so he sends the G-man to the delevpoper's in the basement who have all seen "The Matrix" waaay to many times who suddenly thing they are being "covert" and "leet". So now much money has changed hands, the law maker thinks he know that something happened and the company thinks they did something for the law maker, but neither the law maker nor the heads of the company really understand what happened and doubtfull that anyone else does either. They'll just say things like "that favor we did for you" back and forth to each other while not having a clue what happened. Law maker thinks "his people" now have the tools they need dispite the fact that he probably can't remember who "his people" actually are, and CEO is laughing all the way to the bank knowing his product fills the government's need dispite having no idea what his product actually does.

Hell, who wouldn't do it?

Re:You joke, but

[DroppedPacket]

OK, I have to bite on this:
In fact, I think it's the only way to explain how many security bugs are in Windows.

I think you perhaps need to take some lessons in critical thinking. This is the equivelent of saying, "The only reason auto-manufactuers put problems into cars so they have to recall them is because the government makes them, which is why Japanese cars are better than American cars."

Large monolithioc systems are inherently more complex that smaller componant built systems. (Although those have problems too along the boundary interfaces.) Auto-makers put lots of time and money into making a car that A) doesn't fall apart and B) doesn't require a multi-billion dollar recall effort. Microsoft puts lots of time and money into trying to make their software more secure.

On the whole, I'd say the auto companies do a better job. :-) Thowing money at a problem very rarely solves the problem. The need to have an understanding of the problem, and how to fix the underlying problem is vital. I think that is where Microsoft fails. The systems they have in place (from what I hear) are more frustrating to the engineers than helpful.

I also have problems believing MS engineers are really motivated these days. Many of Microsoft's security issues have stemmed from their own code interactions which they implemented as deliberate features. Many more have been from sloppy programming (such as buffer overruns).

Trying to blame MS security issues on government mandated back doors smacks of plain political diatribe with a nice glossy veneer of ignorance on the top to give it a nice sheen.

Re:You joke, but

[juan2074]

Oh, I thought you wanted them to build Vista on the OpenBSD platform.

Re:You joke, but

[Anonymous Coward]

"The only reason auto-manufactuers put problems into cars so they have to recall them..."

Whew, thanx. I understand these IT issues much better with an automotive anology. I was afraid there wouldn't be one this time. ;-)

Re:You joke, but

[cosmicj]

Do you really think auto-manufacturers are doing a better job? Or do they just have MORE incentive?

A car 'crashes' and someone could die.

Windows crashes..you loose some work. And M$ sees another revenue opportunity--sell you a new pile of crap code to fix "your problems" ...is there any wonder there isn't any incentive to fix this?

Re:You joke, but

[causality]

I think you perhaps need to take some lessons in critical thinking. This is the equivelent of saying, "The only reason auto-manufactuers put problems into cars so they have to recall them is because the government makes them, which is why Japanese cars are better than American cars."

My critical thinking skills tell me that this is a false analogy because the government has no incentive to make automobile manufacturers issue recalls, and really the attorneys and enforcement and regulations involved would make this nothing but an expense for the government. When consumer protection laws are enforced, the governmental officials involved can at least claim that they are doing this to benefit the public, even when doing so does further someone's personal agenda.

The situation as described by the A.C. is where the government requires backdoors so that its own governmental snoops (law enforcement and possibly more shady, less accountable organizations) can easily access systems that would otherwise be difficult to access due to security protections. This directly benefits the government because it makes their legitimate law enforcement job easier and it also makes less legitimate ventures (potential data mining, eavesdropping, etc) much easier and has the nice side-effect of eliminating some of the need to do old-fashioned police work. This scenario certainly does not benefit the users of Microsoft software and so the intent shown is nothing like your analogy. If this is actually happening, then this is a very dangerous precedent for two reasons: One, if the government can use such a backdoor, so can anyone else who learns of it; two, the job of law enforcement was not intended to be easy and efforts to make it an easy job immediately preceded the rise of most totalitarian states that existed during the 20th century (at the risk of invoking Godwin's Law, Nazi Germany and the USSR did not take place due to powerless and ill-informed police forces).

Further, when speaking about Windows you are dealing with proprietary, closed-source software. You and I simply do not know with 100% certainty whether or not there actually is such a backdoor in any of the Windows code, nor do we know what agreements Microsoft has made with which governments. What you can know is that we are in an era where privacy is on the decline and law enforcement powers are increasing, and being able to easily access over 90% of all desktop computer systems does fit the stated purpose of programs that we do know about, such as the NSA wiretap program. To say that we already know about every possible threat to privacy and that the statists who desire this kind of surveillance are now satisfied and will not be seeking further powers is a lofty claim indeed. Study history and you will observe that the USA has a bad case of "it can't happen here" regarding foreseeable abuses of power.

Also, unmotivated programmers and undocumented backdoors are not mutually exclusive. It is possible that they both contribute to the sad state of security in Microsoft's code. It is also possible that neither are true and that some third factor (such as program design being dominated by marketing and forcing otherwise good programmers to work within these parameters) can explain the lack of security. But to observe that the possible existence of unmotived programmers could explain the situation and then claim that this is a valid reason to dismiss other arguments out-of-hand does not fit the spirit of critical thinking that you mentioned earlier.

But it does indicate that maybe, just maybe, you live in the USA and are in denial about the direction towards which it is headed.

Re:You joke, but

[drsmithy]

Don't buy the excuse of it taking a lot of resources -- Microsoft has a *LOT* of resources including billions of dollars in the bank; and the OpenBSD group have a near perfect track record with a better performing OS with a budget thousands of times smaller than what Microsoft pays as dividends to shareholders.

OpenBSD isn't doing anywhere near as much, nor used by anywhere near as many people. Your comparison is broken.

Incidentally, you can't compare budgets between OSS and commercial software development. One would hope that would be obvious to even the casual observer, but clearly it isn't.

Re:You joke, but

[eonlabs]

Props to your post!

I would just love to see more of the people bitching about how crappy windows is try writing a program that functions with the linguistic support and extensibility you see in windows and ffx.

Not that I think windows is great. I would just like to see some money where peoples mouths are. It would mean more options.

By the same token, I would love to see microsoft write an operating system that allows you to trim it down to bare minimums, so I can get the damn half gigahertz machines that my friends have unknowingly installed XP on to work again.

The article sounds like MSoft is doing something right for a change, and re-working a piece of code from scratch instead of beefing it up to new levels of crap. The thing that has always worried me about microsoft is this is a company that happily dropped a flight simulator into its database editor and a pinball game in its word processor. You can't comfortably install XP on under 4GB. Many modern games with full physics and 3D engines don't require that kind of space (yes, I know, apples to grapefruit, and they often use part of the OS they run on), so it's shocking to me when I consider that that's what the bare minimum for the system to run is.

Re:You joke, but

[Anonymous Coward]

Wow. MS goes almost 6 years between OS releases and you're accusing them of intentionally putting in bugs to get you to upgrade? Do you also believe that MS EOLed Win98 last week just to get people to pay for the $50 upgrade to XP?

I'd be more inclined to suspect Apple of this scam. They've come out with a $100 upgrade just about every year since 2001. You could even argue that Apple intentionally made MacOS 10.0 slow as molasses so that they could incrementally speed it up every release.

dom

Re:You joke, but

[10101001 10101001]

Large monolithioc systems are inherently more complex that smaller componant built systems. (Although those have problems too along the boundary interfaces.) ... Microsoft puts lots of time and money into trying to make their software more secure.

Microsoft has, in many ways, designed a system from a very monolithic standpoint. This isn't very surprising in many ways. If GNU wasn't around to provide the userland tools that separate the monolith X from the monolith Linux kernel, I'd imagine the Linux community would be in a very similar position. This is because once a group has spent a good bit of time working on a project that they have a lot of confidence in, they begin to see a lot of parallels between it and the tasks they are about to complete.

Normally, it's the other competitors in the market place who force a rigid border that creates a separation which helps solidify the lines between the two. This is especially good because in a monolithic environment, you're still left with subgroups that otherwise form much weaker borders between components in the collective. This in turn creates something of a development nightmare, as major shifts in the fundamental design of the system cause a need to rewrite many componets of the system to remain compliant which invariable leads to even weaker borders as people write in hacks to keep everything working together (the Linux kernel is in the same boat, though thankfully it's a much smaller code base so there's less things that can go wrong). The end result is that people don't end up thinking through very clearly what the new borders are and assumptions that were true in the past become security gotchas.

The switch of Microsoft to managed code is, at best, a hack that will only help minimize the problems that will invariable occur as a result of this fundamental design (basically to make most code execution attacks impossible, reducing them to denial of service). But none of this fixes the problem that the Windows code base is so monolithic that the future development costs will continue to rise. Perhaps Microsoft should take a cue from Xorg and split up Windows into components (XP Embedded sounds like it might be along those lines, though I don't know enough about it to say that that's what it actually is). In the sort term, there would be a massive increase in the number of obvious exploits (many of them undoubted fixed in the modularization), but it is probably the best way to spend their money on security improvements. And an added bonus is that it will greatly improve their ability to develop in the future.

Re:You joke, but

[heybo]

One problem with your comparsion. With Car companies a recall means they have to pay to fix the problem with the car. With MS YOU! have to pay for the patch to fix their flaws. Read the EULA they're (MS) not responisable for anything. Plus why should they fix their code when they and the "Partners" get rich selling you things to protect you from the holes in their OS?

Maybe one day the world will wake up and find out there are differant OSs that are better the Windoze.

Curiously, ...

[Zx-man]

...they also tend to have the best networking stacks I ever worked with.

TPM support should be security concern #1

[Anonymous Coward]

When are Symantec going to start protecting users against that?

Windows Defender anyone?

[DoubleRing]

I'm thinking Symantec is feeling the heat from Windows defender. Once people have that, a large number of people will probably be too unconcerned or too lazy to bother installing a different virus program. Symantec cannot be trusted for a neutral veiw (NPOV comes to mind).

2008

[Nom du Keyboard]

Vista in 2008 anyone?

Did you also notice?

[Spiked_Three]

"Friedrichs noted that in the Linux networking stack, vulnerabilities and stability issues continue to surface well over five years after it was first released."

And about vista's new stack "This may provide for a more stable networking stack in the long term, but stability will suffer in the short term."

I think the report overall is positive for Vista. ANYONE who expects a new OS to come out bug free is a fool. Unfortunately, on CNET as on Slashdot, a positive microsoft article isn't news, thus the SPIN.

DOA for sure.

[fuego451]

'complete with new corner cases and defects'.

I think Symantec misspelled coroner.

Slashdot...biased?! Never!

[crerwin]

How does an article about how a new network stack could come with unknown security flaws and the fact that most security flaws that have been found in the beta builds have been fixed - as is to be expected - turn into "ZOMG M$ Winblows still rife with unsecure Hax!!" I'm not a Microsoft fan by any stretch and the world would possibly be a better place without them, but for Pete's sake stop acting like children. The article is "Symantec sees an Achilles' heel in Vista," so at least use that as the slashdot title. If the same article was written about a new network stack for Apple's new OS, the slashdot title would certainly not be spinned as much. Actually, it probably would, but the other way. Maybe I didn't read the article well enough, but it just seems that the summary isn't talking about the same article.

Maybe it'll finally work

[Draconnery]

As I say this, I have to admit that I am primarily a Windows user and find XP to be the first version of Windows that is entirely usable and not entirely frustrating; I have been a big fan since I first used it.

But even so, I find that Windows Networking never works. I have a file/print server runner Server 2003 which does work very well, but XP is a different story. I am a perfectly capable advanced user, and I can never get two different computers running XP on the same router to share printers or files, with less than an hour of work/directionless mucking about/rebooting. Same shit always used to happen with Win98, but XP does other things so much better that I had great hopes for networking. No luck.

It's tried and tested, and lousy. So I'm excited to hear that it will be replaced with something completely new, because for the first time in years, I have hopes that it might work.

Re:Maybe it'll finally work

[Anonymous Coward]

I am a perfectly capable advanced user, and I can never get two different computers running XP on the same router to share printers or files, with less than an hour of work/directionless mucking about/rebooting. Same shit always used to happen with Win98, but XP does other things so much better that I had great hopes for networking. No luck.
Don't even begin to compare 98 to XP.... just because you don't understand how the networking works, doesn't mean the OS has a problem. Here's a tip: drop NetBIOS and learn how a multi-user OS works and you'll have great success with Windows networking.

So they kicked out the BSD code

[guruevi]

We all know that from Windows NT up, they used the BSD TCP/IP stack. And it's usually not the TCP stack that is vulnerable, it's the next layer up that doesn't/can't handle what TCP brings in. So why did they throw it out and re-write it? It was one of the only pieces that made Windows semi-stable on a network and made it server-worthy. It was also pointed out that the MS implementation of the TCP/IP stack was the slowest stack around in the late 90's (I don't know about now). OS/2, Linux and even DOS had a faster TCP/IP stack back then.

Re:So they kicked out the BSD code

[0xABADC0DA]

Obviously they are going to embrace and extend IP with their own changes and retro-fitting these non-RFC compliant changes on the BSD code is too difficult. Error-correcting codes, DRM, new windows-only protocols (HTTP/IP)? Reformatting packet fields to be more 64-bit friendly? Whatever they are up to it's going to suck.

Is this that fucking hard?

[bhima]

I program professionaly and I've looked over some BSD & Linux code and quite frankly it is lot more involved than what I do. So I guess I shouldn't complain but jumping Jesus H. Christ if the BSD guys can do it with the resources they have, how is it that a company the size of Microsoft can't make this work?

Re:Is this that fucking hard?

[Anonymous Coward]

Christ if the BSD guys can do it with the resources they have, how is it that a company the size of Microsoft can't make this work?

Too many cooks in the kitchen, dude!

Plus the fact that people like Theo and Linus are fanatical.. they go way beyond the "vested interest" stage. In particular I hate Theo's demeanor at times, but when push comes to shove I send the bucks for OpenBSD media because OpenBSD just works.

Re:Is this that fucking hard?

[protohiro1]

As I mentioned elsewhere, if I had a few billion dollars and five years I think I could come up with a decent OS. I would probably go find an orphaned closed-source UNIX os (IRIX?) and graft a windows UI on top and then use virtualization to maintain backwards compatibility. Security problems, memory problems, clustering problems: gone overnight. Then spend the rest of the money getting exchange and active directory running and writing drivers.

Re:Is this that fucking hard?

[Clover_Kicker]

DARPA paid for the BSD TCP/IP stack waaaay back in the day.

Re:Is this that fucking hard?

[bhima]

That's not all that of a bad idea... I haven't used IRIX in a long, long time :)

But I wonder if you could just hire some BSD developers insted and arrive in same place only being free

Re:Is this that fucking hard?

[gbjbaanb]

if 1 developer can write it in a year, 2 developers could write it in 9 months, 3 developers in 7 months, and 10 developers could do it in 3 years and find time to include a mass of conflicting design issues, several project plans, bugs, security exploits, and out of date documentation.

Turned upside down

[Opportunist]

Well, the funny part is that, with TCPA and DRM built core-deep into Vista, we can only hope for insecure code...

Vista has been improving...

[PurifyYourMind]

I work as a tester at a large, well-known tech company. I started using Vista back in February of this year, and I've used one of the latest versions, 5474, recently. Here are the changes I've seen:

• Improved graphics (more complete icon set, fancier installation and login graphics, nicer titlebar look on non-3D capable systems)
• More stability in general (some blue screen bugs I've reported have gone away with later versions)
• More gadgets in the sidebar
• A bit faster for file copies, file searches work a lot better -- file searching wasn't working at all at one point

So... I'm still skeptical of their early 2007 predicted time frame, but it's definitely been getting more polished over the months.

Re:Vista has been improving...

[Richard W.M. Jones]

I work as a tester at a large, well-known tech company. I started using Vista back in February of this year, and I've used one of the latest versions, 5474, recently. Here are the changes I've seen:
[better graphics, crashes a bit less, more widgets, file copying is a bit faster]

Sounds like it was really worth spending more money than the Apollo programme on then!

Rich.

Re:Vista has been improving...

[colmore]

I think the early 2007 one is going to be some sort of "Vista ME" to business customers they're now saying Q4 2007, which is I guess when the non-beta will be sold to the public.

Never buy a 1.0 product from Microsoft.

Re:Vista has been improving...

[Anonymous Coward]

But it's NT 6!

Newsflash...

[DrJokepu]

...scientists discovered that beta code contains bugs!

Convenient omissions

[grassh0pper]

Seems to be some pretty important information missing from the original post.

Traditionally allies, Microsoft and Symantec are now going head-to-head in the security arena. In late May, Microsoft introduced Windows Live OneCare, a consumer security package, and the software giant is readying an enterprise product. Symantec has also sued Microsoft, alleging misuse of data storage technology it licensed to the company.

In their paper, titled "Windows Vista Network Attack Surface Analysis: A Broad Overview," Symantec researchers put the networking technology in Vista under a magnifying glass to determine its exposure to external attacks. The team said it found several flaws in build 5270 of Vista and even more in earlier test versions. However, these were all fixed by Microsoft in build 5384, the version of the operating system that was publicly released in May as Beta 2.

So a Microsoft competitor releases a paper discussing flaws is a BETA that have already been fixed and the Slashdot article falls under the title "Windows Vista still Rife with Insecure Code". Problem is that even the writers of the paper aren't claiming that Vista is "rife with insecure code"...only that it might be because they found some other problems. It's amazing what qualifies for news some days.

Best Quote from TFA...

[SloppyElvis]

people should understand the ramifications of a virgin network stack

Oh man! I can't even begin to think of a joke worthy of that setup...

Fun-factor

[Valacosa]

I'll bet the code got re-written from scratch because it's more fun and sexy to write new code than to fix problems in old code - and this time, dammit, it'll get written right!

(I can't take credit for the thought. JWZ says it somewhere on his site, though I don't have the time to find it.)

Re:Fun-factor

[cnettel]

To be fair, the original design of NT networking was focused on IPX and NetBEUI. The bandwidth was 10 Mbit. If you routed in several steps, you didn't expect minimal latencies. You were also supposed to kind of trust the traffic on the network (no SYN attacks or stuff like that.) IPv6 on current Windows versions still has "it will kind of work" status. You don't start with MS-DOS and end up with XP. You end up with Me. Rewriting something because the old version is broken is highly unwise. Rewriting something because the old version is unappropriate for what you currently use it for might make sense. I remember the JWZ article and he talks about all the hidden assumptions you've found through hard work and how those are an essential value in the current codebase. If enough of those assumptions are not true anymore, it can make sense to rewrite something.

Re:Fun-factor

[Foolhardy]

Just to be clear, NT has always supported TCP/IP. In fact, KB article Q12823 compares available protocols circa NT 3.1 and 3.51.

From the October 2000 MSDN magazine, "Windows Sockets 2.0: Write Scalable Winsock Apps Using Completion Ports"

Unlike some other operating systems, the Windows NT and Windows 2000 transport protocols do not have a sockets-style interface which applications can use to talk to them directly. Instead, they implement a much more general API called the Transport Driver Interface (TDI). The generality of this API keeps the subsystems of Windows NT from being tied to a particular flavor-of-the-decade network programming interface. The Winsock kernel mode driver provides the sockets emulation (currently implemented in AFD.SYS). This driver is responsible for the connection and buffer management needed to provide a sockets-style interface to an application. AFD.SYS, in turn, uses TDI to talk to the transport protocol driver.

Ironically, it's TDI that's being replaced for something more sockets-like.

I think this is yet another example of Microsoft not understanding code that was previously written by someone no longer available, causing the new developers to misunderstand the original design, who then feel the only option is a rewrite. I've yet to hear any technical comparisons between TDI and "Next Generation TCP/IP", showing how the TDI architecture could never do those things. I bet TDI can support these new features with some new code, but it just wouldn't be as glamorus that way.

To adapt an old saying about LISP and UNIX, "Those who fail to understand NT are doomed to reimplement it. Poorly"

Re:Fun-factor

[ComputerSlicer23]

I'm reasonable sure you the article you are referring to is from Joel on Software.

JWZ might have also written one about it, but I don't recall it. I read quite a bit of his stuff a while back. What you are discussing sounds exactly like a Joel on Software article.

Any chance this article rings true with you?

Kirby

Re:Fun-factor

[Simon Garlick]

It was Sposky, at the time writing about Netscape (which is probably why you thought of JWZ):

It's a bit smarmy of me to criticize them for waiting so long between releases. They didn't do it on purpose, now, did they?

Well, yes. They did. They did it by making the single worst strategic mistake that any software company can make:

They decided to rewrite the code from scratch.

http://www.joelonsoftware.com/articles/fog00000000 69.html

Re:Fun-factor

[cnettel]

Absolutely, that's it :-)

Re:Fun-factor

[cnettel]

You're right that it's been supported since 3.1, but NT 3.1 was released a few years after the original design decisions were made. Just look at the status of the OS/2 and POSIX subsystems (and, for that matter, the whole idea of separate user mode subsystems).

The main point I've seen about the new stack is performance. Focusing solely on what's actually used is part of the degradation of NT that's been going on for years, but if they actually did the profiling and concluded that the problem was in the design of the old stack, a new one might be a better idea than adding some kind of kludgy shortcut bypassing the original design to solve those issues.

I certainly don't know enough to say for sure that this is the case, maybe the same work could provide similar improvements within the existing framework, but performance sure seems like something that logically often conflicts with a very generalized design.

Re:Fun-factor

[Foolhardy]

TDI is a set of interfaces; tdi.sys itself is only 20k with some support functions. I guess it's possible that the interface style could be getting in the way of performance, but I'm not quite sure how. TDI operations are just IOCTL IRPs with a common header and pre-defined functions (e.g. listen and send-datagram).

Maybe the problem is having buffering seperate from the TCP stack; in the TDI model, buffering is done above TDI, currently in the kernel-mode socket layer afd.sys. I was under the impression that AFD would continue to serve the same functions as before, including buffering, however. This diagram[1] seems to support that position; AFD is still between user mode and NGTCP/IP.

Technical details seem to be a little hard to come by, but the pages I could find are all about performance tweaks (mostly more automatic tuning) and new functionality, all at what TDI would consider the transport level (now broken into transport, network (addressing) and framing layers in NGTCP/IP). TDI doesn't care about how tcpip.sys is implemented internally, which is what these changes seem to be all about.

I did notice that afd.sys is now dependent on a new file: netio.sys, which is dependent on the new msrpc.sys. RPC in the kernel? That's new; it's been a required service since NT4 but implemented in user mode until now. The new tcpip.sys is also directly dependent on these new drivers. As expecetd, tcpip.sys is no longer uses tdi.sys, and user processes no longer hold TCP device handles for TDI context; everything goes through AFD now. I think there may be more going on under the covers than simple performance and management improvements.

Focusing solely on what's actually used is part of the degradation of NT that's been going on for years [...]

Well put. I'm a bit saddened that some of NT's elegant, innovative (and largely unknown) design features are being steamrolled for the sake of expediency, but I can see the reasoning from the perspective of actually selling the OS.

[1]Next Generation TCP/IP Stack in Windows Vista and Windows Server "Longhorn"
Performance Enhancements in the Next Generation TCP/IP Stack
Windows Vista Networking

Shortening the credits

[93 Escort Wagon]

"Symantec describes how Microsoft scrapped the old networking stack code from Windows XP in favour of newer, rewritten code."

Yeah, I imagine it really irked them, having to include that mention of BSD in their credits. Networking code written in-house by Microsoft Software Engineers should be WAY more secure.

Hmm... I wonder if anyone over there, even for a moment, talked about "extending" TCP/IP? Or maybe IPv6-MS?

I kid, I kid...

Re:Shortening the credits

[swissmonkey]

It never irked them, the TCP/IP stack in Windows 2000/XP/WS03 is 100% MS code.

It's always fun to see people who can't make the difference between TCP/IP utilities like ping, ftp, ...(who have BSD code) and a TCP/IP stack(which is 100% MS code) make fun of MS engineers.

Maybe you should go re-read your books about the OSI layers and basic networking.

Bye Bye Corporations

[nbannerman]

Ok, I run a network in education, but I can imagine Network Mangers banging their heads into walls already. I think I've got my network locked down enough to cover most of the bases, but seriously, can anyone really say they are looking forward to rolling out Vista across an entire network? I understand network / computer security companies have a vested interest in showing there is a need for their product, but they are not the only ones suggesting Vista is going to be a nightmare.

Re:Bye Bye Corporations

[Vancorps]

Out of curiosity who is suggesting that Vista will be a logistical nightmare? Plenty of speculation about the security which is just due diligence. Last I checked thought MS added a ton of features to Vista that corporate America has been dreaming about. Network managers and Systems Engineers should have a much easier time administerring a larger number of machines. Policy control is vastly improved combined with central storage options and other dynamic configuration tools and Vista looks great on paper.

Lot of Ifs in there still being a beta and all. I know from personal experience a lot of the features will make a lot of lives a lot easier. The popups to grant access need to be dealt with but I'm told newer versions of Vista have made this easier. I only worked with Beta 2 and I will revisit the OS when it has a release candidate. I can't say right now how many problems bugs will cause since I honestly don't know. Most of the issues I saw with beta 2 have already been addressed so it doesn't look half bad.

So yeah, back to my original question because I really do want to know. Who else is suggesting Vista is a nightmare to deploy? Just uninformed people shooting in the dark? Or people that have done a proper analysis on it?

Re:Bye Bye Corporations

[nbannerman]

Deployment wise, I'm not sure that Vista will be a nightmare. Far from it, I agree with you that all the indications we've had so far suggest a decent piece of software of that front. However, the security aspects of Vista apparently leave a lot to be desired, especially with regards to spyware, viruses and the like.

Re:Bye Bye Corporations

[Vancorps]

Not sure about the spyware regard since there is a lot more real-time monitoring of Vista going on which of course is a major performance hit. I haven't seen any gaping design flaws in the security around Vista as of yet, I am curious if there are some already discovered in newer builds. Viruses will probably exist for it but with the ability to run with the least amount of privileges will help reduce this risk. So then it's a matter of focusing on privilege escalation which is more a problem with applications than with operating systems.

Remotely I worry about Vista the most, it's new firewall is quite robust and hosts a great number of features not previously seen. How bulletproof this firewall is however remains to be seen. What about the underlying services? RPC is authenticated, how about thresholds to terminate connections with clients repeatedly failing logins and provide this service per port? I believe such a policy exists with Vista although I am admittedly unsure.

Don't get me wrong here though; I'm nervous about deploying Vista. Anytime you deploy something new there is inherent risk and a learning curve. This was the case when I moved from Netware 3.1 to Netware 4 and yes, even Netware 5. Windows NT to 2000? Same boat, Linux has been fairly consistent in that most of the stuff I learned to do in the mid-90s is still applicable now and by most I mean the vast majority.

So it sounds like we're mostly in agreement anyhow, that is quite excellent and without any name calling as well.

Oddly...

[Luthair]

They aren't trying to pay employees and maintain stock prices ....

Re:Slashdot...biased?! Never!

[Tweekster]

Have you not been paying attention to MS's product releases and their "increased security" which never amounts to any code being ANY more secure in any way shape or form.

That isnt bias, that is a reality.

It is history that creates expectations.
Apple does not have an extremely consistent pattern of making poorly secured products. People would be interest and expecting a high quality securely coded system from them. They have earned a good repuation. Microsoft has routinely released bug infested crap, there is no other way to put it. When they finally made some gains in the security dept (and not even that much of a gain in all honesty) they put in a new bunch of new code into an important section of the OS. Gee, is it that hard to realize that this could cause some problems.

And?

[ms1234]

This is news how? Was anybody suprised?

I don't remember where I read it but it suprise suprise costs more to develop new code than trying to maintain old code even though it may be in a horrible condition. The same seems to go for bugs and security holes.

Windows Vista still Rife with Insecure Code

[kpang]

Windows Vista still Rife with Insecure Code

See what happens when you constantly tease it? Now it's got an inferiority complex. You people should be ashamed.

Somewhat OT - keyboard shortcuts?

[PurifyYourMind]

Has anyone else noticed that Vista is stripping away some of the old keyboard shortcuts? Maybe it's just a beta thing, but I've noticed, for example... you used to be able to hit CTRL-ALT-DEL and then "T" for Task Manager. Now it seems you have to add at least an extra ALT (ALT-T) to get it. Also tabbing within Explorer windows is bringing up the menus for me instead of tabbing through panes. Especially for people that suffer from RSI--i.e. the mouse is best avoided--this is a real pain.

Re:Somewhat OT - keyboard shortcuts?

[Anonymous Coward]

Try CTRL-SHIFT-ESC, brings up task manager directly.

Re:Somewhat OT - keyboard shortcuts?

[Anonymous Coward]

I noticed this too. I decided it was beta incompleteness because this problem was really pervasive and as a windows programmer, I don't ever get around to doing this stuff til right before the release.

But this--in addition to loathing the new explorer--was why I decided I didnt give a crap about vista.. it was part of a general problem of it being significantly harder for me to use than XP or 2003. It was obvious that the power user wasnt on their radar at all. Nothing had become easier. Everything was buried behind more noobfriendly layers of mouse clicks.

Re:Somewhat OT - keyboard shortcuts?

[_Swank]

additionally, using the alt key is the standard (maybe not adhered to so well) on windows when accessing a mnemonic in a dialog. so forcing the alt-t from the ctl-alt-del screen is actually just fixing an accessibility/consistency issue.

Re:Somewhat OT - keyboard shortcuts?

[cnettel]

Not true, if the input focus is not in an edit field/list box/combo box, but rather a check box or the dialog itself, you can get away with just pressing the key. Bring up some file property dialog and press "R" for example (for the read-only attribute, if you're using the US English version of XP).

I got one...

[Dareth]

people should understand the ramifications of a virgin network stack

By the time the average person gets a shot at this network stack it will about as "virgin" as Madonna!

BTW, saw her in concert live in Chicago... kick some major ass she does!

And In Other News...

[fobbman]

...representatives of the US automotive insurance industry announced today that after careful analysis of 2007 model year vehicles that every last one of them could run into something and get damaged.

Things You Should Never Do

[Bill Kilgore]

Joel has addressed this technique long ago, and far away: http://www.joelonsoftware.com/articles/fog00000000 69.html

More Symantec Propoganda; a new stack is better

[postbigbang]

The old stuff had so many holes we stopped counting. Based on BSD stuff that had been around since the early '90s, Microsoft had to change the stacks.

The new provider modules are a step ahead of what they'd been using. This is what Symantec is mad about: being left out of the anti-virus and spyware game. Look to see that Microsoft also purchased Win/Sysinternals today to see what else motivates Symantec. Their cash cow, a flea-bitten operating system-- might just work for a change.

But I doubt it.

Re:More Symantec Propoganda; a new stack is better

[smokeslikeapoet]

Why do you think MS bought Sysinternals today? When you have several billion in the bank it's a lot easier to buy off your detractors then fix real problems. This got posted to /. in a different article but the two stories are interrelated.

Re:More Symantec Propoganda; a new stack is better

[drsmithy]

The old stuff had so many holes we stopped counting. Based on BSD stuff that had been around since the early '90s, Microsoft had to change the stacks.

The BSD-derived TCP/IP stack was replaced with Windows 2000.

They wouldn't want to make Vista too secure...

[thewils]

Otherwise there'd be no incentive to upgrade to the version that comes after, would there?

News....

[Anonymous Coward]

Am I the first to say, I thought Slashdot was about news?

Nice list, minor correction suggested

[Dareth]

COMPETENT:
Is still able to get work done EVEN if supervisor helps.

Emphasis on correction.

Emphasis

[tonyr1988]

Since January 2002, Microsoft has put a stronger emphasis on protecting PCs by attempting to implement stable, secure code into Windows XP and their new operating system.

Why haven't they been ALWAYS using stable, secure code?

They've been too busy with cool stuff.

NEWSFLASH!

[darcling]

This just in: Windows XP STILL rife with insecure code...

Smells like FUD

[Anonymous Coward]

Just look at the number of security defects between IIS 5/5.1 -> 6.0 after Microsoft essentially re-wrote IIS.

Microsoft has improved the reliability/security of their products with every iteration NT -> 2000 -> XP -> 2003 and there is nothing to suggest that trend won't continue with Vista.

Beta Crashes

[Bizzeh]

any un-supported beta software crashes alot.. ohh wait, thats because its beta software, not ment for general use, as it says when you use it...

Another reason...

[Kadin2048]

Marketing deadlines always trumps everything else, except for OpenBSD and maybe Linux kernels. Curiously, both have dominant but benevolent personalities in charge......

Also, both of them lack marketing departments.

Re:And? Here, have some r's (r r r)

[Anonymous Coward]

I doubt anyone was suprised, but some are probably surprised. As you may be now about your spelling. :)

It has been fixed

[CalTrumpet]

Microsoft has put a signifigant amount of work into creating USER/GDI messaging passing barriers between the new Vista integrity levels. This feature is called UIPI and mostly works in the betas.

BTW, almost no Microsoft written applications are still vulnerable to shatter attacks on XP. This is mostly an issue that still hits ISVs because they don't understand the problem.

Re:It has been fixed

[Anonymous Coward]

This is mostly an issue that still hits ISVs because they don't understand the problem.

Well! I feel safe already! thx.

Re:It has been fixed

[Compholio]

BTW, almost no Microsoft written applications are still vulnerable to shatter attacks on XP.

You can exploit a buffer overflow by changing the name of the stupid "Start" button! There are PLENTY of MS applications on XP that are vulnerable to this attack.

Re:It has been fixed

[Anonymous Coward]

I'm pretty sure the Start button isn't running as a high privledge window so what you just said has nothing to do with the Shatter attack. The flaw is indeed pretty big but a lot of people here are blowing it all out of proportion by claiming it's an "unfixable design flaw" even though the actual exploit depends on shoddy coding of high privledge software. The reality is windows is already screwed the moment hostile code is even allowed onto the computer.

Re:It has been fixed

[Anonymous Coward]

> The reality is windows is already screwed the moment hostile code is even allowed onto the computer.

Like a malicious web page exploiting an IE flaw?

Re:It has been fixed

[Anonymous Coward]

"mostly works"

How comforting.

Re:It has been fixed

[CalTrumpet]

"Exploits" that require you to run in the same user context as the attacked process are fun to impress people on Slashdot and not the point of shatter attacks, which are worthwhile in situations where a message handler is accepting messages from other user contexts. This was mostly a function of high-rights services popping GUIs onto the interactive user's desktop. That is much less likely these days, since most devlopers now know to have a separate process for GUI interaction that communicates back to the service through a better method than COM.

If you want to "exploit" your own explorer.exe, I would recommend using OpenProcess(). That'll be a lot faster.

The Windows messsaging model sucks, but its something that has been seriously attacked by Microsoft and will hopefully become less of an issue as other Win32 developers figure this out.

Re:It has been fixed

[LO0G]

So what. That's not an attack. You're saying that if you can run a program on the user's desktop, you can get another program, also running on the user's desktop in the same security context as your application to perform an operation.

Why ask the shell do perform an operation instead of simply performing it yourself? Anything explorer can do, your app can do.

So there's no security hole here.

The original shatter attack WAS a vulnerability in Windows - the WM_TIMER message allowed the sender of the message to specify an arbitrary location in the target app to execute (or something like that). That attack was closed a LONG time ago.

Nowadays, shatter attacks are caused when a privileged application (like a service) brings up UI on the application's desktop. Interestingly enough, this doesn't work for many scenarios (Fast User Switching, for example), but it didn't stop applications like from doing it.

On Vista, all system services run in a different session than the logged on user. As a result, all the UI of the service is completely inaccessible to the interactive user. Shatter attacks should be essentially impossible for Vista. However, fixing this security hole may break those apps that depend on the security hole.

Re:It has been fixed

[10101001 10101001]

A stupid question, but isn't IE7 supposed to be designed to run in a less-than-user privilege level? And if IE7 is run on the same desktop, don't all these shatter attacks basically mean anything that can exploit IE7 can easily go back to the user privilege level (this ignoring other issues with the IE7 less-than-user privilege level scheme)? Of course, Vista may have resolved this by putting IE7 in its own desktop or something. If not, all those "non-security vulnerabilities" all of a sudden have become security vulnerabilities.

Re:It has been fixed

[LO0G]

From what I've read at the UAC blog (http://blogs.msdn.com/uac) and the IE blog (http://blogs.msdn.com/ie), it's somewhat different.

IE and the desktop run in the same security context - in the worst case, IE can't do anything more than the user can. Since the user isn't running in a privileged account on Vista (unlike XP, users on Vista run with admin privileges turned off), IE still can't do anything that the user can't do. That eliminates shatter attacks.

But beyond that, IE runs in a special limited mode (User Interface Privilege Isolation, or UIPI) where even things that the normal user can do are restricted - code running in IE can't send window messages to higher integrity level windows (essentially every other window on the desktop). In addition, code running in IE effectively runs in a sandbox - can't write to the filesystem or the registry except for certain certain defined areas (this is the MIC feature mentioned in the IE blog post). See this Channel 9 video, or this IE blog post for more details on how IE's protected mode works.

Shatter attacks happen when code running in a restricted security context is allowed to send window messages to code running in highly privileged security context, the UIPI feature is explicitly designed to stop that. In addition to IE, when you run an application elevated (right click, select "Run as administrator"), the elevated application is run at a "high" UIPI mode. That means that normal apps running on the desktop cannot send window messages to those applications. Apps running on the desktop are also prohibited from opening processes at a higher UIPI mode for write access, which stops a different set of attacks. You can find info about UIPI here here.

So in Vista for an ActiveX control to issue a shatter attack that would exploit the system, you would need to have:
1) A hostile ActiveX running in the browser (so the attacker first has to convince the user to execute their code).
2) a vulnerability in UIPI that allows the ActiveX control to send a window message to a higher privileged application (like every other application running on the desktop).
3) An application running on the users desktop that is running with elevated privileges (to get an application running with elevated privileges requires a special action of the user), normally no application runs with elevated privileges.
4) A vulnerability in that application that would allow an attacker to cause the application to allow the attacker to execute arbitrary code in the application.

The bottom line is that there are at least 4 levels of defense-in-depth that would have to be breached for code running in IE to be execute a shatter attack.

There may be other ways of attacking the system that don't involve shatter attacks, but from what the Microsoft guys have said, I think that shatter attacks are gone.

Re:It has been fixed

[10101001 10101001]

IE and the desktop run in the same security context - in the worst case, IE can't do anything more than the user can.

Yea, that was my main point. Remote execution is bad for most user accounts, even if Microsoft is including things like port restrictions for users.

Since the user isn't running in a privileged account on Vista (unlike XP, users on Vista run with admin privileges turned off), IE still can't do anything that the user can't do. That eliminates shatter attacks.

While it's true that many XP users run as admin privilege (or at least Power User, since that's the default for XP Pro), it isn't the case that users are required to run as such (though my use of Win 2k has shown it's a pain in the ass at times). But in any case, the reduction of privilege of users isn't what eliminates the shatter attacks. It just mitigates the possible/probable damage if one can still manage a shatter attack.

Shatter attacks happen when code running in a restricted security context is allowed to send window messages to code running in highly privileged security context, the UIPI feature is explicitly designed to stop that.

Yea. It was only after making my post that I learned what UIPI included. So, it does seem that at least shatter attacks should be stopped in MS Vista.

So in Vista for an ActiveX control to issue a shatter attack that would exploit the system, you would need to have:

1) A hostile ActiveX running in the browser (so the attacker first has to convince the user to execute their code).

Or for there to be an exploit that automatically runs the ActiveX control.

2) a vulnerability in UIPI that allows the ActiveX control to send a window message to a higher privileged application (like every other application running on the desktop).

True. UIPI blocks shatter attacks, so you'd have to circumvent that, which assumedly will be quite difficult.

3) An application running on the users desktop that is running with elevated privileges (to get an application running with elevated privileges requires a special action of the user), normally no application runs with elevated privileges.

Actually, if you managed to get to step 3, you've already commited a shatter attack. The user (and their desktop) has higher privilege than IE7. And for a lot of the worm activities that would occur, a regular user is more than enough privilege to do what is needed.

4) A vulnerability in that application that would allow an attacker to cause the application to allow the attacker to execute arbitrary code in the application.

It sounds like a lot of XP already allows this. If you can manage to usurp UIPI, almost every component on the desktop is probably a viable target to cause execution of arbitrary code at the user's privilege level.

The bottom line is that there are at least 4 levels of defense-in-depth that would have to be breached for code running in IE to be execute a shatter attack.

Actually, only three. And it sounds like step four is already done. And given how IE7 is specifically given a lower privilege than other apps, it can be assumed that there will probably be bugs in IE7 that allow it to be attacked in the future. So, it's really UIPI that is the key. One can only hope that it does well what it says it does.

There may be other ways of attacking the system that don't involve shatter attacks, but from what the Microsoft guys have said, I think that shatter attacks are gone.

It's quite possible. Shatter attacks may very well be impossible with UIPI. It all comes down to, I'd imagine, just how well UIPI works.

Except this should be perfect.

[kinglink]

This isn't Beta code, this is a public beta, the current name for what was originally called "Gamma". Aka, the stuff right before release.

This isn't a problem if the problem you find is a minor thing where if you click on a button it crashes only if you have a ATI card that was made in June 2005.

This is a problem if the majority of code, that has been rewritten from near scratch has major flaws that would take another full rewrite to get rid of (or years of critical updates). Vista is supposed to be the reinvention of Microsoft security, however this isn't secure. This isn't a "we're still adding features" problem this is a critical flaw at the core of the system.

Re:Except this should be perfect.

[man_of_mr_e]

Ummm.. no. This is a beta.

The terms Alpha, Beta, and Gamma used to mean this:

Alpha: Feature incomplete code
Beta: Feature complete, but still buggy
Gamma: We think we have all the bugs, but let's do some wider testing anyways to be sure

Gamma's most closely map to Release Candidates, which Beta 2 of Vista is not.

Beta's have gone through a lot of change since the invention of iterative development models. Now you can have parts of the code "feature complete" before other parts are. Betas are now issued during various feature complete milestones rather than when the entire product is feature complete.

Re:Except this should be perfect.

[Jugalator]

Aka, the stuff right before release.

No, that's release candidates. At least if you're talking Microsoft.

And in a related story...

[daskrabs]

sky still blue... grass still green... more at 11...

Abuse of Moderation

[drinkypoo]

Another way of saying it
(Score:0, Troll)
by Aqua_boy17 (962670) on 07-18-06 10:37 (#15738032)

and shows how it will be a long way before it is ready for the mainstream

In other words, wait until at least SP2 is released before even thinking about upgrading. That's how I read it anyway.

Hey, you're not supposed to mod people "troll" when you don't agree with what they say. It means they don't agree with what they say. And anyone who actually has experience maintaining windows knows that it's not worth a flying fuck until at LEAST the first service pack, usually the second. It was true of NT4, Win2k, and XP. Why shouldn't it be true of Vista?

Re:Abuse of Moderation

[Aqua_boy17]

Thanks for having my back and you're dead on. SQL Server also had some serious flaws (slammer anyone?) until SP3 was released and I could go on.

One of the largest parts of my job as a sys admin is planning and budgeting for upgrades. With this news, I figure I have at least a good 3 years before I have to seriously think about Vista. Someone's too quick on the Troll mod button today. All my hard earned good karma going up in smoke (sobs). :p

Three things...

[multimediavt]

1. Fuck CNet and News.com
2. Fuck Symantec
3. ROFLMFAO @ Microsoft for rewriting Windows as Vista and STILL not getting it right...

Well, no it isn't.

[jd]

The network stacks that exist for, say, BSD and Linux are rather more convoluted than I would have thought necessary. I believe they could be made a lot simpler and faster, without sacrificing one iota of capability, flexibility or configurability. In fact, there may well be areas where reducing complexity will increase flexibility. That happens.

It should be very easy to build a networking stack for Windows (or any other OS) that is bullet-proof, compact and fast, because it's not a particularly complex piece of logic. There are lots of rules, sure, but each rule within itself is very simple. That makes it possible to test each decsion-making component directly and individually, along with the rule that component applies. Because you know what a well-formed packet looks like - that is defined by the applicable RFC(s) - you can also do comprehensive bottom-up integrated testing.

Add in one of the multitude of profiling packages that will work with kernel-level code, and it should be child's play to make the code not only correct but damn fast.

Could Microsoft do this? Of course they could. They might act the part, but that doesn't make them idiots. In general, anyway. How long it would take and how much manpower it would take depends on how correct they'd want the code. If you want to guarantee fewer than N errors per M lines of code, you can do it, but halving N will more than double the effort required. Can you guarantee no errors at all? Yes. The networking stack is simple enough that you can prove it complete, sufficient and correct. It would cost Microsoft far less to prove their network stack totally bug-free than they're owing the EU in fines. Personally, I feel that producing better code would have been a wiser investment, but that's their decision to make.

could Linux developers do this? Again, sure. There are many tools for profiling and analyzing the Linux networking stack, and suitable test harnesses shouldn't be that hard to write. If kernel hackers had more of a liking for testing, Linux networking bugs should be all but extinct within a year. As things stand, the cleanup is OK but not enough to seriously endanger the bug population. I would like to see a concerted effort to clean up the code rigorously, but I do recognize that much of the code is "good enough" for most developers to be more interested in expanding the capabilities than polishing the code to perfection.

Re:Well, no it isn't.

[ronabop]

The reason why parent may (?) be misled is that networking stacks are not merely simple pieces of logic. Certainly there are some general rules... these are the very easy parts to program. In RFC terminology, these are the "shall" parts. Every packet that doesn't meet those rules, "should" (theoretically) be tossed.

Where networking stacks get really ugly is not the mandatory, properly implemented, "shall" parts, it's the "may" parts, and the "shall" parts that have been misused, abused, or ignored, and the burden of handling pieces which *cannot* be broken into easily testable discrete units.

For an analogy about why networking stacks are so complex for something that seems deceptively simple, it's fairly easy for most people on /. to recognize a normal, well formed, email address of foo@example.com. That's quite easy to write a short regular expression for. (Go try it, I'll wait). All done? If your regular expression is under 200 characters or so, it's broken on a vast number of perfectly valid email addresses, or allowing through a vast number of illegal addresses. Here's a *still* partially broken regular expression (it can't handle inline comments) for, oh, "simply validating email addresses" based on the defined logic found in only *one* RFC. Not so simple with email, and it's not so simple with networking.

Oh, and by the way, networking code has to perform at absolute breakneck speeds, so you need to optimize the heck out of implementing those "simple" rules, too... and while it's certainly *possible* to validate every single bit, in every single packet, against a protocol's defined ruleset, I can pretty much guarantee you that you will rapidly find yourself consuming 100% of an average desktop's CPU before a 10Mbs stream can be completely checked, let alone used.

Re:Well, no it isn't.

[asuffield]

The network stacks that exist for, say, BSD and Linux are rather more convoluted than I would have thought necessary. I believe they could be made a lot simpler and faster, without sacrificing one iota of capability, flexibility or configurability.

Unless you actually cite specific examples, this is just handwaving. Personally I find it unlikely.

Modded down... surprising

[Alkrun]

"I'm shocked, shocked to find that gambling is going on in here!"

Funny how a post questioning the tone of the article as being slightly biased gets modded down. I'm sure if the tables were turned and I was asking about the harsh tone of a Linux article on /. all would be well in the world.

Ah Slashdot, how I love you.

It's part of the bigger picture

[postbigbang]

There are a myriad companies that Microsoft has bought, then put to good use. Some were then thrown off a cliff (like McAfee does/did with Network General and OilChange) while others made them smarter. They need the brains. And they need a new authentication methodology, a new networking stack, and a new registry protection mechanism not made of tissue paper. That doesn't mean they'll get it. So many people have blown up Vista (yes, I know it's not RC+ yet) that Microsoft must be rattled to their very core (yes, Bill-- you, you crummy half-assed programmer) before they'll believe their customers. It's a classic case of Sales Department Rules (Ballmer) and everything else drools. Hit the sales department in the wallet, and things change. Look for a big change from Microsoft soon when they report that XP sales are down and that Windows 2003 server's recent sales peak has now hit the skids, and the X360's are costing a fortune. Mark these words.

Hasta La Vista Windows Vista

[Orion Blastar]

Microsoft will never work out the bugs in order to meet the deadline. We may never see Windows Vista unless it is released with the bugs.

What are the odds of the following things happening before Windows Vista is released?

ReActOS 1.0 is released.

Windows XP SP3 is released.

IBM releases the OS/2 source code to open source.

Duke Nuke'em Forever is released.

The Linux based Indrema game console is released.

Enron comes back from the dead.

SCO makes OpenLinux their main OS and drops the Linux lawsuits.

Mac OSX takes over marketshare from Windows and gains 80% of the market.

George W. Bush pulls US troops out of Iraq and Afghanistan and signs a peace treaty with the middle-east, and cuts military spending to pay for more welfare programs, and lets the UN police nation states while the USA sits out of foreign policy.

Jesus returns, resserects John and George for a Beatles Reunion Tour.

Re:Slashdot...biased?! Never!

[dedazo]

That isnt bias, that is a reality.

Unfortunately for your point, it is bias if it comes from Symantec. It is bias if it is applied to a beta product. It is bias if the Slashdork headline reads "Windows Vista Still Rife with Insecure Code" where if this was Symantec talking about another OS it would read "Symantec claims Linux Rife with Insecure Code".

Bias. Not hard to spot. You just have to look.

"Building from the ground up" months before ship?

[dpbsmith]

TFA says "For maintenance purposes and to improve performance and stability, the company is building much of Vista's networking technology from the ground up."

IS building? Not "HAS built?" Months before ship they are not just mopping up, they are still in the process of designing the network stack?

I realize this is reading a lot into the verb tense chosen by a reporter... and maybe it's reporter so clueless that he doesn't understand what's meant by "performing a build..." but that is still astonishing language to me.

Only in slashdot

[Anonymous Coward]

Its true, this is the more idiotic place to read news in. A lot of the GREAT linux news, and when a company that is in the verge to going bankrupcy cause of vista says that the OS is insecure, the news get its place here...
LOL

News at 11, OSs have exploits!

[Anonymous Coward]

Who would've guessed it. Sendmail, anyone?

In other news

[McGiraf]

Universe still full of atoms ...

"tried and tested"?

[The MAZZTer]

I think they mean "tried, tested, exploited, patched, exploited again, patched again, broken, fixed, obfuscated, exploited and patched yet again".

Wait... windows is insecure?

[Mr. Freeman]

How is this news? Seriously. Yes, they dumped their "tried and tested code", but judging from the amount of updates I get each month for windows I wouldn't think that their "tried and tested code" is any better than anything they've written since.

Didn't we see this from McAfee regarding linux?

[alpinerod]

Do I recall a long time ago that McAfee came out saying that because linux was open-source, it was less secure, hence they saw a "need" for commercial McAfee antivirus programs for linux "real soon"? This was before the .com bust, but I'm not sure I've seen a McAfee Antivirus: Linux edition yet. Not to say that Vista will be as secure as linux, just pointing out the relative "value" of such statements from antivirus companies.

Insecure By Design: IPV6 Tunneling

[Prototerm]

"To help transition to the new protocol and for peer-to-peer networking features, Microsoft has functionality called IPv6 tunneling in Vista. This functionality could expose PCs that otherwise would be invisible behind a firewall, Symantec said."

Once again, Microsoft creates vulnerabilities in its operating system by adding new functionality that the majority of the world is not asking for.

Don't get me wrong, I think rebuilding the code is necessary in a big program like Windows from time to time. It allows for a cleaner, more comprehensible design. But adding features that most people -- users and managers alike -- neither expect nor want, is a recipe for trouble.

While it might not be a good practice, many people secure their Windows computer by hiding it behind a NAT router and hardware firewall, without an anti-virus or software firewall. If a standard feature in Vista allows hackers to get around this protection, I can see security problems becoming worse, not better.

I'm not even going to consider Vista until at least SP1 comes out. I might even wait until SP2 if things look really messy!

Re:Insecure By Design: IPV6 Tunneling

[KiloByte]

"To help transition to the new protocol and for peer-to-peer networking features, Microsoft has functionality called IPv6 tunneling in Vista. This functionality could expose PCs that otherwise would be invisible behind a firewall, Symantec said."
Once again, Microsoft creates vulnerabilities in its operating system by adding new functionality that the majority of the world is not asking for.

As someone experienced with netfilter-fu, let me tell you:
IPv4 is the root of all evil. Not the basic design of it, which is fine -- what is wrong is NAT and related problems.
Switching from IPv4 to IPv6 is like switching from all itty bitty charsets to utf-8. An investment in upgrading your software that pays off in a silver bullet to most interchange problems.

A simple setup can be easily made secure, a complex one will rarely ever be. Any non-trivial IPv4 setup is by definition complex. Change it to IPv6 and suddenly all you need to do is filtering unwanted traffic.

Re:Insecure By Design: IPV6 Tunneling

[Viol8]

"Once again, Microsoft creates vulnerabilities in its operating system by adding new functionality that the majority of the world is not asking for"

The majority of which world? The USA or the rest of it? Take a trip to the far east
and you'll find that IP6 use is booming (unfortunately , can't stand it myself , way
too complex to be administered properly by any normal human) so if MS want to stay
afloat in that market they need to get IP6 working properly.

Critical Reading Skills Lacking In Tech-Mongers

[FeSceptre]

Getting off-track seems to be the proposed penultimate goal of most.
Here are the critical points of the article, for those lacking the ability to distinguish:
1)"Vista's networking technology will be less stable, at least in the short run."
Whoa, short run, imagine that. The intelligence to scrap an outdated stack-based system in order to produce an -ultimately- more stable networking system on Windows. Unbelievable.
2)"'We expect many of our results to be invalidated by changes made prior to its public release,' the researchers wrote."
See point number one; research the terminology "short run".

C'mon guys. Stop pussy-footing around with the ball when you have already lost it.

Symantic Bites.

[Anonymous Coward]

Lets see, I'm going to care what a company that makes Norton Disk Damager says? I can't remember the last time I saw the symantic suite of applications actually fix anything. It always generates problems, not fixes them.

I always loved how their crash protection app could actually make applications crash back on Win95/98.

Some Microsoft software is unstable, all of Symantic's is. (though, hey, ghost enterprise actually does work properly sometimes.)

A long ways away from mainstream...hmmm

[Mulielo]

Secure code from microsoft is a long ways away from being ready for the mainstream. "User Friendly" implementation of Linux is a long ways away from the desktop. Sounds like a lose lose situation....

Who modded this informative?

[Anonymous Coward]

No one is talking about graphics, stability, gadgets in the sidebar, file copies etc... We are talking about security here, or Vista's lack of it.

they're still doing it, btw

[emagery]

I'm STILL Getting uncouth behavior from netflix (i know they had a class aciton lawsuit they lost over the same once before)... namely, I watch a lot of SERIES... anime, scifi, etc... and they have, a good 9 times out of 10, send the following volue 2 or more days before the preceeding one... i.e., the first to arrive is volume 2... then acouple days later, volume 1... then 4 and 3... etc. Even though the processing station for returns is just an hour down the road, sometimes they register recv'd the next day, sometimes it takes then 2-3 days, which is rediculous. I like the service, but I don't think they learned their lesson from the last time they got caught screwing with deliveries in an attempt to make you keep discs longer and expand their profit margin.

Gimme 5 minutes

[rodgster]

Gimme 5 minutes

Not counting boot time and I'll have your computers doing whatever you want them to do.

Re:Slashdot...biased?! Never!

[Overly Critical Guy]

Well, maybe you should take a read about the Win32 shatter attack and get back with us.

Link to the paper

[Anonymous Coward]

Here's a link to the paper:

http://www.symantec.com/enterprise/security_respon se/whitepapers.jsp

42 pages, by Tim Newsham and Jim Hoagland

Re:Link to the paper

[Anonymous Coward]

Paper, with blog post introducing it:
http://www.symantec.com/enterprise/security_respon se/weblog/2006/07/post.html

Maybe I'm oversimplifying,

[gettingbraver]

but, it seems to me that security is one of the most, if not the most important parts of running a network. The way that I understand networking is that if it is not secured properly, it is only a matter of time before a major crash, or the software and/or hardware conflict with each other and lead to endless problems with one or the other, as opposed to a crash. Or am I missing something?

Re:Maybe I'm oversimplifying,

[nbannerman]

I've been accused before (on here at least) of being slightly over-zealous when it comes to network security. I tend to lock machines down to prevent users installing their own software. Then again, I am responsible for student coursework and student records, some of which we have to keep for 20 years under government guidelines. I have a duty to protect that data; I'm wise to most the current threats, but Vista will (in my opinion) be a minefield to start with.

Re:Maybe I'm oversimplifying,

[Vancorps]

Seems to me proper precautions like various methods of security have decreased the pressures this causes. Why do I care if a machine on the network can send out mass mail when the machine isn't allowed outbound 25? Yes its bad security to let things run around but that means the crash result doesn't happen. Instead of the whole network going down you have one machine which has its software stripped and restored in less than 20 minutes all 100% remote site.

Security is very important and should remain in the spotlight for Vista but when was the last time a mass mailing worm took out networks that were properly protected with only basic appliances? I don't put a Linux box directly on the Internet just like I don't put a Windows box on without a firewall in between. It's just good practice, I've screwed up configurations on just about every platform at some point in my life and the additional layer of security helps to make sure that my little oops doesn't turn into a major catastrophe.

So yes, we agree security is one of the most important parts of running a network but I'm still left wondering since another poster planted the seed. What else has people in cold sweats over deploying Vista?

Symantec biting the hand the feeds them?

[grolschie]

Surely Microsoft's constant supply of security woes is a major factor that keeps Symantec in business? You'd think they'd shut-up until after the final OS is released, and then plug their own security product range.

Then again, Symantec products are just as buggy, so maybe the title should read "People in glasshouses...." :-)

How to secure windows

[Sathias]

Interesting how when code is in Windows, it is unsecure. As soon as they throw it out, it is "tried and tested". Maybe they should throw out all of Vista and our security problems will be solved!

Of course it should be noted that Symantec have a vested interest in reporting Vista to be unsecure.

That new stack...

[GeorgeFitch3]

That new Vista networking stack better handle The Internet tubes better than XP's!
http://www.comedycentral/motherload/index.jhtml?ml _video=71653&ml_collection=&ml_gateway=&ml_comedia n=none&ml_context=show

Re:That new stack...

[GeorgeFitch3]

I had to reset my Comcast connection with a PowerBall; let's try that link again...

http://www.comedycentral.com/motherload/player.jht ml?ml_video=71653&ml_collection=&ml_gateway=&ml_co median=&ml_runtime=&ml_context=show&ml_origin_url= /shows/the_daily_show/videos/headlines/index.jhtml &ml_playlist=&lnk=&is_large=true/

FUD?

[Jugalator]

Windows Vista still Rife with Insecure Code

So, point me to the place in the article which says something is still rife with insecure code?

Well, of course, there'll be securite holes in Vista too, like most other OS's, but I'm not sure that's what the article means? It seems someone somewhere have come to the conclusion that there are still major problems with it and I just, darned as much as I try, can't find the place in the article.

It seems to me Symantec only speculates, as Vista will have a new network stack?

But then, Symantec themselves say:

"We're not saying that Vista's network stack is going to be inherently insecure when it is released," Oliver Friedrichs, director of emerging technologies at Symantec Security Response, said in an interview Monday.

So, which is it, and is the article just spun like this on Slashdot because it's Slashdot?

Re:FUD?

[Anonymous Coward]

So, point me to the place in the article which says something is still rife with insecure code?

Oh, I don't know... how about waaaayyy down in the SECOND SENTENCE of tfa?

They found several security bugs and determined that Vista's networking technology will be less stable, at least in the short run, than Windows XP's, the report said.

Now get back to work, I suspect that your Redmond overlords are disappointed in you.

definition of 'virgin network stack'

[Anonymous Coward]

Definition of virgin network stack:

* See Slashdot ;-)

Vista & VISTA dictionary definitions

[Tandoori Haggis]

vista -

1. a view, esp through a narrow avenue of trees, buildings, etc , or such a pasage or avenue itself.
2. a comprehensive mental view of a distant time or a lengthy series of events.

VISTA -

acronym for Volunteers in Service to America; an organisation of volunteers established by the Federal government to assist the poor.

Source - The Collins English Dictionary (1986)

Corner cases?

[DrXym]

Are corner cases worse than edge cases?

Re:Corner cases?

[mapinguari]

Obviously, a corner case is where two edge cases intersect.

Trustworthy Computing

[HTH NE1]

[T]he code is 'complete with new corner cases and defects' in the networking component.... This latest report from Symantec brings attention to Microsoft's trustworthy computing campaign, and shows how it will be a long way before it is ready for the mainstream.

Considering whose Trust the Computing is really intended to be Worthy of(*), I welcome the defects. They will be avenues for me to reassert my rightful control.

(*) Hint: not you, and sorry about the dangling preposition.

No problem, it comes with Windows Defender

[VGfort]

Fighter of Spyware, Guardian of Viruses, Defender of Evi.... well uh.... hmmm...

What else is new ?

[Sohil]

Windows is a severely buggy, insecure platform. Please tell me something I don't know.

Ready for the mainstream?

[Anonymous Coward]

It will be a long, long time before any release of Microsoft Windows is ready for the mainstream. Its still an untidy hack of mangled code, put together by children and monkeys with little or no hope of ever being able to co-operate to produce a useful piece of software. Sure, a lot of computers have Microsoft Windows installed, but it is by no means "ready"; it just happens to be there. I have people who have been using Microsoft Windows for a number of years, and still can't get to grips with it. Before it is ready, as well as making it more stable and secure, they also have to make it easier to use.

Cthulhu.

[jd]

You are correct that the overall logic is complicated, but in the end ANY series of decisions can be reduced to an n-ary decision tree (which you can provably test, one decision at a time) which can then be folded up into a graph (ie: more than one path exists between point A and point B, for at least one pair of points). If the tree was validated as correct, and the graph is simply an optimized representation of the same structure, the graph must also be correct.

Note: I'm not talking about a rules engine or expert system shell - which would be painfully slow and very hard to follow, but a complete writing out of the rules in such a way that one code block can only be entered by exactly one path through the decisions.

So what you do is you start with something that is valid but slow, then optimize it without changing the overall logic. This is considered "good programming" practice anyway, as optimizing too early can lead to sub-optimal code because you hide what may be become better possibilities. (It's slow because we've not considered the sequence of decisions, we've not considered early break-outs and we've not considered the frequency of differing cases. However, because it's flattened, it'll be faster than most of the procedural code out there. The biggest problem is that it would, well, be big. Very big.)

Now we get onto malformed packets, optional parts, and the like. Yes, this does make things a lot more complicated. The optional parts less so, as those can still be represented by a well-defined set of decisions. It's the malformed packets, packets that are not strictly inside the specification but should be allowed anyway, that are the problem. You can't apply if/then logic if you don't know what the 'if' should be, or necessarily which 'then' is the most applicable. The best I can see here is to split into four types of malformed packet. The first needs to be done early, the other three should be treated as rogue optimizations.

1. if (x) then (branch)
2. if (x | x') then (since this is always true, eliminate if and else)
3. if (x) then (automatically accept)
4. if (x) then (automatically reject)

The example with e-mail is well-taken. Yes, there are MANY ways to write the same e-mail address, if you include ! notation, multiple levels of @, comments, etc. Again, the overall complexity is provably very high, but the individual rules for handling each case encountered are all relatively simple, particularly if the complexity is caused by nesting, as you don't need to worry about anything at a layer deeper than you need to parse to deliver the mail. Parsing the address to find what you need, though, is (overall) a complex task that requires a fair amount of processing.

With packet validation, again the point that processing needs to be blazingly fast is well-taken. It does need to be blazingly fast. 100 MB/s cards are the standard, with gigabit moving into the mainstream and ten gigabit on the fringes. Any stack that chokes on the standard isn't going to be of much use to anyone, and ideally you'd want it to run fine on the standard-to-be. Validation is expensive, so you want to apply as little as you can, but many errors downstream are likely to be at least as expensive as the validation that would have prevented them.

Assuming we are applying the method of validate early/optimize late, then once we have validated the code, we would want to optimize it as much as possible. Now, code size isn't that important here - smaller code is generally more structured and will therefore often run slower. We're wanting here to make it run as fast as possible. The first thing to do is to decide if we're going to have to allow certain malformed paths. If we're allowing A and A' to have identical results then A can be optmized out entirely. You only need the test if the paths for A and A' differ.

You also want to reorder the decisions. If A' is a common case that MUST lead to

Sounds to me like...

[Phraghg]

Symantec is trying to carve up Vista so that they don't go the way of Iomega. I hate to defend Microsoft, but according to the link

"However, these were all fixed by Microsoft in build 5384, the version of the operating system that was publicly released in May as Beta 2."

That's not to say the code is totally secure but that that seems to be a very good sign.

Don't forget to question your sources. If I was Symantec, I would be worried that in the case that Windows Vista is secure, and does come with a good build in antivirus that my revenue would go down the drain. For those of you who have ever used recent versions of Norton Antivirus or Internet Security, you know what I'm talking about. The widely used Norton software is honestly rather bloated and probably presents a security risk of its own. As an IT technician, I get a lot of requests from workers to remove Norton because Norton causes an alarming measurable slowdown in system performance.

Given that all the bugs found by Symantec were fixed in build 5384 and the fact that Vista still has about 5-6 months before it goes gold (at the earliest), any attempts to speculate on the security of Vista is just that -- pure speculation.

What about the LSPs..

[2phar]

A new TCP/IP stack might mean a whole new set of support problems as all those third party antivirus and spyware apps have to start again ironing out compatibilty problems with their LSPs. Oh what joy.

a product from microsoft with bugs

[Anonymous Coward]

a product from microsoft with bugs, like this is news. whats next? sky == blue, water == wet, nerds == virgins.

No credibility...

[Anonymous Coward]

This article/post is one example of why slashdot has so little credibilty outside of it's own little Microsoft bashing audience...

Comment removed

[account_deleted]

Comment removed based on user account deletion

A rewrite can be a good thing

[Anonymous Coward]

Just look at Mac OS.

But what about Linux?

[mcrbids]

There are many posts here decrying the idea of writing again, you should refactor, etc. And for the most part, I agree.

But if rewriting is nearly always a bad idea, why is Linux so successful? GNU/Linux is a complete rewrite of the UNIX O/S, including its compiler, utilities, shell, etc. and it's worked out well enough that the GNU tools have become largely the standard of the industry!

Obviously, the poster-child of the F/OSS movement is a good argument for an occasional rewrite or two...

Eyecandy.

[jotaeleemeese]

The discussion is about security kid, we all know that MSV is going to be shinny, have new colorful icons and have a nice wallpaper.

Straw man

[ravenlock]

The point of "rewriting UNIX" in Linux was not about rewriting, but about free software. The UNIX vendors of the time would certainly not give their products away for free, so taking their existing code was not an option.