Slashdot Mirror
Microsoft Port 25 interviews Miguel de Icaza
Ben Galliart writes "Microsoft's Port 25 blog, the voice of MS Linux Labs and a spin-off from the MS Channel 9 blog, has an interview with Miguel de Icaza where they discuss the Gnome and Mono projects. It is a nice change of pace to see Microsoft go from attacking Novell and Linux to interviewing a Novell employee about a Linux desktop system. Port 25 has come under some fire since they can not always be trusted. Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor and a security guide attacking Red Hat for not providing security updates for Red Hat v9 despite that Red Hat ended support back in 2004. They have also released a password synchronization daemon for Red Hat, AIX, HPUX and Solaris that must run as root and makes several calls to strcpy() (which violates Microsoft's guidelines for doing secure coding)."
What the fuck kind of insane summary is that? Even for Slashdot, that steps over the line.
miguel is the liebermann of open source
Just goto http://port25.technet.com/ and click the link on the front page.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
Miguel makes no secret of his admiration for Microsoft and is really a MSFT-employee-wannabe. All his talks I've ever heard were about how UNIX sucks and how Microsoft got the desktop right.
Yawn...
Maybe there is some validity in saying they (Port 25) are untrusted, but what excuse is it that Redhat ceased updates for v9 in 2004, a mere year after the product was released (March 31 2003). Seriously, is a single year of updates good enough? I think they actually have a valid point on that one at least, a year isnt long enough to even be considered stable server software in my book.
I was reading the death of red hat support slashdot comments from a few years ago. I think it's interesting that so many people thought that would be the death of red hat. In fact, they are stronger than ever. Even with strong competition from large corporate entities that weren't in the linux game a few years ago, red hat remains the market leader.
If an officer ever threatens to taze you, say you have a pacemaker.
Blog of gate 25 of Microsoft, of voice of the laboratories of MRS Linux and of unexpected advantage of MRS some blog 9, an interview with Miguel de Icaza has, where they discuss mono gnomes and the projects. It is a nice change of the step to go seeing to from of Microsoft to to take Novell and Linux with the Interview of an employee from Novell over a system of the office from Linux into attack. Gate 25 concerned a certain fire, there it not to be always formed can confidence. Gate 25 has occasionally for enteindre FUD such as Microsoft marks more to state, in order to improve security, and a leader of security the red hat tackling the each possible other supplier, around updates of security for the red hat v9 despite this support for order of not placing by red hat after 2004 terminated. They also released a Daemon of the Synchrounisierung of the password for the red hat, AIX, the HPUX and Solaris, like root to work must and demand several strcpy() on (that the guidelines of Microsoft hurts to form around blocked coding).
From the article:
Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor
I'd be curious to hear what vendor the article author thinks is doing more to improve security than Microsoft if this statement is to be decried as FUD, and what kind of metrics/data support this. Amount of exploits patched? Amount of money spent on security?
I mean, even if you think Windows is one giant yawning security hole, that really only says that they have the most room for improvement. I'd be surprised if they're not patching the most holes, affecting the largest number of users, and spending the most money on security -- even if the results are often sad.
Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor
Which vendors are doing more to improve their security?
Given what they had to start with, I think it's very difficult to claim anybody's done what they've accomplished between 95 and XP SP2. You tell me one other vendor that's gone so far as using tools like authentication and WGA to combat the worst offenders of security -- the users themselves? Linux users, Mac users, even the *BSD user is free to boot their operating systems without the slightest arbitrary challenge to their right to do so and from there go on to face any number of potential security issues; but with Windows, you need only upgrade your CD drive emulator a handful of times or use Windows Update as directed to find yourself relieved of the concerns users of lesser operating systems face.
They had the most potential with regards to security and they've finally met it, and I say kudos.
I never vote for anyone. I always vote against.
-- W.C. Fields
It is a nice change of pace to see Microsoft go from attacking Novell and Linux to interviewing a Novell employee about a ...
Microsoft platform, implemented under the name Mono.
What a surprise.
At the very least, they should be using Port 465 (SMTP over SSL/TLS). It's no wonder they feel insecure, using plain-test. Honestly!
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Exactly. You don't usually hand the MVP and the Most Improved trophies to the same person...
501 Not Implemented
On of the POP or IMAP prottocols would have seemed much more friendly. Using the SMTP port seems like all they want is to tell us what to think and couldn't care less about us. Probably a Freudian slip. Seriously, someone at Microsoft must have at least had some clue as to what this meant. Then again, mabye not.
Even my old university has now upgraded their labs to FC5, and they are so cheap that they actually asked if there was a discount on a GPL upgrade license.
Think of the Children; Sleep with your Sister
what vendor the article author thinks is doing more to improve security than Microsoft if this statement is to be decried as FUD
Just about every linux/bsd distro and probably apple too on the desktop.
and what kind of metrics/data support this. Amount of exploits patched?
The problem with this mindset is you think it's okay that the code that is increasingly responsible for running more things that make a country productive is never seen and can't be reviewed except for poking at it in a willy-nilly blackbox style. As a matter of principal I don't think it's okay. At all.
Amount of money spent on security?
If I were Warren Buffet I could spend two hundred million dollars on security for a fundamentally insecure OS by buying advertisement and story space telling people it's really secure. And they would believe it. I could set up a site called port23 and look like I'm reaching out to the IT pro. Meanwhile BSD and *nix security is insanely robust at pennies (tenths of pennies?) on the dollar with code that everyone can see and test.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Can someone explain to me why strcpy is insecure? No sarcasm here, I really would like to know.
Please let us know, in the summary, when an interview is a video file. Some of us don't have time at work to watch videos (today, actually, I've been busy watching specific videos for work, and trying to clean them up so they don't look like crap, at which I have failed) and would like to know before we have to click down into them - especially when you can't just click the link, and have to visit the site, because the primary article link is malformed.
This is one of the crappiest story submissions I've seen in a long time.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
"claiming Microsoft is doing more to improve security than any other vendor"
That is not FUD, they started so far behind everybody else that they have to do more than anybody else just to keep Windows running
I'm working with Microsoft right now, and I don't think I've ever met a firm that takes security so seriously as they do when it comes to "normal" software, especially in the field I work in. So that claim might not be as much FUD as some would like it to be.
I use strcpy. If you know for a fact that the string is terminated then it's overkill to use anything else. For example the below is perfectly legit:
char buf[6];
strcpy(buf, "hello");
In fact, to truly protect yourself from invalid input you frequently need to write a state machine style input parser. It's the parser that ensures all strings are properly terminated which would mean all downstream copies could be performed safely with strcpy.
It's far more important to understand *why* strcpy should not be used. Then you'll know when you *can* use it.
Note that Mono has better cross-platform support and a cross-platform roadmap that Microsoft totally lacks.
-
With Sparc, S390, and Power support, Mono is more promising than Microsoft's CLI implementation for high-end computing platforms.
- And with ARM available now and MIPS soon to come, Mono is more promising than Microsoft's for embedded devices.
High-end servers and embedded systems are areas where Microsoft simply doesn't have the experience to do well. If they want C# to have a chance against C and Java in these areas, they need Mono.If you're going to convince people you're all about security, you don't do "port23". You do "port22".
If anyone's confused, take a look at /etc/services on your local *nix. Failing that, take a look at the IANA assigned port numbers reference.
It's not what you say, it's the way you say it. The statement may be true but it's misleading. It's like saying that 25% of companies would not consider using Linux. Sounds bad for Linux, right? But really it means 75% of companies would considering using Linux. So even though their statement is true, it's still a deliberate attempt at FUD.
I'll probably be modded down for this...
Getting modded Flamebait was a little harsh, but I think you're not seeing the bigger picture if you think the main benefit of programming in .NET is easy interop with the Windows API. Web applications, even large ones will typically make little use of the Windows API. Now imagine that you, a developer that works under you, a developer friend, etc. has developed such a web application in .NET. How sweet is it that you can run this application on Linux without significant effort?
If Linux's popularity grows as is continually predicted this migration ability might become very valuable indeed.
Taken from http://cis.stvincent.edu/swd/professional.html:
I imagine those infinite apes running in circles and shouting "patch! patch! patch!". Seems you would count that as doing *a lot* to improve security, even if the result is not improved at all?
Can you think of a sillier thing to criticize MSFT about? Really?
I looked at (some) of the code. They do a malloc(strlen(foo)+1), and, if it succeeds, they do a strcpy() of foo. THERE IS NO VOODOO MAGIC IN STRNCPY TO MAKE IT SAFER IN THIS SITUATION.
Really. There isn't.
That's "Mr. Soulless Automaton" to you, Bub.
Let's not generalize to much, that depends entirely on the flavor of UNIX/Linux you are talking about. OS.X for example is a UNIX flavor and if anything it's desktop environment is even more idiot proof than Windows and there are a few Linux distributions out there that do a pretty good job at shielding the user from having to use his/her brain.
The teeming masses don't even know the Windows CLI exists and those that do are scared to death of it and that includes a frightening proportion of Microsoft's legions of MCSE ninjas.
The problem with this mindset is you think it's okay that the code that is increasingly responsible for running more things that make a country productive is never seen and can't be reviewed except for poking at it in a willy-nilly blackbox style. As a matter of principal I don't think it's okay. At all.
The problem with your mindset is that it's only correct if security is always the most important thing. It's not. The world doesn't work that way.
Microsoft always plays a losing game of catch-up to *nix in the security department, and *nix damn near always plays a losing game of catch-up to MS in the usability department. (There are, of course, many more considerations besides those two.) There are things the open source paradigm consistently does better, and there are things the commercial closed-source paradigm consistently does better. That's reality.
I believe it's spelled Kodos.
"It could be at 25% would not consider Linux, 33% don't know what Linux is, 30% don't know if they would consider it or not, and 2% would consider using Linux."
Why would only 2% consider Linux? I think that's just more FUD. It's higher than that. You are just making an example but disguising it as a fact and hoping people won't notice. You could have picked any number. Why 2%?
FUD, FUD, FUD! Even Anonymous Coward is FUDing. Slashdot is really going downhill...
Slashdot has too much FUD. 99.999% of people wouldn't consider reading Slashdot.
I'll probably be modded down for this...
I am not sure if this makes a difference for you but there is a podcast of the interview:
e icaza.mp3
http://port25.technet.com/videos/podcasts/migueld
Isn't that like "Jews for Jesus," "Rock Against Drugs," or "McDonald's New Healthy Menu?"
Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor and...
I'm sorry, how does this qualify as "fear", "uncertainty" or "doubt?" Maybe FUD means something else to you? That sounds more like CCS, "calming", "certainty", and "surety" than FUD. I'm not saying their statements are true, simply that it's not FUD.
strncpy(buf, input, strlen(input));
What is interesting, but not really surprising, is that Microsoft chose to replace the unsafe functions such as strcpy with their own safe variants with names like safe_strcpy (though I can't remember the exact name, it's something like that). They could have just recommended people used already-existing functions such as strncpy or strlcpy, instead of adding yet another incompatibility obstacle that must be surmounted when porting software from/to the Windows platform...
Unless I am mistaken, strcpy_s() and the other 'safe' variants are part of and ISO standard. Check out https://buildsecurityin.us-cert.gov/daisy/bsi/arti cles/knowledge/coding/314.html
The thing is even the wiki article gets this wrong.
I think Bill is waiting for an apology for your rant :)
Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
It looks like the issues with MS Single Sign-On daemon has been simplifed for purposes of the summary.
The problems I see with MS ssod for *nix is:
1) They state that StrSafe and other coding practices *MUST* be used for Windows related products and then violate those rules for their *nix based code
2) They run *ALL* of the ssod code as root despite the fact that some would work in a priviledge sepration style enviroment
3) They run all the code with *FULL* root priviledge and never call libcap
4) They never call chroot (which goes along with never dropping root priviledges)
5) They claim "all rights reserved" so no one else can try to apply priviledge sepration or other security coding methods with this code
While your example does show some care in the specific case toward trying to address security, are you sure enough about all the rest of the code that trying to apply other security methods to it is unwarrented?
found it interesting Microsoft is using MP3 encoding for this and not Windows Media... hmm...
Is a shorter than short article like this one worth a headline/argument/troll on /. ? Well, Miguel doesn't seem happy with having a conference in a hallway, I can understand that. What else ?
Have a nice day.
Microsoft always plays a losing game of catch-up to *nix in the security department, and *nix damn near always plays a losing game of catch-up to MS in the usability department.
The exception being OS X, which is more usable and more secure.
Statements must be assumed to be false unless there is evidence that they are true--that evidence should then be examined to see if it proves the statement or not. The burden of evidence is on Microsoft/Port25/you, not everyone else.
That reminds me of talking about Iraq with my uncle. I said "There's not one shred of evidence that Iraq was involved in 9/11" to which he responded, "Oh yeah? Can you prove to me that they weren't?" My point about there not being any evidence that Canada wasn't involved either went totally over his head.
You can't prove the negative, folks. The burden of proof is always on the affirmative statement. If Port 25 made bold, unsubstantiated statements about Microsoft's security compared to other vendors (or statements substantiated by documents they fabricated themselves with the intent of supporting this conclusion, regardless of the facts), then they are indeed the Colin Powell of the software world. That's all there is to it.
I would note that, while people who were using 7.3, way back when they still have access to third party support, while people who paid good money for windows ME and 2000 are gonna be completely SOL if they need something done, and Microsoft refuses to do it.
There's been a coupl of times when I dug out the sources to a Red Hat RPM, added functionality that dealt with a problem that a customer was having, and offered the changes back to Red Hat. Anybody can do that.... Unlike Israel who almost had to go to war to get Microsoft to (ahem) 'graciously offer' to fix the Hebrew support in Microsoft's OSX version of Office.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Why is it that every site these days has to post things as sound files or movies?? I want to read my news, damnit!
Some people change their minds others dont. Some companies learn others dont. Some never will.
helo
501 Syntactically invalid HELO argument(s)
hello
500 unrecognized command
hey gnome boy
500 unrecognized command
sod off
500-unrecognized command
500 Too many syntax or protocol errors
Connection closed by foreign host.
Does someone have a link to a transcription?
Server Error in '/' Application. The resource cannot be found. Description: HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable. Please review the following URL and make sure that it is spelled correctly. Requested Url: /archive/2006/08/11/Let_2700_s-talk-Mono_3A00_--Sa m-interviews-Miguel-de-Icaza.aspx
Version Information: Microsoft .NET Framework Version:1.1.4322.2300; ASP.NET Version:1.1.4322.2300
You already got the explanation to your question.
SO here is Microsoft going to contribute to *nix with NO LESS than a password synchronization daemon and write an exploitable buffer overflow dead in the fucking code.
Well oooops, me bad!
Can these dickheads even help themselves OR are they just trying to drag *nix down to their level?
"Never ascribe to malice that which can be adequately explained by incompetence"
Lets just make the defining statement now and be done with it:
"Any and all Microsoft code shall be quarantined until inspected, disected and tested in its entirety by experts in every applicable field not in the employ of Microsoft"
It would be easier and certainly safer to not use ANY Microsoft code AT ALL.
That is my recommendation and I will sleep well having made it.
Microsoft should go back to what they do best; litigation and fucking their own customers.
Doesn't Michael sound like Triumph the Insult dog?
It's a decent interview but, I couldn't help but laugh out loud with him sounding so much like the dog.
doing an interview is about asking questions and letting the person you interview talk.
I get annoyed a lot by stuff like this where the interviewer comments all the time or
talks about his own agenda rather than giving the spotlight to the person interviewed.
"Without GNOME, QT might not have been open sourced in the first place. "
Ummm, no. I'd say it was the usual incessant whining of the GPLers which you still see to this day (Waaa Tivo!) Most KDErs (the only ones in direct competition) hold Gnome in contempt.
So, your "big picture" for Mono is that it facilitates migration of web app from Windows to Linux? The migration will still have to jump through several hurdles: migration of any native hookup, version/implementation differences between Mono and .Net, and any surrounding services (DBMS, messaging, transaction, etc.). Except for the simplest cases, it's likely easier to re-implement the app in Java (or other similar OO system) using services better supported on the target platform. Besides, Java *already* provides a *better* portability between Windows and Linux (and Mac), especially for web app.
.Net on linux, and that only partially, for the unusual cases where you need to migrate some web apps from Windows to Linux, and the work may not even save much/any work vs. alternative porting methods in the end, is a waste.
All that work to replicate
I wouldn't agree that Linux is insanely robust - today I'm upgrading my kernel becuase of security flaws in the one I'm currently running. Again. Then, almost every time I type "yum upgrade" I get updated packages with security fixes in them. So linux is insanely secure? no way, just stop with the bigoted posts ok.
Back to the article comment - they said MS was doing th emost to improve security. Well, fair enough - they have made great inroads on fixing loads of stuff, it is not a big priority at MS, so yes, I think I can safely say that "MS is doing more to improve security than any other company out there", simply becuase they're improving their product the most (you could say Linux doesn't need to be improved very much)
Yay anecdotal evidence. That trumps all!
Java's just a less virulent disease. The cure is Python.
Please, for the good of Humanity, vote Obama.
Microsoft's PREfast stuff lets you mark up code to say how the parameters to functions work. If you accidentally put a "5" instead of "6" as your array size, the compiler would notice a violation of the rules and issue a warning. It won't pick up everything (see "halting problem") but at least it'll find the obvious things.
There are performance reasons to use strcpy.
I personally feel that strcpy on a buffer allocated by the same function is okay, but doing this across functions is bad because someone else (or you years from now) modifying your code won't know to do that.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Yes, you are absolutely right IMO.
GNUStep is definately one of those frameworks where on several occasions I've looked at it and thought "Oh, what could have been."
Qt4 has drawn my interest, but I fell flat on my behind trying to get it compiled on OS X.