Slashdot Mirror
Microsoft Port 25 interviews Miguel de Icaza
Ben Galliart writes "Microsoft's Port 25 blog, the voice of MS Linux Labs and a spin-off from the MS Channel 9 blog, has an interview with Miguel de Icaza where they discuss the Gnome and Mono projects. It is a nice change of pace to see Microsoft go from attacking Novell and Linux to interviewing a Novell employee about a Linux desktop system. Port 25 has come under some fire since they can not always be trusted. Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor and a security guide attacking Red Hat for not providing security updates for Red Hat v9 despite that Red Hat ended support back in 2004. They have also released a password synchronization daemon for Red Hat, AIX, HPUX and Solaris that must run as root and makes several calls to strcpy() (which violates Microsoft's guidelines for doing secure coding)."
What the fuck kind of insane summary is that? Even for Slashdot, that steps over the line.
miguel is the liebermann of open source
Just goto http://port25.technet.com/ and click the link on the front page.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
Miguel makes no secret of his admiration for Microsoft and is really a MSFT-employee-wannabe. All his talks I've ever heard were about how UNIX sucks and how Microsoft got the desktop right.
Yawn...
Maybe there is some validity in saying they (Port 25) are untrusted, but what excuse is it that Redhat ceased updates for v9 in 2004, a mere year after the product was released (March 31 2003). Seriously, is a single year of updates good enough? I think they actually have a valid point on that one at least, a year isnt long enough to even be considered stable server software in my book.
I was reading the death of red hat support slashdot comments from a few years ago. I think it's interesting that so many people thought that would be the death of red hat. In fact, they are stronger than ever. Even with strong competition from large corporate entities that weren't in the linux game a few years ago, red hat remains the market leader.
If an officer ever threatens to taze you, say you have a pacemaker.
From the article:
Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor
I'd be curious to hear what vendor the article author thinks is doing more to improve security than Microsoft if this statement is to be decried as FUD, and what kind of metrics/data support this. Amount of exploits patched? Amount of money spent on security?
I mean, even if you think Windows is one giant yawning security hole, that really only says that they have the most room for improvement. I'd be surprised if they're not patching the most holes, affecting the largest number of users, and spending the most money on security -- even if the results are often sad.
Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor
Which vendors are doing more to improve their security?
Given what they had to start with, I think it's very difficult to claim anybody's done what they've accomplished between 95 and XP SP2. You tell me one other vendor that's gone so far as using tools like authentication and WGA to combat the worst offenders of security -- the users themselves? Linux users, Mac users, even the *BSD user is free to boot their operating systems without the slightest arbitrary challenge to their right to do so and from there go on to face any number of potential security issues; but with Windows, you need only upgrade your CD drive emulator a handful of times or use Windows Update as directed to find yourself relieved of the concerns users of lesser operating systems face.
They had the most potential with regards to security and they've finally met it, and I say kudos.
I never vote for anyone. I always vote against.
-- W.C. Fields
At the very least, they should be using Port 465 (SMTP over SSL/TLS). It's no wonder they feel insecure, using plain-test. Honestly!
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Exactly. You don't usually hand the MVP and the Most Improved trophies to the same person...
501 Not Implemented
Even my old university has now upgraded their labs to FC5, and they are so cheap that they actually asked if there was a discount on a GPL upgrade license.
Think of the Children; Sleep with your Sister
what vendor the article author thinks is doing more to improve security than Microsoft if this statement is to be decried as FUD
Just about every linux/bsd distro and probably apple too on the desktop.
and what kind of metrics/data support this. Amount of exploits patched?
The problem with this mindset is you think it's okay that the code that is increasingly responsible for running more things that make a country productive is never seen and can't be reviewed except for poking at it in a willy-nilly blackbox style. As a matter of principal I don't think it's okay. At all.
Amount of money spent on security?
If I were Warren Buffet I could spend two hundred million dollars on security for a fundamentally insecure OS by buying advertisement and story space telling people it's really secure. And they would believe it. I could set up a site called port23 and look like I'm reaching out to the IT pro. Meanwhile BSD and *nix security is insanely robust at pennies (tenths of pennies?) on the dollar with code that everyone can see and test.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Can someone explain to me why strcpy is insecure? No sarcasm here, I really would like to know.
Please let us know, in the summary, when an interview is a video file. Some of us don't have time at work to watch videos (today, actually, I've been busy watching specific videos for work, and trying to clean them up so they don't look like crap, at which I have failed) and would like to know before we have to click down into them - especially when you can't just click the link, and have to visit the site, because the primary article link is malformed.
This is one of the crappiest story submissions I've seen in a long time.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
"claiming Microsoft is doing more to improve security than any other vendor"
That is not FUD, they started so far behind everybody else that they have to do more than anybody else just to keep Windows running
I'm working with Microsoft right now, and I don't think I've ever met a firm that takes security so seriously as they do when it comes to "normal" software, especially in the field I work in. So that claim might not be as much FUD as some would like it to be.
I use strcpy. If you know for a fact that the string is terminated then it's overkill to use anything else. For example the below is perfectly legit:
char buf[6];
strcpy(buf, "hello");
In fact, to truly protect yourself from invalid input you frequently need to write a state machine style input parser. It's the parser that ensures all strings are properly terminated which would mean all downstream copies could be performed safely with strcpy.
It's far more important to understand *why* strcpy should not be used. Then you'll know when you *can* use it.
If you're going to convince people you're all about security, you don't do "port23". You do "port22".
If anyone's confused, take a look at /etc/services on your local *nix. Failing that, take a look at the IANA assigned port numbers reference.
It's not what you say, it's the way you say it. The statement may be true but it's misleading. It's like saying that 25% of companies would not consider using Linux. Sounds bad for Linux, right? But really it means 75% of companies would considering using Linux. So even though their statement is true, it's still a deliberate attempt at FUD.
I'll probably be modded down for this...
I imagine those infinite apes running in circles and shouting "patch! patch! patch!". Seems you would count that as doing *a lot* to improve security, even if the result is not improved at all?
Can you think of a sillier thing to criticize MSFT about? Really?
I looked at (some) of the code. They do a malloc(strlen(foo)+1), and, if it succeeds, they do a strcpy() of foo. THERE IS NO VOODOO MAGIC IN STRNCPY TO MAKE IT SAFER IN THIS SITUATION.
Really. There isn't.
That's "Mr. Soulless Automaton" to you, Bub.
The problem with this mindset is you think it's okay that the code that is increasingly responsible for running more things that make a country productive is never seen and can't be reviewed except for poking at it in a willy-nilly blackbox style. As a matter of principal I don't think it's okay. At all.
The problem with your mindset is that it's only correct if security is always the most important thing. It's not. The world doesn't work that way.
Microsoft always plays a losing game of catch-up to *nix in the security department, and *nix damn near always plays a losing game of catch-up to MS in the usability department. (There are, of course, many more considerations besides those two.) There are things the open source paradigm consistently does better, and there are things the commercial closed-source paradigm consistently does better. That's reality.
I believe it's spelled Kodos.
"It could be at 25% would not consider Linux, 33% don't know what Linux is, 30% don't know if they would consider it or not, and 2% would consider using Linux."
Why would only 2% consider Linux? I think that's just more FUD. It's higher than that. You are just making an example but disguising it as a fact and hoping people won't notice. You could have picked any number. Why 2%?
FUD, FUD, FUD! Even Anonymous Coward is FUDing. Slashdot is really going downhill...
Slashdot has too much FUD. 99.999% of people wouldn't consider reading Slashdot.
I'll probably be modded down for this...
Isn't that like "Jews for Jesus," "Rock Against Drugs," or "McDonald's New Healthy Menu?"
Port 25 has on occasion put out FUD such as claiming Microsoft is doing more to improve security than any other vendor and...
I'm sorry, how does this qualify as "fear", "uncertainty" or "doubt?" Maybe FUD means something else to you? That sounds more like CCS, "calming", "certainty", and "surety" than FUD. I'm not saying their statements are true, simply that it's not FUD.
Oh, and please hand in your geek card at the door.
This sig is intentionally left blank
What is interesting, but not really surprising, is that Microsoft chose to replace the unsafe functions such as strcpy with their own safe variants with names like safe_strcpy (though I can't remember the exact name, it's something like that). They could have just recommended people used already-existing functions such as strncpy or strlcpy, instead of adding yet another incompatibility obstacle that must be surmounted when porting software from/to the Windows platform...
Unless I am mistaken, strcpy_s() and the other 'safe' variants are part of and ISO standard. Check out https://buildsecurityin.us-cert.gov/daisy/bsi/arti cles/knowledge/coding/314.html
The thing is even the wiki article gets this wrong.
I think Bill is waiting for an apology for your rant :)
Based on upvotes, Ageism is the only "-ism" Slashdotters care about and think isn't SJW
found it interesting Microsoft is using MP3 encoding for this and not Windows Media... hmm...
So all the negatives of strncpy with none of the positives.
It might be better to restrict the length copied to match the destination rather than the source...
Even if you did that right, you didn't null terminate after the call, and even if you added that extra bit of code you'd be wasting time setting chunks of bytes to 0 because strncpy is retarded.
strncpy(buf, input, strlen(input));
Or even:
(works in the original coder's example because he declares buf in the same basic block).
Not only does this approach avoid calling any functions and may well produce faster code, but if your string is longer than your buffer, it'll zero-fill it for you automatically. One caveat: if your buffer is exactly the length of the string, it won't get zero-terminated and the compiler won't warn you, but habits like:
...will warn you of that.
I would note that, while people who were using 7.3, way back when they still have access to third party support, while people who paid good money for windows ME and 2000 are gonna be completely SOL if they need something done, and Microsoft refuses to do it.
There's been a coupl of times when I dug out the sources to a Red Hat RPM, added functionality that dealt with a problem that a customer was having, and offered the changes back to Red Hat. Anybody can do that.... Unlike Israel who almost had to go to war to get Microsoft to (ahem) 'graciously offer' to fix the Hebrew support in Microsoft's OSX version of Office.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
So why the fuck are they doing a bytecode language?
The rest of your post is equally trollish, but I just thought there was a point to be made there.
Don't thank God, thank a doctor!
I think he is being sarcastic guys. Strlen(input) is an overrun in itself.
helo
501 Syntactically invalid HELO argument(s)
hello
500 unrecognized command
hey gnome boy
500 unrecognized command
sod off
500-unrecognized command
500 Too many syntax or protocol errors
Connection closed by foreign host.
Does someone have a link to a transcription?
"So why the fuck are they doing a bytecode language?" Er, cause they want to pretend they're Java? Fact is since M$ hasn't bothered to provide a .net runtime even for the Mac (Ok i understand not porting VS) indicates to me that they're not bothering to compete with Java since they lost anyway.
There is .NET runtime/framework for Mac but nobody has a clue what they will use it for.
At least me...
...Microsoft Windows NT version 5.5; Microsoft Toaster version 4.5; BSD network stack version 0.5b; gnuutils version 2.1; Microsoft Bob sp3 version 2.356287; Screensaver directory C:/Windahz/; ADMINISTRATOR password: rock0u7; BZFlag version 2.1; VirtualDancer version 2.4b; stupid troll jpardey version 1.2; PHP.NET version 1.2.867.5309...
I have freaks! I did something right...
doing an interview is about asking questions and letting the person you interview talk.
I get annoyed a lot by stuff like this where the interviewer comments all the time or
talks about his own agenda rather than giving the spotlight to the person interviewed.
I wouldn't agree that Linux is insanely robust - today I'm upgrading my kernel becuase of security flaws in the one I'm currently running. Again. Then, almost every time I type "yum upgrade" I get updated packages with security fixes in them. So linux is insanely secure? no way, just stop with the bigoted posts ok.
Back to the article comment - they said MS was doing th emost to improve security. Well, fair enough - they have made great inroads on fixing loads of stuff, it is not a big priority at MS, so yes, I think I can safely say that "MS is doing more to improve security than any other company out there", simply becuase they're improving their product the most (you could say Linux doesn't need to be improved very much)
Java's just a less virulent disease. The cure is Python.
Please, for the good of Humanity, vote Obama.
Microsoft's PREfast stuff lets you mark up code to say how the parameters to functions work. If you accidentally put a "5" instead of "6" as your array size, the compiler would notice a violation of the rules and issue a warning. It won't pick up everything (see "halting problem") but at least it'll find the obvious things.
There are performance reasons to use strcpy.
I personally feel that strcpy on a buffer allocated by the same function is okay, but doing this across functions is bad because someone else (or you years from now) modifying your code won't know to do that.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Yes, you are absolutely right IMO.
GNUStep is definately one of those frameworks where on several occasions I've looked at it and thought "Oh, what could have been."
Qt4 has drawn my interest, but I fell flat on my behind trying to get it compiled on OS X.
Why does it matter that they can, if they won't? In open source, it would matter, that's why we like Mono. In proprietary stuff, all that matters is what they want to do, not what they can do that they won't and we can't.
And you still haven't answered my question.
Don't thank God, thank a doctor!
There's Mono, and then there's Rotor. I don't know about the Shared Source licensing on Rotor, and Mono still has rough edges.
But certainly, Microsoft isn't planning to release it for the Mac.
Don't thank God, thank a doctor!
So even a non developer end user like me laughs to claims that .NET will crush Java. I mean come on, it even runs Opera Mini my cellphone right now.
I have read some military mags and I got completely amazed at Java's success there too. I mean targeting, radar systems all run java etc.