OpenOffice.org Security 'Insufficient'

InfoWorldMike writes "IDG News Service's Robert McMillan reports that researchers at French Ministry of Defense say vulnerabilities with open source office suite OpenOffice.org may rival those of Microsoft's version. With Microsoft's Office suite now being targeted by hackers, researchers at the French Ministry of Defense say users of the OpenOffice.org software may be at even greater risk from computer viruses. "The general security of OpenOffice is insufficient," the researchers wrote in a paper entitled In-depth analysis of the viral threats with OpenOffice.org documents. "This suite is up to now still vulnerable to many potential malware attacks," they wrote. The OpenOffice.org team has already fixed a software bug discovered by the researchers, and the two groups are in discussions about how to improve the overall security of the software. "The one real flaw in the programming logic has been fixed," said Louis Suarez-Potts, an OpenOffice.org community manager. "The others are theoretical.""

Comments

"theoretical"

[dmiller]

It is disappointing to see a free software project dismissing threats as "theoretical". Today's "theoretical" vulnerabilities are tomorrow's exploits. Worse, the article hints that these threats are fundamental design flaws - the developers should be working to fix these and not issuing PR speak to cover them.

Re:"theoretical"

[morgan_greywolf]

The PDF presentation that the group gave was en Français, but I got the gist. I'd post a translation, but my French is a little rusty. ;) Anyway, they seem to be saying that because OOo doesn't support authentication certificates for documents or macros, and because OOo has an API that allows you to program in several different languages (Python, VBScript, Perl, C++, etc.) and that OOo has no solid verifiable security model, that the suite is fundamentally insecure.

I can see where some of this gets dismissed as "theoretical" -- for instance, while OOo has such an API, this isn't any more secure or insecure than the fact that other applications, like MySQL, for instance, have a similarly flexible API. Ditto for Microsoft Office or any operating system.

The information on authentication certificates seems a little outdated -- OOo 2.0 supports digital signatures for documents and macros and even security settings that prevent macros from being run that are not signed. I think that as for a solid, verifiable security model, OOo 2.0 seems to have one based on digital signatures.

Re:"theoretical"

[portmapper]

It is disappointing to see a free software project dismissing threats as "theoretical". Today's "theoretical" vulnerabilities are tomorrow's exploits. Worse, the article hints that these threats are fundamental design flaws - the developers should be working to fix these and not issuing PR speak to cover them.

OpenOffice is quite buggy, as porting it to OpenBSD shows that OpenOffice has many stupid bugs

Re:"theoretical"

[0racle]

"It's only a theory."

Re:"theoretical"

[Sikmaz]

The sentence above that also says:
""This suite is up to now still vulnerable to many potential malware attacks," they wrote. The OpenOffice.org team has already fixed a software bug discovered by the researchers, and the two groups are in discussions about how to improve the overall security of the software."

So the important issue was fixed and now they are discussing how to improve security overall, it sounds to me like they handled it perfectly.

Re:"theoretical"

[Red Alastor]

I speak French, let me translate.

1. "Official" MS Office competitor.
2. Share of the market rising.
3. Cheap but...
4. What about the real security of OpenOffice ?
5. Viral analysis by proof of concept
6. Numerous integrated programming languages : script shell, VBScript, Python, Perl, Asp, Java.
7. Rich macro developing.
8. Numerous existing hijackable execution points
9. No protection mecanism for macros
10. zip format is makes virus penetration easy.
11. Macro security is easy to bypass. "Trusted" folders are defined. Any macro placed in those folders is by definition, trusted.
12. Document signature do not really consider macros. Bypassing possibilities
13. Macros can be linked to events or services.
14. Other mechanisms : macro chaining, hypertext links, inter-application execution, OLE
15. Many mechanisms are usable for an infection
16. All known viral techniques known for Microsoft Office can be translated under OpenOffice.org
17. Every kind of infection is doable. (Infection and auto-reproduction)
18. Globaly, OpenOffice's suite is a bigger infection risk than Microsoft's suite.
19. No real security concepts.
20. Many functional viral roots were made as proof-of-concept
21. Infection successful no matter the security setting of the user.
22. Some senarii can act without alerting the user in any way (scenarii is a stupid plural in French too but they used it in the original)

Then they go on to explain (still in powerpoint bullets) that they managed to write a macro that sends an e-mail with an attached file which then executed C code which modified dicOOo.

And they conclude that infection risk under OOo is MAXIMAL and its use should be discouraged for security reasons.

Re:"theoretical"

[Red Alastor]

I'm replying to my own post but the other was the translation and this is what I think of it. I think it's bullshit.

Point number 10, what the fuck ? zip is just a comression format. Point number 11, trusted folders are defined by YOU. So most people don't even have them. But if it's convenient to you to define a folder where all macros are trusted how is it different from accepting every macro while you open the document ? It must be quite convenient for developers who want to test their macros. Most other points ? Way too vague to mean anything. Beside, if the danger for an office suite which isn't really attacked right now is "maximal", how should be classify MS Office ?

And their famous proof-of-concept... they won't even tell us how they got it to run. My guess is that they defined a trusted folder and put it in.

Until they reveal that, this document is worthless. Like that other proof-of-concept from I don't remember which AV vendor. Their macro (if you accepted it) would download a porn picture from the net and put it in the document. I guess it's much more dangerous than sending documents with the picture already in.

Re:"theoretical"

[Anonymous Coward]

zip format is makes virus penetration easy.

So, Word, with its undocumented format that third parties have great difficulty in writing and reading is soooo much more secure.

Right.

Re:"theoretical"

[Anonymous Coward]

No, no, no... if you can unzip faster, you can penetrate faster. And if you happen to have a virus...

Re:"theoretical"

[colmore]

Someone needs to explain this to me. Why do office suites need these features? For what are they used? I've never worked in a big office that actually uses the macro and scripting features of productivity software.

Can intra-office communication not be done via RTF? Why do we need document formats that rival PDF and layout-software fileformats in complexity?

It seems like you could avoid all of this using a smaller array of utilities and custom scripts for office productivity, it just strikes me as impossible to create a scriptable, monolithic, document engine that won't have some sort of security hole on some platform. It seems like a cluster of smaller, more agile tools is the way to go.

Re:"theoretical"

[Marcion]

It seems to be OpenOffice on Windows. I have 64bit Linux, behind an Selinux hardened firewall - nothing is able to exploit office software from over the network. I send out documents in PDF format. People likewise send me docs in PDF or text (or Word arrr). If I was sent an ODF then I would probably open it with Abiword, is the macro going to exploit that, what about Koffice?

Not being part of the software monoculture has enough security benefits that I doubt it would ever pay to attack us when there are enough Windows zombies out there to get first.

Re:"theoretical"

[TheRaven64]

I've never worked in a big office that actually uses the macro and scripting features of productivity software.

I worked for a little while for a (very large) organisation that made heavy use of scripting in Office. Every single type of document had an official corporate style. It had a (scripted) wizard that went through and added the sections you want, automatically filled in various bits of it, etc. After five minutes with the wizard you would have a multi-page skeleton document which would then just need text adding.

If I had been implementing the system from scratch, I would have made it intranet-based, with a TeX backend for generating PDFs, but they had an enormous amount invested in the it, and a team working on updating and fixing the templates. It was sometimes a problem ensuring that you had the right version installed (which is why I would go for a client-server model), but even that could probably be fixed by scripting (simply have the wizard check it was the latest version and fetch / install it if now).

Re:"theoretical"

[miro f]

the developers should be working to fix these and not issuing PR speak to cover them.

actually, I think the best option is to do both, and that is probably what the OO.o team are doing (at least, that's what I hope the OO.o team are doing.) Just because they're downplaying the importance of a security issue doesn't mean they're not fixing it.

Of course, it doesn't mean they are either

Re:"theoretical"

[mspohr]

TFA said they were working to fix them in cooperation with French security experts. They were not "dismissed" but rather they have started to patch them.

Re:"theoretical"

[Skater]

Nothing like using the font "Comic Sans MS" to convey "BSD Is Great" to me. That seems like an especially bad travesty - I don't care for it when I see it in Windows, but using it in a BSD-related presentation has to be part of some diabolical scheme to discredit BSD.

Re:"theoretical"

[Red Alastor]

I took this crap in the original document. Scenarii is as stupid in French as virii is in English so I left it intact.

Re:"theoretical"

[Anonymous Coward]

Some companies use office productivity software to produce reports. That in itself is not an issue since the company could generate reports as PDF, HTML, or any number of other formats. However, once a user had a report, they would frequently need to modify the report before sending it to a client. The company may also need to generate the report in real time on the client machine.

When dealing with reports, macros are a great place to store the code. You can create a very generic system to pull the data back from a stored procedure and pass it into a code template. If you need to change code for the template, you need only test and deploy a new template rather than an entire application.

Also, since the company already has licenses for the office software, they might was well reuse the license rather than purchase a license for a reporting system.

Re:"theoretical"

[imroy]

From that "presentation":

...amazing it works on linux (as usual, by luck)

What ever made people think the OpenBSD guys are a bunch of arrogant fucks?

Re:"theoretical"

[legallyillegal]

shh!

Re:"theoretical"

[imroy]

I can't understand why office suites and their formats need macros, at least when they're embedded in the document. I think it's quite simple: don't mix data and code. If you need macros/scripts/whatever, put them into another file (and format) separate from the document. That way it's easier to sort out which is which e.g email filters.

Re:"theoretical"

[Planesdragon]

I think it's quite simple: don't mix data and code.

Data and code are fundamentally linked. You can put an artificial barrier between them, but that doesn't do much if you lose functionality by doing so.

Let's say that I've got an Excel Sheet (I do) that needs to call a custom function that Excel doesn't ship with (I do, as well). While it would, in theory, be possible to move that code to a seperate macro in a "code" file somewhere, I'd still have to find a way to let anyone who opens my document get at that code file.

MS Office et al have scripting built right in because a good portion of what a good office does is make tools to simplify their work, and those tools are usually so simple that they only make sense to write down at the user level.

FWIW, the french are right. OOo is a security risk--just like a user is. Presume that they might introduce a horrible silicon-melting virus, and plan your security accordingly.

Re:"theoretical"

[swillden]

If I had been implementing the system from scratch, I would have made it intranet-based, with a TeX backend for generating PDFs

If I'd been building it, for use with OOo, I'd have given it a backend that generated the OpenDocument data without using any macros within the application. The great thing about having a fully documented, open format like OpenDocument is that you can easily generate and manipulate documents with any tool that's convenient.

Of course, the same is true of TeX, but if you generate OpenDocument format, then you can use OOo to edit and maintain it. In most environments the users are more likely to be comfortable with that than with TeX.

I think the openness of the format actually eliminates many of the reasons that macros are so important in the Microsoft Office world.

Re:"theoretical"

[imroy]

Hmm, I guess I wasn't talking about simple functions when I said "don't mix data and code". They should be OK. The problem comes with the stuff that allows applications to be written, and especially with the ability of "hooking" into internal functionality of the office program. That's where you get self-replicating worms happening. I still think that sort of stuff should be external to the office program and file format. The thing is that MS makes Visual Basic and then uses "Visual Basic for Applications" in Office. Why not just remove VBA from Office and use external VB programs that can access the office functionality via COM. Then users would never have to worry about opening documents and having odd things happen.

Re:"theoretical"

[GodWasAnAlien]

Yes, if the macro can modify, edit, or destroy _this_ document, then someone can send you whatever corrupt documents they wish. They could not set global settings, or operate outside the document. No problem, really.

If a macro lets you write documents that can change other documents, your system, or the outside internet, the the program is as broken as ms office.

Re:"theoretical"

[bangenge]

that's why you have to use protection... ;)

Re:"theoretical"

[Anonymous Coward]

Whoa there Microsoft Fanboi! You are shooting too fast (your gun is still in the holster, and your foot an easy target). I've seen several theoretical security bulletins for my system over the years. Not any has become a virus. Why you ask. Well, on my system, rm / will erase all the files on my computer (if I'm logged in as administrator), so theoretically, "rm /" is a virus and a dangerous one. I could theoretically get a letter, telling me to run the instruction. Theoretically the letter then is a virus. If I issue the command, I have to be administrator in order for it to run. I have to run it myself (although I could put it into a program), and either execute the original instructions or program by myself. Theoretically its a virus. Practically, its something I avoid. To conclude, I submit the old adage: In theory, there is no difference between theory and practice. In practice, there is.

Re:"theoretical"

[cyber-vandal]

I have and do. I wish people would stop saying "I don't use it so it must be pointless"; macros are very useful and save me a lot of time. Excel doesn't come with the be all and end all of functions; sometimes a user-defined one is necessary. Word doesn't allow for every possible permutation; sometimes a little program is needed. Custom scripts would be good too, I hate having to load Word to generate a document, but when the document is already open and being edited a macro makes more sense than an external program taking over your app (which is surely a security risk as well).

Re:"theoretical"

[tganter]

Also theoretically, 640k are enough for anybody.

Re:"theoretical"

[jimicus]

Someone needs to explain this to me. Why do office suites need these features? For what are they used? I've never worked in a big office that actually uses the macro and scripting features of productivity software.

What generally happens is this (and I'd expect it to be much the same for most of Office's macro features):

Department A perceives a need for a complicated spreadsheet or a small database. It's not really complicated enough to go through the "pass it up the line and set up a project in conjunction with IT" routine, and in a lot of companies IT is viewed with a certain degree of suspicion. However, it would still be nice to have.

Then a person in department A with an interest in IT but with no formal IT training or experience (we'll call him Fred) hears of this need. Fred thinks to himself "I could do that! Easy!", and a couple of weeks later Department A his its database, courtesy of Fred. Over the coming months, Fred adds features and fixes bugs as they come up.

While all of this is going on, nobody outside of Department A even knows that the database exists. It's not until Fred leaves the company two years later and someone in Department A suddenly discovers a hitherto unknown bug in his database (which has since become critical to Dept. A's function) that IT gets to hear about it - when the person who discovers the bug calls the helpdesk and demands support.

Re:"theoretical"

[dmiller]

You are displaying your ignorance (or are just trolling) - porting software exposes bugs. Most frequently these bugs are precisely things that work "by luck" on the platform on which the software originally ran because they depend on false assumptions. As the software is ported to another platform, the false assumptions are made visible. This applies doubly to something like OpenBSD, which goes out of its way to make bad assumptions visible, particulaly those related to memory management

Re:"theoretical"

[mpe]

Do you sit around trying to see who can come up with the most idiotic perversion of the English language, or are you really that stupid?

Given the origin of the document the language being perverted is more likely to be French.

Re:"theoretical"

[cnelzie]

The "IT" Department of that company isn't doing it's job.

    Fred shouldn't be capable of installing any software to create a database on any computer within his department.

    At best, Fred could create an Excel Spreadsheet. Depenending upon the amount of data going into the file, the IT Department would probably hear about it sooner or later, as Excel simply cannot hold that much information without getting really wonky.

Re:"theoretical"

[baadger]

That may well explain why Gentoo, a *source distro*, hasn't got anything but a binary package of Open Office. Apparently it's hell to compile.

Re:"theoretical"

[imroy]

Ok, porting frequently exposes bugs. I'm a programmer and undertand that. Except that OpenOffice.org already exists on several platforms. And StarOffice has been around since 1994 on various Unix platforms. What I was referring to was that there seems to be a group of BSD users who resent the popularity and success of Linux and try to put it down at every available opportunity. I saw that comment as the product of this childish anti-Linux attitude.

Re:"theoretical"

[jimicus]

Fred doesn't need to be capable of installing any software. It's already installed; it's called "Access".

And trust me, by the time the IT department hears about it it's probably already taken a strong foothold.

Re:"theoretical"

[jez9999]

At least it's not as bad as US perversions of the language. 'Burglarize', anyone?

Re:"theoretical"

[Dan Ost]

You're misinformed. Gentoo has both a source ebuild (app-office/openoffice) and
a binary ebuild (app-office/openoffice-bin).

I use the source version myself (takes several hours to compile).

Re:"theoretical"

[baadger]

Ah, that'd be because it's keyworded "-amd64". Doesn't build as 64 bit at all :|

Re:"theoretical"

[boule75]

Guys. Last time I was taught about this, this came right down from the Latin language... In French, the singular is "scénario", and the plural may be "scénarios" (common) or "scénarii" (rare, direct from the Latin). Note the funny accent on the "E" which is no Latin sprach whatsoever !-)

Anyway, no need to boast any moral superiority there.

Re:"theoretical"

[owlstead]

Simply said, people don't like to start up 2 programs just to create one text document. And writing a complete GUI for this is not productive. There is no shame in using templates and/or macros for this. As long as the macro system is restricted to the document, there is no reason not to use macro's. If you need more, there is no problem in using some plugin either. This whole "scripting is bad" is just a problem because they created too big a sandbox.

Re:"theoretical"

[Leiterfluid]

That's a pretty narrow view, considering many finance departments in larger companies have their own IT specialists that are familiar with their needs, hence the CITP credential.

I've been in IT for over 12 years, and my wife, a CPA, runs rings around me when it comes to excel functionality.

Re:"theoretical"

[Red Alastor]

Guys. Last time I was taught about this, this came right down from the Latin language... In French, the singular is "scénario", and the plural may be "scénarios" (common) or "scénarii" (rare, direct from the Latin). Note the funny accent on the "E" which is no Latin sprach whatsoever !-)

That would make it the only French word that ends in "ii". French is my main language and even though scenarii is used in France (fortunately, I'm not living there), it's bad French. And it sounds awful. I'm unsure if it's worse or not than their other perversion of the word : "scénar".

P.S.: Grepping my French dictionary file, I do find ONE word ending in "ii" : impresarii. Never saw it before. I think it's bloody stupid.

Re:"theoretical"

[swillden]

Have you ever actually generated any OpenDocuments? A bit of code to generate some custom XML, plus an XSLT stylesheet to convert it makes it *extremely* easy to build them. More powerful, flexible, extensible and often quite a bit simpler than using macros. Oh, and no security problems at all. It's a Better Way.

Re:"theoretical"

[rtb61]

This change happened when microsoft was pushing the change from embedded macro laguages to quick basic so they could generate additional revenue for quick basic licence (for other non-microsoft programs, full version needed for full functionalty).

Over a period of releases they killed off access to the embedded macro language (typical M$, f the customer we need more money).

Everybody else followed suit and simple embedded macro laguages were replaced with external calls to other programming languages, with the marketing hype that you could transport the macro (why would you use a spreadsheet macro in a word processor).

Thats a cool thing with open source

[CrazyJim1]

If someone finds a bug or flaw, it doesn't take someone else very long to fix it. Now when it comes to corporations, they have to wait to bill you for the next release, and you pay it too because the fix of bugs alone justifies buying the new version.

Re:Thats a cool thing with open source

[daniil]

The cool thing about corporations is that it takes them longer to produce new bugs and set them loose in the wild.

Re:Thats a cool thing with open source

[Dorceon]

Or they issue a hotfix that's automatically downloaded and installed.

Re:Thats a cool thing with open source

[Vexorian]

That statement is certainly wrong to me, at least as a generalization, a great counter example would be microsoft.

Re:Thats a cool thing with open source

[nwbvt]

I've seen plenty of security bugs in open source code that don't get updated right away. Open source is not all that different from closed source software in this sense. While it certainly is fun to pretend open source is perfect and is in every way better than commercial software, that simply is not true.

Re:Thats a cool thing with open source

[Penguin]

Yeah, open source is great. I'm so happy that after a year nobody responded to my Firefox bug report marked as security related issue. After a year I suppose someone got a notification email and re-wrote the summary, but it is still marked as "NEW". This bug is over a year old, no way it could be regarded "NEW". It should be "FIXED" or at least "INVALID" (or "GET A LIFE, MORON"). Currently it is assigned to "Nobody's working on this, feel free to take it". Yay, the power of open source.

I'm sorry that you put that much trust into a community. It seems like people are more fond of a thought of "the great thing is that when we are THAT many people present at the party surely someone want to do the dishes (and fetch the dead guy out of the pool)" instead of a schedule of "No security bug older than one day/week/month/year" should be regarded "NEW", but should assigned to any responsible person".

I'm not heckling the open source community. I'm part of it. But happy-go-lucky progress just doesn't cut it for security efforts. BIND is open source as well, but its security track record has been awful, especially by comparsion of the simplicity of a DNS server versus web servers (or any other kind of application)

(the mozilla bug is #295922, requires privilege access, no biggie, not a problem for default or average users, but there is still no reason for a security marked bug to have status "NEW" after a year)

Re:Thats a cool thing with open source

[westlake]

Thats a cool thing with open source...If someone finds a bug or flaw, it doesn't take someone else very long to fix it. Now when it comes to corporations, they have to wait to bill you for the next release, and you pay it too because the fix of bugs alone justifies buying the new version.

Last I heard, Sun was still providing the money, manpower, leadership, and material resources going into the development of OpenOffice.org. That contributions from outsiders were trivial, given the scale and complexity of the project.

"If it looks like a duck and quacks like a duck..."

Just maybe an open source license and free distribution doesn't change things much internally from the way they are done in Redmund.

Re:Thats a cool thing with open source

[Pharmboy]

Or they issue a hotfix that's automatically downloaded and installed.

You forgot to add " but often breaks some other piece of software."

Re:Thats a cool thing with open source

[Pharmboy]

On the server side, critical security bugs are fixed on average of one to 3 days in Linux. Be it a kernel issue, sshd, apache, bind, vsftpd/proftpd, sendmail or any other widely used daemon.

Minor programs not as fast but still faster than MS and the main programs that offer the greatest possibility for root exploits have always been fixed in just a day or two. I welcome any example where it took 4 weeks for a fix for a main package.

I don't think Linux is safer because I use it on my servers, I use it on my servers because it has the POTENTIAL to be safer if maintained properly. Still using Windows on the desktop for 90% of system.

I am glad MS has gotten better about patches, but they still done anything nearly as fast as the average large, mainstream OSS package does for updates.

Re:Thats a cool thing with open source

[TheRaven64]

contributions from outsiders were trivial, given the scale and complexity of the project.

Sun does about 80% of the work on OpenOffice.org. This is a significant majority, but I would hardly classify 20% a trivial. The second largest contributor is Novell. Since they have OpenOffice.org deployed on every single one of their employees machines, they do a lot of work fixing dogfood bugs.

Re:Thats a cool thing with open source

[nwbvt]

"I welcome any example where it took 4 weeks for a fix for a main package."

Well offhand, here is one opened 3 years ago which still hasn't been fixed, though it would be difficult to exploit. Basically what happens is that that a machine with trust level 4 (the default is 3, so again this would be difficult to exploit) to gain level 5 access (meaning they can run arbitrary commands on computer running the service. No, STAF/STAX is not as big as Linux (which is why I was talking about open source in general, not just Linux, which isn't even the software this article was about), but it is used in many corporate environments as an automated testing tool.

Re:Thats a cool thing with open source

[Anonymous Coward]

No, STAF/STAX is not as big as Linux

Jesus, you shills must be getting desperate. That is just pathetic.

Re:Thats a cool thing with open source

[mcrbids]

But happy-go-lucky progress just doesn't cut it for security efforts. BIND is open source as well, but its security track record has been awful, especially by comparsion of the simplicity of a DNS server versus web servers (or any other kind of application)

Perhaps a bit ironic that you mention BIND. It's been quite a while since there's been a big security problem in BIND, and is currently the driving force in the largest security update to the DNS protocol in, like, decades - DNSSEC.

Yes, the BIND sources were pretty clumsy and took a while to "get it right". Despite that, it's also always been very stable, and despite the security flaws, has done a good job keeping the vast majority of the Internet together. And, AFAIK, BIND is standing on some pretty solid ground right about now...

Re:Thats a cool thing with open source

[DrXym]

If someone finds a bug or flaw, it doesn't take someone else very long to fix it. Now when it comes to corporations, they have to wait to bill you for the next release, and you pay it too because the fix of bugs alone justifies buying the new version.

The problem with Open Office is that someone could check the fix in tonight but you wouldn't necessarily see a 2.04 until whenever they felt like releasing it which could be months or more. So really it's irrelevant in that situation that you're dealing with open source or closed source.

What OOo should do is implement some form of patching mechanism, similar to Firefox. Then they can have their firedrills and dump out a small, precision patch and innoculate much of their userbase before any harm can be done.

If I were OpenOffice, I'd also be questioning the need to support StarBasic AND Python AND Java AND BeanShell AND JavaScript (two versions) for the same product. While it's understandable there are certainly legacy reasons for doing so, I wonder if all these languages shouldn't be reined in a bit. My understanding is that JS, Basic & BeanShell can be embedded in documents, so if I were looking to break OO I'd be looking to see what objects had been exposed in these scripting languages.

Re:Thats a cool thing with open source

[abigsmurf]

However patching suffers from the same problem of virus scanners in that it's usually reactionary, they only patch bugs after they're known.

A smart hacker will find an exploit, not reveal it to anyone and only use it on select targets. It could be a long time before this exploit is noticed and fixed. One of the flaws of OSS is that a hacker can find flaws that haven't been fixed in a much easier way because the source is in front of him.

Re:Thats a cool thing with open source

[rtb61]

The difference between open source and closed source that for some reason you fail to grasp, is you can fix that bug immediately or you can pay someone to do it for you.

There is never any nonsense that the bug will never be fixed or support has expired or buy the next version (basically the old version dressed up with bugs removed, that they have no intention of ever fixing in the old version because the instability and insecurity produced by the bug provides motivation for the end user to upgrade).

No one has ever claimed perfection, apart from marketdroids selling proprietary products, the big driving issue is about putting control back into the users hands.

The reality is, if the M$ office source code, ever went public, then it would likely be only a couple of weeks before, you could not take the risk of connecting any windows computer to the internet (there are bound to be bits of office code embedded all over windows to ensure a competitive advantage).

Code that has been subject to independent public vetting, will always be more stable and secure than code than has not been, if, for no other reason than more independent eyes have seen it (if you think internal company politics and bonuses etc. don't have an affect on the quality of code going out the door, then you are crazy).

Only an idiot or a corrupt fool, would look at open source code and than try to compare it to a closed source product with out looking at it's code and make any kind of comment regarding the comparative quality of the code.

Re:Thats a cool thing with open source

[nwbvt]

Nothing like a condescending open source zealot to wake you up in the morning...

"The difference between open source and closed source that for some reason you fail to grasp, is you can fix that bug immediately or you can pay someone to do it for you."

No, you can't. First, believe it or not, most people out there who would use a product like OpenOffice are not software engineers. That argument may work for software that is primarily used by developers such as Apache, but not at all for something like OpenOffice. Second, projects like OpenOffice are notoriously tight, and you cannot just one day join the project right off the street. Even though they are open source, most of their developers work for Sun, and they do control who is able to contribute to the project.

"No one has ever claimed perfection, apart from marketdroids selling proprietary products, the big driving issue is about putting control back into the users hands."

No, but the previous poster did claim that with open source projects "If someone finds a bug or flaw, it doesn't take someone else very long to fix it", thats the claim I was rebutting.

"Code that has been subject to independent public vetting, will always be more stable and secure than code than has not been, if, for no other reason than more independent eyes have seen it (if you think internal company politics and bonuses etc. don't have an affect on the quality of code going out the door, then you are crazy)."

Again, while that argument may work in LaLa Land, thats simply not true in the real world (as this very article itself demonstrates). Just because something is open source does not mean everyone who uses it will take a look at every line of code. Most people (especially with a product like OpenOffice) will simply just use it and never even download that tarball of source code. And very few of those who do actually take a look at the code and who are skilled enough to recognize problems in it will look at every last little line of code in the project. In fact, many propritary products that have internal processes like code reviews will actually get more eyes on it than some open source projects.

Re:Thats a cool thing with open source

[rtb61]

Choice or lack of choice. Companies and governments have much larger budgets than individuals. Why pay for tens of thousands of licence fees and put up with faults that you can't correct. Far better to invest in coders you can control.

Since when has expressing a desire for choice been zealotry, oh yeah, since the microsoft marketdroids decided that ex-customers who don't tow their corporate line should be insulted as a marketing strategy.

Less eyes look at the same closed source code than the same open source code, considerably less. In the closed source world having many eyes looking at the same lines of code means going bankrupt, simple non-marketing logic, more coders than code and you will lose money (that is a plain simple fact). Perpetuating the illogical drivel of corporate marketing at it's best.

Perhaps you missed the part about independent review and the affect of having your code reviewed in public is likely to have on the quality of code you endeavour to produce.

Why would anybody bother with the silly argument, that not every users analyses the code of the program they are using, what is it meant to mean, what possible significance could it have betweem closed source and open source code (according to the DMCA it is a criminal offence for the majority of users to even attempt to look at closed source code).

Re:Thats a cool thing with open source

[nwbvt]

"Since when has expressing a desire for choice been zealotry"

You are not expressing a desire for choice, you are spreading misinformed propaganda about something you clearly do not understand.

"Less eyes look at the same closed source code than the same open source code, considerably less."

What are you, a broken record? I already refuted that point.

"Perhaps you missed the part about independent review and the affect of having your code reviewed in public is likely to have on the quality of code you endeavour to produce. "

Perhaps you missed the part about how the vast majority of OpenOffice users do not even download the source file, and those that do are not going to scan each and every line of code. Furthermore, claiming that since it is going to be open to the public developers are going to endeavour to produce better code in the first place shows you know absolutely squat about the history of the product in question. Ever hear of something called StarOffice? Want to guess how it is related to OpenOffice?

"Why would anybody bother with the silly argument, that not every users analyses the code of the program they are using, what is it meant to mean, what possible significance could it have betweem closed source and open source code (according to the DMCA it is a criminal offence for the majority of users to even attempt to look at closed source code)."

Are you asking why does it matter that your entire argument is based on a false premise?

Re:Thats a cool thing with open source

[rtb61]

At least there is some value in your posts, the parts where you quote mine. I refute your refutations, 'er', infinity.

Consider this, those that resort to insults, generally have very little constructive to say or in your case post.

Microsofties, they invented the term to describe themselves, they put as much thought into their code ;).

Re:Thats a cool thing with open source

[nwbvt]

I'm just going to assume that you are drunk or something and that wasn't supposed to make any sense...

Let me think...

[DumbSwede]

which should I use, hmmmm...
Microsoft's Office Suite IS being attacked.
OpenOffice could, possibly, theorectically, be attacked.

Re:Let me think...

[daniil]

If you have to choose between the state of war and the state of constant fear, then you cannot possibly lose, can you?

Re:Let me think...

[Anonymous Coward]

All joking aside, that is a dangerous way to think. No matter what platform or software you run, you should never become complacent with even potential security threats. Why do you think we still vaccinate children against polio?

Re:Let me think...

[Deliveranc3]

Sad truth, which will cost more to use next month...
Already installed vs has to be installed.

Re:Let me think...

[Jim_Callahan]

So you're saying that your preferred product has better security as a result of its relative obscurity... don't we have a saying about that somewhere?

Well

[mysidia]

They may find the security of OpenOffice to be insufficient. Their grounds for the finding seem rather questionable to me, given the theoretical nature of said flaws, and the very realized nature of Office security flaws.

I for one find the security of MS Windows as a whole to be insufficient. Quite clearly the only way to achieve a sufficient level of security is to use a patched BSD kernel, and use Vi or Ed for all editing tasks instead of MS Word, OpenOffice, or other similar GUI application.

In many ways, integrated GUI applications have ineffective security compared to segregated command line applications. When you type a command into a computer, you can be a lot clearer as to what the computer will do.

You separate viewing some text from viewing a picture, etc.

Re:Well

[LinuxIsRetarded]

I for one find the security of MS Windows as a whole to be insufficient.

Perhaps that's because you're ignorant of the security measures in Windows 2000 and later operating systems. If you run as an administrator, you place yourself at increased risk (this is no different than running as root on *nix). I have no problems running as a reduced privilege user with XP Professional. Yes, I've had to tweak file and registry permissions due to a few poorly-written applications, but that's not a flaw in the operating system- that's just developers being lazy and ignorant.

Re:Well

[Anonymous Coward]

I stopped using windows software around 1993, glad to see that is has only taken MS 13 more years to get to the point my Linux box was in 1993. Keep up the good work, MS!

Re:Well

[Anonymous Coward]

Sorry, but your callsign and associated web link automatically drop anything worthwhile (nothing noted in this instance) that you may have to say into my bit bucket.

Just a suggestion, but if you want to be taken seriously, drop the stupid name. Otherwise feel free to continue posting worthless comments or common knowledge, since that correlates well.

That goes for anyone using "insulting" callsigns, regardless of the target. They're fine if you want to come across as a juvenile, but not if you want your opinions to be taken seriously. As I say, just a suggestion.

Re:Well

[LinuxIsRetarded]

This is slashdot- I don't expect any informative posts about Microsoft products I make to be taken seriously, anyway. This is a *nix-fanboy site- no more, no less.

Now, I could act like the typical slashdot nerd and post incredibly insightful comments about "Micro$oft" or chairs. Would that make you feel better?

Many eyes at work. Sounds like a + not -

[MCRocker]

This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed.

The closed source model doesn't offer the same level of opportunity to find flaws. Even when people do find flaws in closed source products the publishers are as likely to bury the report, deny the flaw it exists or use DMCA to sue the people who disclose the problems.

Chalk this up as a win for the open source model... at least for large high visibility projects like Open Office.

The Bad News Is...

[RobotRunAmok]

...that OpenOffice has security flaws.

The Good News is that in the time it takes the suite to open and load an infected document the malicious hacker has been captured by the FBI, brought to trial, convicted, and a patch made available.

Re:The Bad News Is...

[Anonymous Coward]

It actually _loads_ a document? Damn, I knew I should have checked back in the morning...

Re:The Bad News Is...

[miro f]

actually since I found the OpenOffice.org quickstarter (hidden in the preferences under memory) I never went back. Loading times have decreased a lot (sometimes it even loads instantaneously). Sure it takes more memory while my system is idle but I've never run out before...

Re:The Bad News Is...

[FudRucker]

OpenOffice suite is a friggin office suite, if you want a editor that is light and fast stick with notepad

What makes them think MS Office isn't vulnerable?

[foreverdisillusioned]

I'm assuming that the vast majority of these alleged vulnerabilities came about as a result of them examining the source code. Since Microsoft Office is closed source, it may have just as many potential exploits or more. The difference is OO.o's vulnerabilities are known and thus can be guarded against or even patched by a third party. MS Office's potential exploits are unknown and thus may be released as zero-day exploits, and even when they are known we're at the mercy of MS to release a timely and effective patch.

I fail to see how this is a black mark against OpenOffice.org.

Theoretical

[Anonymous Coward]

The statement that "the others [vulnerabilities] are theoretical" reminds me of the slogan that L0pht used to have at the top of their web site:

"That vulnerability is completely theoretical." -- Microsoft
L0pht: Making the theoretical practical since 1993.

Not that I don't greatly prefer OpenOffice and open source in general over Microsoft, but in order to remain better than Microsoft, open source can't afford to become complacent like Microsoft.

Re:Theoretical

[Neuropol]

Agreed. And I'm sure people are working on it and looking in to it. Even on this fine Sunday evening.

Most likely right at the time when the OO.o devs were sitting down to a nice sunday dinner. Then all of a sudden one looks over at his idling machine and sees that a story about his software has been posted at slashdot "... gasp ... choke ... (insert heimlich meneuver)!"

In theory, an OO developer has just come close to near death to a near exploit found in OO!

Look what you've done! Couldn't this have waited til monday morning?

MMKay.. Interesting, but..

[wwiiol_toofless]

OpenOffice.org is FREE! FREE I tell you! Given the choice between a known-to-be-vulnerable $200 suite and a hypothetically-vulnerable Freeware suite, I'll take the latter. The day I discovered OO still ranks in the top 10 of my favorite computing moments of my life.

Re:MMKay.. Interesting, but..

[Anonymous Coward]

heh until your confidential document you had on your computer gets leaked and you get fired.

So...

[Anonymous Coward]

On the one hand, we have an office suite (MS Office) that's presently under heavy attack by hackers, and on the other, we have one (OpenOffice) that MAY be attacked, that has already addressed one of the discovered weaknesses and will probably address the others ASAP. OpenOffice is a greater security risk? Maybe in Upside-Down Land.

What's the point

[alveraan]

in talking about what os/office suite/browser/... has the most bugs. Just report them to the programmers so they can fix them. I mean, this is an open source project. I'm sure they care about critical security bugs...

If a company/project takes 2 years average to fix a bug, that's a problem, but hey - stop spreading blame and start spreading bug reports. That's far more productive.

Re:What makes them think MS Office isn't vulnerabl

[NihilEst]

I fail to see how this is a black mark against OpenOffice.org.

I don't either. But you know that if MS (or its shills) can make it appear so, they will.

OO.org is vulnerable

[Elektroschock]

True. Guess the same applies to Abiword. But who will write an Abiword worm?

Re:OO.org is vulnerable

[megabyte405]

Actually, since scripting isn't supported in AbiWord documents (writing plugins is the recommended way to do anything crazy that you can't script externally, as far as I know), the same isn't true for AbiWord.

AbiWord strips out macros and ignores them - a plus for security! :)

--Ryan, AbiWord Dev and Win32 Maintainer
AbiWord Community Outreach Project: http://cleardefinition.com/oss/abi/blog/

leaked MS Expense Report

[Gothmolly]

From: sballmer@microsoft.com
To: accounting@microsoft.com

Attached find my receipts for the recent meetings I had with the French Ministry of Defense:

First class plane ticket to Paris: 2100 USD
Swank hotel in Paris: 1800 USD
Dinner for 2 at a spiffy restaurant: 800 USD
Hookers and blow for MoD officials: 5000 USD

Business Justification For Expense: I believe that we will sell ONE MILLION copies of Office to the French MoD.

--Steve

PS If you get a bill from the hotel about a broken chair, it was like that when I got the room, so I don't think we should pay it. Bill said it would be OK.

Re:leaked MS Expense Report

[winkydink]

First class from SEA-CDG is closer to $10k.

Re:leaked MS Expense Report

[jawtheshark]

Not only that, but the spiffy restaurant wasn't all that spiffy either. In some spiffy restaurants 800USD is what the (cheap) wine costs.

Gentle Reminder About the Ministry

[mpapet]

This is the MINISTRY OF DEFENSE where draconian access control and accounting should be routine.

It's very difficult to go from that environment back to the real world where security is measured by successfully implementing long passwords in a company.

Making the inductive(?) leap that OpenOffice.org is insecure is a really long leap of faith. Are there holes? Probably.

In many ways, this is good news because the open source application is being picked over with a fine tooth comb by a large ministry.

Bring it on!

The imporant news here

[andreMA]

... is that France has a Ministry of Defense.

Re:The imporant news here

[kfg]

http://en.wikipedia.org/wiki/French_Defence

KFG

Re:The imporant news here

[Harmonious Botch]

I disagree. The important news is that they have finally overestimated a threat.

Re:The imporant news here

[mark_hill97]

Well someone has to oversee the production of white flags.

Re:The imporant news here

[baggins2001]

They have always had a Ministry of Defense. Up until now though they've only been used to wave white flag and yell "Runaway, Runaway, Runaway". The really important news here is that they have attacked something.
Twenty one years ago they attacked a Greenpeace vessel and had they're first victory at sea in 300 years. Now they're going after OpenOffice, man these guys truly have balls.
Be afraid Iran, be very afraid. In 5,000 years they may just come after you.

Re:The imporant news here

[Guppy06]

They've done it before, though. Consider the Rainbow Warrior.

Re:The imporant news here

[Anonymous Coward]

You had to discuss with the OOo guys because the french guys are working with them to IMPROVE the security of OOo to be usable in a very strict security environnement. Do you really think that it's better to let some big "shadow" area inside the code instead to try and correct the problems or designs?

And for the french foreign politics, the story proved they were right for the so called " weapons of massive destruction", in the same time story proved that it's very easy for a governement to use the fear to do what they want...

Re:The imporant news here

[boule75]

Well, we are happy not to have a "war [happy] president".

Well, frogs joke with the Belgians, I begin to get along with French jokes in the US. If only the related matters were not so deadly serious...

Re:The imporant news here

[DataCannibal]

Can't you keep up with the Republican kneejerk dance ?

The French are now goodies, on your side: they're helping out Condi with sorting out the mess in Lebanon and French Fries are back on the menu in the canteen on Capitol hill.

Re:The imporant news here

[Anonymous Coward]

hum and how was the war in Vietnam for the USA, and in Afghanistan and in Irak? Because for what I know they lost all these wars...

Afghanistan there are only european people including french now. It's so easy to destroy but so difficult to reconstruct ... So the bad job is let to real men not stupid rambo who shoot before to think.

In Irak it's not better, but no one want to take the shit, so USA has be to be there and fight Al Quaida, another things they brought with them in Irak (like some weapon of massive destruction...).

You're funny guys, before to speakj try to learn what is diplomacy you need it a lot.

Insecure by association?

[quantaman]

My understanding is that a lot of the security problems in MS Office comes from bad design wrt things like macros which make it very hard to secure the system. If OpenOffice is working towards compatibility with MS Office they may be having to deal with the same types of security issues in trying to secure bad macros and such. Thus it makes sense that OpenOffice would be just as, or even more, insecure than OpenOffice, not only do they have many of the same classes of exploits, but they also have greater pressure to rush these features out (for compatibility reasons) and up till now haven't had the motivation of attackers actively exploiting them to force them to spend the necessary time on security.

OPDs and Latex

[MarkWatson]

Well, be careful of Other People's Documents (OPDs)!

I always turn off any live macro support in OpenOffice.org and Microsoft Word, and hope that is good enough security. I also tend to open Word .doc files I receive from other people in OpenOffice.org.

A little off topic, but I have been blogging about this lately: whether I am writing up short project documents or working on a for-fun book project (Ruby AI Programming), I find that just using Latex is much more productive for me. One reason is just seeing raw text (with a little markup) seems less distracting. Also, I find Latex easier to automate for stuff like running external commands and including the output, auto-insert of external files using custom listing styles for programs and for program output, etc. This is great when writing about programming - tweak the code examples, and the next time you run Latex on the main document, the new code versions and new output are included. Sweet. The "overhead" for writing is reduced, giving me more time to post on Slashdot :-)

Re:OPDs and Latex

[SpiritGod21]

Yeah, I discovered Latex just a few months ago and I've been loving it. Looking forward to the semester starting up so I have an excuse to use it a lot and some motivation for writing a template for SBL format :-P

Re:OPDs and Latex

[iabervon]

The main problem with LaTeX is that, if you use it for much of anything, you'll never have the patience to deal with a word processor again, and will therefore be unable to work with businesspeople on documents. And you'll be forever annoyed by the minor formatting flaws in everybody else's documents, like when paragraphs spanning page breaks have a single line on one of the pages.

Re:OPDs and Latex

[whitehatlurker]

This is interesting in that the slide show referenced by TFA was produced with LaTeX and dvips - on the 4 of June, 2006. News for nerds is a bit behind ...

Re:OPDs and Latex

[MarkWatson]

Too late - I am already spoiled by Latex.

I tried to get the publisher of my last book to accept Latex, but they said no.

CVE-2006-2198

[tetromino]

I think that the flaw they are talking about is CVE-2006-2198, which was fixed in OOo-2.0.3. It was pretty nasty, executes arbitray macro without alerting or prompting the user. However, given that the mistake was already found and fixed, what else does the French Ministry of Defence have to complain about?

Re:CVE-2006-2198

[truthsearch]

I submitted this story to /. a month ago and it was rejected. Back then the MoD stated they were already working with the OpenOffice.org developers to have the appropriate changes made. Apparently it's been completed within the last one or two months. This is old news (by internet standards).

Microsoft or Sun?

[Rudolf]

From the summary: ...vulnerabilities with open source office suite OpenOffice.org may rival those of Microsoft's version

Microsoft has a version of OpenOffice? Isn't OpenOffice's closed version StarOffice, which is owned by Sun, not MS?

Re:Microsoft or Sun?

[Jessta]

You seem confused and seem to be having trouble reading. In no way does that sentance convey that Microsoft has a version of OpenOffice.org But it does state that microsoft has an open source office suite. Which I've never seen.

The actual problem is DicOOo

[Animats]

Here's the attack:

Installation d'une fonction offensive C dans la macro DicOOo.
La fonction C est exécutée à l'installation de DicOOo.

"DicOOo" is an installer for dictionaries into OpenOffice. Unfortunately, it seems to have too much power, and can be replaced or induced to install other things. This is an add-on to OpenOffice, and apparently an unsafe one.

Re:The actual problem is DicOOo

[g4sy]

That was the problem that was fixed. The other problems have been examined and dealt with using certificates etc.

Nothing to see here. Move along.

Maybe we need to take a step back...

[Harker]

a decade or more, at least.

How about we stop writing word processors and spreadsheets that are capable of running code (other than its own)?

I remember back when I was big on a certain usenet news group, we had a discussion about an email virus. The claim was, when you opened the email (don't recall the name off hand), it would do all sorts of nasty things to your computer, and possibly to your girlfriend/wife/sister/etc. The entire thing was a hoax that preyed on ignorant computer users, and urged them to spread the word.

My argument at the time was basically that an email client could not, or should not execute the text within the email itself, and any client that did, shouldn't be used.

Now I use Outlook on a daily basis, and guess what?

So, let's take a step back to simpler, less efficient applications. Get rid of what causes the vulnerabilities in the first place.

Now where did this box come from?

H.

Re:Maybe we need to take a step back...

[whitehatlurker]

The claim was, when you opened the email (don't recall the name off hand), it would do all sorts of nasty things to your computer,

That would be the Good Times virus. (Warning: don't click on that ... ooooh too late.)

Re:Maybe we need to take a step back...

[Anonymous Coward]

Tru dat, yo.

Same go fo browsers. Noscript fo life, dogg.

Re:Maybe we need to take a step back...

[Harker]

Yup, that's the one.

H.

Alternatives

[Doc Ruby]

How secure is MS software that responds to vulnerability discoveries by ignoring them or lying about them, fixing them after months or even several versions (years) later? Because users have to rely on MS to fix them.

Compared to OO.o, which anyone can fix, even the French government itself, but which does fix bugs quickly.

The only problem with open office is

[popsicle67]

It doesn't have a sales staff that can kiss a ministers ass.

Re:Many eyes at work. Sounds like a + not -

[kz45]

"This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed."

This seems to be the call of the open source zealout, but it is not reality. 99% of the people using Open Office are users. The other 1% contain people that might have the ability to look at it, but may not have the time or patience.

I have been involved with many open source projects over the past couple of years and it usually ends up like this:

1) someone emails a bug to the main programming team
2) someone on the programming team (when they have time..since it is a volunteer position) will look through the code and make the changes
3) rinse and repeat

Proprietary apps actually seem to be better in this respect because at least the main programming team is usually working on it full time and can implement changes in a timely fashion (because they aren't working other jobs). In bigger corporations, this does not always happen because of corporate BS.

"Chalk this up as a win for the open source model... at least for large high visibility projects like Open Office."

Not really. Many proprietary apps still have people that can and do find flaws (much in the same way they find them in open source apps. Sure, the source code helps, but I would imagine it's easy for many of the security experts to test it from the outside).

"The closed source model doesn't offer the same level of opportunity to find flaws. Even when people do find flaws in closed source products the publishers are as likely to bury the report, deny the flaw it exists or use DMCA to sue the people who disclose the problems"

so why did the people at openoffice.org pass many of the flaws off as theoretical?

Re:What makes them think MS Office isn't vulnerabl

[Anonymous Coward]

I'm assuming that the vast majority of these alleged vulnerabilities came about as a result of them examining the source code.

Then you assume wrong. Other than the one source-level defect, the security problems being dismissed as "theoretical" are fundamental design problems that are evident without any examination of source code. That is, OO.o is "working as designed", yet it has security problems.

The difference is OO.o's vulnerabilities are known and thus can be guarded against or even patched by a third party.

Not so. A fundamental design problem isn't fixed by a patch. I suppose you can guard against it, in the sense of "never open a document from anybody you don't trust". Of course, if that advice were offered as a solution to similar problems with a MSFT product, the person offering it would rightly be laughed out of the room.

I fail to see how this is a black mark against OpenOffice.org.

That's because you appear to lack critical thinking skills.

The goal isn't to be better, it's to be good

[tfried]

I fail to see how this is a black mark against OpenOffice.org

I don't think that's (neccessarily) the point. Whatever MS does about their Office security flaws does not really concern me any longer. There's almost nothing that could ever make me use MS Office again. But so what. The point isn't which suite is better, the point is: OpenOffice.org still has flaws, and those should be fixed. In this context the statement "The [other flaws] are theoretical" does not make me feel good. I want even theoretical flaws to be taken serious, so they won't become real ones ever, if possible to avoid. I just hope the OO.o team does not concentrate too much on having the better PR, but also on having a good product.

Disclaimer: I don't have the slightest clue about OOo security in general, and the "theoretical" flaws in particular, so possible they may in fact be nothing to worry about. If you convince me this is the case, or I'm just mis-interpreting the quote, I'll happily shut up.

The problem with Open Office

[theshowmecanuck]

... is that when they do have a security 'fix', they force you to update by downloading the entire suite... they don't have differential patches. I personally get sick and tired of having to download around 100 MBytes of app, uninstall the original, and re-install the new. Granted on my Linux box the package updater will do all three, but the updater takes forever to download the files. Quite frankly it is a pain in the ass. Sometimes I delay installing an update because of it (sometimes quite a while). Other than OO, I really am pretty diligent about updating my systems, so I can imagine there are those who just won't bother updating OO at all. I would think this is especially for those who are still on dial-up where a 100 meg download can take many, many hours.

In my opinion, if they want to say they get fixes out quickly, I can call bullshit. Just because you have the code complete doesn't mean the fix is complete. It still needs to be distributed to all the installations. If this is not done because the process is so onerous, then you can't say the fix is released faster than M$. As much as dislike monopolies, they do make the update process a lot less painful.

That said, it is a pretty decent office suite.

Re:The problem with Open Office

[Anonymous Coward]

Then use StarOffice on Solaris, like Sun want you to.

The problem you highlight, is a problem with all Linux distros that I've tried. No distro seems to provide proper patch level dependency checking or provides incremental patch files. It's just most obvious with OpenOffice being (typically) the largest set of packages on the system.

So, bad luck, at least it's free.

Re:The problem with Open Office

[penix1]

"The problem you highlight, is a problem with all Linux distros that I've tried. No distro seems to provide proper patch level dependency checking or provides incremental patch files."

Then you haven't done Gentoo. Even big programs like Xorg, KDE, KOffice, etc. are done now in meta form allowing an update to one part without doing it all. I eventually see programs like Ooo going that route in Gentoo as well. Any other dependancy change is handled by revdep-rebuild. All-in-all, Gentoo is a fine distro for this feature alone...

B.

Re:The problem with Open Office

[Anonymous Coward]

I have 'done' gentoo. Much as I enjoy watching gcc messages fly past, that is not a credible solution in an enterprise environment.

Which Open Office?

[Anonymous Coward]

Again we have this inconsistent naming structure, where two different programs have the same name. See it all the time, like "firefox has this new bug" etc when a lot of the times it is only really a problem when it is a microsoft windows brand firefox. A windows product is a proxy MS product, whether someone else besides MS develops it or not or what they charge for it or what license it is developed under. Now the same with open office. I REALLY wish these projects would pick entirely different names for their software to distinguish an MS proxy product or not. Please distinguish between your "helping out poor old penniless Microsoft" efforts in developing software for them, and "the other". It's time, way past time, to be a little more accurate here. And if you can't come up with different names, throw it out to the community of users, get some suggestions, then vote on it.

Re:Which Open Office?

[jtev]

What, The, Fuck? It's only a Microsoft App if Microsoft develops it. There may be a few bugs inherent in the operating system, but that is true with all operating systems. You cannot blame Microsoft for any bug that is not inherent in a product or API they developed. That'd be like blaming Linus for bugs in some newbie's "Hello World!" program. The bugs in firefox you're talking about were an API bug. But, nobody wants to write their own API to do every single function in a program. Especialy when the APIs for other host OSes do not have that particular bug, and the bug isn't known at the time the API is first used.

Re:Which Open Office?

[RobertLTux]

actually it would be better if in the case of a platform specific bug (which this isn't btw) then it should be mentioned that Project Name on Platform

its like cars if a Ford Pinto has a "crash and burn" (>8-)) bug it doesn't effect other Fords but something like tires used (say a certain type of FireStone tires) would effect all Fords (that used those tires

What a productive attitude

[ElektroHolunder]

Great. A goverment agency sees enough potential in OO.org to spend a probably not insignificant amount of time and money on analysing the code, and what is the reaction around here? Finger pointing. "But MS Office is at least just as bad, yadda yadda yadda".

How constructive. When you were a child and you came back from school with your less-than-stellar marks, did you point at your retarded little cousin and yelled "but Bobs marks are even worse"?

Either refute their points if they are wrong, or suck it up like a man, use the money already spent for the betterment of the project and get your shit together and clean up the mess.

And yes, I know that the people whining around here are probably not the same spending their time coding on OO. Still, this attitude pisses me off.

Re:What a productive attitude

[Anonymous Coward]

How constructive. When you were a child and you came back from school with your less-than-stellar marks, did you point at your retarded little cousin and yelled "but Bobs marks are even worse"?

Of course. It's a well known strategy to deflect criticism. Works even in adulthood.

Besides, it's not like Bob is gonna get into too much trouble because of bad grades. He's retarded, for pete's sake!

Re:What a productive attitude

[YetAnotherBob]

You may have missed the above comments, the French were working with the OOo crew on this. It's already been fixed.

Re:What a productive attitude

[Xybot]

Flamebait? The parent post is the only thing worth reading on this thread.

Re:What a productive attitude

[shis-ka-bob]

I almost completely agree with you - but I still like some of the 'funny' posts, cheap shots can still be fun;-) More productively, this incident should be part of a larger story about how open source works better than closed source. A government agency does a serious investigation (using the open source) and finds one explitable flaw and outlines other possible, as yet unrealized, attacks (hence 'theoretical'). The actual attack is fixed and the theoretical attacks are being investgated by the developers. How is this a bad thing? This is 'many eyes' in action. Any 'shoot from the lip' attack on the messenger (French Defense Ministry) is counterproductive. Lets celebrate in the fact that a serious flaw was found and fixed and other fixes are underway. The world is larger than Redmond, so let a world full of eyes find and fix bugs.

Consider the source.

[kahrytan]

Consider the Source -- The French. Need I say more?

Re:Consider the source.

[angrykeyboarder]

That was an intelligent response.

8 steps to improve oo.org security

[paj1234]

1) Click Tools menu.
2) Click Options.
3) On the left side, click the Security category.
4) Under "OpenOffice.org Basic Script", set "Run macro" to "Never".
5) Under "Hyperlinks", set "Open hyperlinks" to "Never".
6) Under "Java", untick "Enable".
7) Under "Enable", untick "Plug-ins" and untick "Applets".
8) Click OK.

OpenOffice.org will now be configured for best security. Some functionality will not be available. Depending upon your system, you may need to repeat these steps for each user account.

Re:Many eyes at work. Sounds like a + not -

[electroniceric]

"This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed."

This seems to be the call of the open source zealout, but it is not reality. 99% of the people using Open Office are users. The other 1% contain people that might have the ability to look at it, but may not have the time or patience.

While I agree that the attitude that open source fixes all vulnerabilities is blasee, your statement is also a bit too broad. Secure projects are generally those that have been engineered to be secure from start to finish. Apache is quite secure, and OpenBSD sets the bar there. This is because these projects are carefully designed and managed for security. MS Office's general insecurity comes from its incredibly ugly code base - apparently it is just a mess in there - which is due to the product having been munged together by acquisition rather than engineered from scratch. Sadly, OpenOffice appears to have nearly the same problem - the original code base was very ugly, and while some cleanup has been done, there has been no general design process to ensure that problems are fixed at a broad level rather than an individual one. So there's very likely a lot of merit to MoD's claims.

      Application security will always be a problem, both in terms of modifying or misusing the OS, and in terms of wrecking users data. The former can and will be mitigated by better sandboxing (e.g. some sort of Zones or virtual machine approach for each app), while continuous backups and shadow copies may help the latter. I suspect you'll see security evolve in two ways - one it will take on much more importance, but two it will also move towards the "plan for flaws and keep things working" approach you hear Amazon, Google and others adopt these days. If OOo can move towards that model, it continue to be a fine alternative, but that requires somebody rescueing it from its enduring stepchild status. Time will tell whether that turns out to happen.

Petard needed for hoisting

[Anonymous Coward]

In an amazing echo of the open source community's criticisms of Micro$loth for the past ten+ years, people ditching Open Office were noted as saying "it's too bad they didn't bother writing it securely the first time".

Re:Damn Frogs!

[Anonymous Coward]

Damn, mods have no sense of humor. Libre Fries? Come on, its hilarious.

Re:What makes them think MS Office isn't vulnerabl

[miro f]

I suppose you can guard against it, in the sense of "never open a document from anybody you don't trust". Of course, if that advice were offered as a solution to similar problems with a MSFT product, the person offering it would rightly be laughed out of the room.

Funny, I've heard that advice many times and never any laughing. This is the kind of advice you follow for everything when working in windows. Don't open a document from someone you don't trust, don't go to a website you don't trust, don't open an attachment from someone you don't trust (you even have to be careful opening attachments from people you DO trust)

In fact if anyone's being laughed out of the room for this advice it's because everyone with any common sense has been following this advice since the first computer ever connected itself to the Internet.

Apples and Oranges

[Anonymous Coward]

It's a bit like comparing apples and oranges
unless your running openoffice as root it doesn't really matter anyway
as an exploit would only be able to access files that the user has access to due to the way Security works within the Linux kernel
and typically the user won't have access to any system files by default that would allow spyware etc to be installed
At most a hacker may be able to access files in the home drive but that's about it

windows / MS Office on the other hand everything runs at the same level
and any Security within the Windows OS / Kernel is easy to circumvent

Re:Apples and Oranges

[angrykeyboarder]

And I'm sure all of anyone's personal files are worthless and wouldn't be missed if they were hacked/destroyed eh?

Seriously, most of the macro viruses affecting Microsoft Office have little to do with system files and everything to do with user files.

It sounds to me like this article raises very valid points.

Someday a lot of Linux users will get off their high horse and realize that their beloved OS isn't as bulletproof as they'd like to believe. Someday....

Meanwhile, OpenOffice.org is cross-platform, so it's bringing it's vulnerabilities to Linux, OS X, *BSD, Windows....

Oh and I run Linux myself (Ubuntu Dapper, Fedora Core 5 & Debian Sid) as well as Windows XP/Vista. This message was made with Ubuntu 6.06.1

Re:Apples and Oranges

[Anonymous Coward]

that's what backups are for :)
the point is having access to files under /home/user
and having access to the system / installing spyware / annoying popups / password loggers / generally trashing the OS / accessing other machines on the internal network etc
is a little more serious in terms of security
one is easier to deal with than the other

although I'd admit that OO on a Windows enviroment could suffer the same issues as MS Orafice

Re:Apples and Oranges

[DarkDragonVKQ]

Linux isn't bulletproof. But it continues tons of nanobots that fix it rapidly :P. Rendering most viruses and such sorta..well useless within a short amount of time. Compared to Windows' rate and their software rate of patching. >.>

Office's APIs

[peterfa]

My sister's fiance is a total Microsoft zealot. He loves that Windows. He told me about some exciting things about Microsoft Office 2007 or something like that. He tells me about these APIs that you can do all this crazy stuff with. In my mind I wonder about why an office suite is supposed all that stuff... thinking if it's an office suite really should do the office functions, and not anything else.

Those APIs maybe one reason why Office is insecure.

OO.o wouldn't try this. They would stick to the UNIX philosophy that each utility should do only one thing, but do it well.

Re:Office's APIs

[angrykeyboarder]

Well based on the story, OpenOffice.org is clearly doing something wrong....

Re:Office's APIs

[megabyte405]

Well, actually, they already don't do the UNIX philosophy - one monolithic suite, and several API's. Just because it runs on Unix doesn't mean that it's made like the rest of it.

Re:Office's APIs

[peterfa]

Yeah, I realized that wasn't necesarily so... however, I can still argue that what Microsoft does with Office is just unnecesary. Office is being used not as an Office suite when used the way my friend was describing it, rather, used as a development platform, if I understood him correctly. Libraries should be pulled, if anything... and those libraries should be distributable with whatever is developed with them. Otherwise, I really don't see the point of these APIs.

Re:Office's APIs

[AJWM]

Otherwise, I really don't see the point of these APIs.

You're not viewing it from the right perspective. You're looking at it like a non-MSFT developer, or any otherwise sane individual. You have to look at it from Microsoft's perspective, and then it becomes obvious: the point is to sell more Microsoft software.

Libraries should be pulled, if anything... and those libraries should be distributable with whatever is developed with them

Not the Microsoft Way. If the (potential) users of this app need the libraries, they must be encouraged to buy a copy of MS Office 2007 to get them.

Re:Office's APIs

[peterfa]

the point is to sell more Microsoft software

Heh, true, true. My friend is all extatic at all these "powers." He thinks it's just the awesomest thing in the world.

Re:Many eyes at work. Sounds like a + not -

[someone300]

Well, considering that a higher proportion of the users of OSS will contribute fixes and bug reports than the equivelant for proprietary software, it doesn't matter as much if fewer of the main programming team are always available. Also, companies that are worried can fix security threats internally and submit the changes back. I'm not a major OSS developer but I've contributed many bug reports to GNOME and some to the linux kernel, and they've all been fixed. I have submitted some usability improvements in patch form too, which can't be done with proprietary stuff. Sure I'm only one person, but if you get even a tiny proportion of the users of a popular piece of software willing to get messy with the code, then it's a positive thing.

The problem I find with most proprietary apps isn't the development model as such, but there's rarely a clear place to forward suggestions and bug reports. For Microsoft software you get the crasher bug reporting with their "Send error report" thing, but there are far many more types of bug that you can submit to bugzilla on most projects (Crasher, usability, suggestion, glitch, etc.). I have seen some Microsoft projects with places to send reports and suggestions, as I have other proprietary stuff, it's just that it usually much less polished if it exists at all.

Lest we forget...

[Anonymous Coward]

The French have every right to be paranoid about invaders.

Re:Many eyes at work. Sounds like a + not -

[MCRocker]

"This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed."

This seems to be the call of the open source zealout, but it is not reality. 99% of the people using Open Office are users. The other 1% contain people that might have the ability to look at it, but may not have the time or patience.

Right... as compared to closed source, where 0% have the capability of auditing the source code.

Of course, things aren't as black and white as either of our initial comments make things seem. The edge is a bit blurred these days as even Microsoft does have a 'shared source' initiative to allow some interested parties to have a look and those just happen to be some of the most likely ones to actually be motivated and qualified to find and implement fixes. However, openness as the default stance does seem to make a lot more sense because even one's critics can look at the code and make an assessment.

I have been involved with many open source projects over the past couple of years and it usually ends up like this:

1) someone emails a bug to the main programming team
2) someone on the programming team (when they have time..since it is a volunteer position) will look through the code and make the changes
3) rinse and repeat

That sounds a lot like the proprietary model except that the 'when they have time' gets replaced with 'if they get budget approval'. I've worked on proprietary software and know, first hand, that development costs are usually dwarfed by customer support costs. In many projects, bugs only get fixed if there's a good business case for the fix.

Either way, resources have to be available, but they can come from outside of the core organization in the case of open source projects. If some customer thinks something is important enough for them, they can always go out and fix themselves. With a commercial program if they aren't a big enough account to make a ripple at headquarters, then it'll never get fixed unless it happens to pop up on the radar of someone more important. Sure, companies that will do this are few and far between, but at least they do have the option. Heaven help them if they decide that they like the legacy version that they've been using for years and haven't ponied up for the forced upgrade to the latest and greatest or even worse, if the company has gone bankrupt and the software is no longer available. At least with source they have a fighting chance.

One of the biggest factors in all of this is the size of the projects. Small open source projects tend to be fairly poorly supported, not as a rule, but in general. Small proprietary programs often have very little support at all and tend to be discontinued. Large, sexy, open source projects get a lot of visibility and tend to benefit from lots of participation and feedback. Large, profitable, proprietary projects tend to have enough paying customers who complain about enough bugs that there's some pressure to get them fixed. Counter examples of all four cases abound, but in general... size matters.

So, perhaps arguments about open vs. closed are really about secondary effects rather than the primary effects.

"Chalk this up as a win for the open source model... at least for large high visibility projects like Open Office."

Not really. Many proprietary apps still have people that can and do find flaws (much in the same way they find them in open source apps. Sure, the source code helps, but I would imagine it's easy for many of the security experts to test it from the outside).

Sure, SOME proprietary software makes SOME of their code available to A FEW reviewers, but as I wrote above, open by default means that even unexpected sources capable of performing audits and code contribution.

"The closed source model doesn'

Re:What makes them think MS Office isn't vulnerabl

[Anonymous Coward]

I suppose you can guard against it, in the sense of "never open a document from anybody you don't trust". Of course, if that advice were offered as a solution to similar problems with a MSFT product, the person offering it would rightly be laughed out of the room.

Funny, I've heard that advice many times and never any laughing. This is the kind of advice you follow for everything when working in windows.

I've never heard that advice seriously offered as a solution to the problem, only as a limited work around.

In fact if anyone's being laughed out of the room for this advice it's because everyone with any common sense has been following this advice since the first computer ever connected itself to the Internet.

Then nobody in the world had any common sense 15 years ago, including you. Or are you now going to claim that you never opened any document (note that I did not write "executed a program") from an untrusted source? If so, you are either an incredible exception or an outight liar. In fact, I'll bet you open documents (PDFs, images, movies) from untrusted sources regularly today.

Nebulous terms don't help

[penix1]

"Much as I enjoy watching gcc messages fly past, that is not a credible solution in an enterprise environment."

Ok, I'm going to call you on this...

Just exactly how do you define "enterprise environment"? If by "enterprise environment" you are talking server farms, gentoo is already on quite a few. If you are talking desktops, again, it is on quite a few and can be installed (if that is a measure) in under 20 minutes (GRP).

I installed Gentoo in 2000. That was the first time as well as the last time I installed the OS. Yet I can assure you that everything is up to date and some of it is bleeding edge. Do you consider having to reinstall the OS every time the distro revs a "credible solution for the enterprise environment"? I sure don't especially when it is so easy to stay on top of updates as they are released instead of as they are packaged.

B.

Theoretical means

[einhverfr]

problem spots you ought to address. These may be areas that need some additional checking etc. but they are not yet practical exploits. They may however be whole classes of exploits in the future.

One can never get rid of all theoretical exploits. What one can do is prevent them from being practical to exploit in general by adding additional checks and countermeasures.

Finally

[Drakin020]

Someone finds something wrong with something other than microsoft. =P Seems likes its allways Microsoft were bashing.

Re:Many eyes at work. Sounds like a + not -

[kz45]

"Well, considering that a higher proportion of the users of OSS will contribute fixes and bug reports than the equivelant for proprietary software."

This was my point: Even though the source is available, you don't really get that many more (if any or helpful) eyes looking for security issues.

Re:Many eyes at work. Sounds like a + not -

[kz45]

"Right... as compared to closed source, where 0% have the capability of auditing the source code."

You missed my point. Even though the source code is available, you don't get more people auditing your code. So what is the benefit?

"That sounds a lot like the proprietary model except that the 'when they have time' gets replaced with 'if they get budget approval'. I've worked on proprietary software and know, first hand, that development costs are usually dwarfed by customer support costs. In many projects, bugs only get fixed if there's a good business case for the fix."

profit is a good motive to get things done. If company X doesn't get feature Y, they might not make a profit this year. With OSS, people only work on things they feel like working on, and the result is a never completed project (or 10X the time it should take) or some things just don't get fixed/added.

With a commercial program if they aren't a big enough account to make a ripple at headquarters, then it'll never get fixed unless it happens to pop up on the radar of someone more important

If they aren't getting the support they need/want, they can go to competitor. It happens every day.

intra-office communication via RTF doesn't help

[beh]

Can intra-office communication not be done via RTF?

It easily could - but that's beside the point. THe fact that you can run "virus-free" software on Windows does not preclude you from (inadvertently) running something virus-infected.

You may do all your company internal documents in RTF even in MS Office - but if one of the company secretaries opens up a document sent by an outside source (maybe a seemingly legitimate one), which DOES contain a virus, your system's security is still screwed. Your RTFs might not get infected - but who knows what else the virus might do (e.g. send all documents in your "recent documents" to the attacker -- good chance of snatching some more important documents there...

Re:The Reality Is...

[Anonymous MadCoe]

That office suites alwais will have security flaws as long as they are feature driven (which is what the current user seems to like). Almost any piece of software that is driven by features and functionality becomes unreliable and insecury in time.

Can we stop complaining about MS Office now? Can we all get back to reality and go to work?

Irony

[Anonymous Coward]

Consider the source ... ah, ok, let's look at your blog, dude :
Lebanon has openly declared war on Israel. I am in full support of Israel and will continue to be in support of them forever.
Need you say anything at all about the French ? I just love pseudo-intellectuals ... , please, would someone responsible down-mod this racist prick ?

Re:Irony

[Anonymous Coward]

Everyone knows French are cowards and can't be relied on.

Buffer overflow, not just macros

[Anonymous Coward]

Read this: http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=op enoffice

Note that 2.0.3 fixes (at least) 3 flaws, one of which involves a buffer overflow that happens when you open any kind of openoffice document: http://www.ngssoftware.com/advisories/high-risk-vu lnerability-in-the-openoffice-suite/

Now, this doesn't mean OpenOffice security is bad, or that it's good, it just means that OpenOffice is subject to exactly the same kinds of security issues that happen whenever a complex app parses a complex data format. To pretend that it's somehow magically immune to this class of problem because of open source pixie dust is utter rubbish. Read the code.

Re:Many eyes at work. Sounds like a + not -

[DrXym]

The problem with OpenOffice is that its a massive project (120000+ files) and incredibly daunting to build with many inter-dependencies on non-trivial 3rd party packages. How many eyeballs actually look at the code, and can you say for sure that it is any more than for MS Office?

Now don't get me wrong. I *only* use OO for home use (MSO is required for office work), but it would be incredibly bad assumption that OO has less exploits than MSO. It's simply that the bad guys have bigger fish to fry. OO is a teeny target compared to MSO but as more and more businesses and governments start to use it, that situation will change. OO has many of the same flaws as MSO including macro scripting, so it seems likely that sooner or later someone might produce something bad that works through it. It's not the scripting that worries me, but what objects are visible through the scripting, the sandbox model and whether scripting should be an all or nothing affair. For example, should a script have unfettered ability to do what it likes with any available class or should be restricted to a subset. Does OO allow you to import any dangerous packages into a BeanShell script, or restrict you to safe and security audited ones?

Just Turn Macros Off

[xdxfp]

Why does MS Office have all these fancy features that only a few people use, yet they open up a world of vulnerabilities? I use MS Excel to write a spreadsheet with some basic formulas, and MS Word to write documents that I could just have easily written in WordPad (minus the spell check). Turn off macros by default, and have a generic "you're running a macro and this is unsafe" popup (which I beleive they already do). If the user clicks yes unwittingly, then they're probably too stupid to read the dialog asking them about the signature, and they're screwed anyhow.

Re:Just Turn Macros Off

[DerPflanz]

Argh. What an elitist snob you are. Just because you don't need or use it, it is crap? And everyone that wants to use their PC and is not ready to read cryptic messages about signatures is stupid?

Computers nowadays are so all omnipresent that not just professors and researchers use it, but also the woman next door that writes a letter to her sister and wants that pink flashy kitten in the middle talking to her. Part of the reason that PCs are so cheap now (and that you and I can actually buy one, or even more) is that they are omnipresent.

Oh, and on the 'fancy features', I remember a big Dutch electrical company (Essent) that has important business procedures stored in Excel and my friend was hired to script them. In the company I work, a open-source minded, Linux developing, automator, we use Excel sheets that can not be imported into OpenOffice, just because of legacy. They were developed a few years back, when OpenOffice was not available. Yes, we could rebuild them, but doing so costs time, which we don't always have. We actually have to work.

Re:What makes them think MS Office isn't vulnerabl

[miro f]

If so, you are either an incredible exception or an outight liar. In fact, I'll bet you open documents (PDFs, images, movies) from untrusted sources regularly today.

of course I have. I do this at my own risk. Yes the risk is low, but there (rememer the WMF exploit doing the rounds). Let's not mention all the picture.jpeg.exe files. Obviously if you know something about computers most of these problems can be easily avoided, but for many it's difficult. As for word documents, I have never opened one from an untrusted source, and if a trusted source sends me one I always ensure that it's actually them sending it. It's basic common sense and I am definitely NOT an incredible exception.

I'm not saying this kind of caution is necessary for every type of document, I commonly view images, movies and sometimes pdfs from sources that I cannot validate the trust of (otherwise I would never get anything done). But for Office documents I never have and barring some incredible security innovation that makes it unnecessary, I never will. Hell it's bad enough just visiting an untrustworthy site in IE let alone actually downloading a file from it nowadays.

To be honest, I've never really had a situation where I absolutely NEEDED to view a word doc at a site I was visiting (except at uni to look at assignment specifications. In many cases I believe google has a "view as html" feature which is quite handy...

Sick of this racist /meme

[Anonymous Coward]

France bashing - the acceptable face of racism on Slashdot.

Seriously, is it acceptable to similar jokes about Israelis?

Re:Sick of this racist /meme

[Joey7F]

Of course it is. Israel is no longer protected. The real question is, is it acceptable to make fun of their neighbors who wish its destruction. Just thought I would add, the French are not a race. Believe me, take a trip through Paris and you will wonder if you are in Europe. I was the only white (read: person of Western European ancestry) person in Gare Du Nord at midnite a few months back.

--Joey

Top 10

[neonprimetime]

The day I discovered OO still ranks in the top 10 of my favorite computing moments of my life.

1. Day I discovered OO
2. Day I discovered Knoppix
3. Day I discovered Debian
4. Day I got streaming audio to work on Linux
5. Day I discovered what buffer overflows were
6. Day I discovered Opera (sweet! an alternative to IE)
7. Day I discovered Perl
8. Day I discovered Python
9. Day I discovered LAN parties
10. Day I discovered the Holy Handgrenade of Antioch in Worms

I thought this was a MasterCard ad ...

[shis-ka-bob]

Sucessful FUD attack against an emerging competitor ... priceless

strike out point ten

[Sigg3.net]

I agree with Red Alastor on point ten. It's easier to penetrate when you're unzipped.

Even emacs had this kind of problem

[Anonymous Coward]

Including executable code (or macros or whatever) in a file that the users think of as simple data is ALWAYS a security mistake. Even emacs used to allow automatically executable macros in data files, but that feature was turned off by default long long ago, because of its nasty security implications.

Shortly after the first PostScript printer appeared, files that contained bad Postscript appeared that were designed to attack the original Apple LaserWriter.

Just because OpenOffice.org is an open source product doesn't mean that repeating the mistakes that Microsoft made in Office won't be just as bad in OpenOffice.org

Javascript in Firefox can lead to security problems. Macros in OpenOffice.org can lead to security problems. Executable content in anything can lead to security problems.

Unfortunately, Microsoft does NOT have a monopoly on bad security decisions.