Longhorn Server's "Improved" Security

Don't see how it matters really by also-rr · 2006-10-13 05:30 · Score: 3, Funny

There are CIOs just lining up to sign the purchase authority forms as we speak.

Ohhh, new windows? And this one has transparency! That's going to make the spreadsheets* fly!

*sigh*

*By which they mean databases. Or possibly Word. Who knows the mind of a CIO?

--
Think of the Children; Sleep with your Sister

Re:Don't see how it matters really by vtcodger · 2006-10-13 07:52 · Score: 3, Funny

****By which they mean databases. Or possibly Word. Who knows the mind of a CIO?***
CIOs have minds? Who knew?

--
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
Re:Don't see how it matters really by Jeremiah+Cornelius · 2006-10-13 08:21 · Score: 1

There is no ability for an Admin to have remote access to Vista or Longhorn, without a PW assigned to the account. From the network standpoint, the account doesn't exist.

This means no services running as "Administrator" 'cause some numbnutz in development just brought up a box in the dev DMZ, as "Administrator:password".

Really, this isn't conceptually very different from what Apple and Ubutu are doing.

--
"Flyin' in just a sweet place,
Never been known to fail..."
Re:Don't see how it matters really by techno-vampire · 2006-10-13 10:50 · Score: 1

I don't think so. If I'm not mistaken, not havng a password for Administrator means that anybudy can log into that account simply by pressing Enter when it asks for a password. Instead of total security, a total lack of it by default. I'm not surprised, as security's always seemed to be an afterthought at Microsoft.

--
Good, inexpensive web hosting

How Kind of You by eldavojohn · 2006-10-13 05:30 · Score: 5, Insightful

In the summary you linked to the text "most secure Windows ever" where the title of the Slashdot article is "Microsoft Says Vista Most Secure OS Ever." You'll notice that the former doesn't really cause my blood to boil because I don't care which Windows is more secure. The latter, however, prompts 440 comments and the tag "lol" to appear.

You see, one is a logical statement because one would hope that newer OS's become more secure than their ancestors, while the other results in "You have offended my operating system of choice, prepare to die..."

--
My work here is dung.

Re:How Kind of You by Compholio · 2006-10-13 05:35 · Score: 1

"You have offended my operating system of choice, prepare to die..."
When he grows a sixth finger on his right hand and kills your father then we'll start paying attention, get used to people offending your OS. People offend mine and yours and everyone else's, it's just one of those things in life.
Re:How Kind of You by callmetheraven · 2006-10-13 05:38 · Score: 0

'most secure Windows ever'

Hmmm.... seems like I've heard this somewhere before... For some reason it brings a picture to my mind of Lucy holding the football for Charlie Brown...

--
You can have my SIG when you pry it from my cold, dead hands.
Re:How Kind of You by nine-times · 2006-10-13 05:44 · Score: 1

Well, I guess it depends on whose security Microsoft is talking about. It seems Microsoft has locked the end user out of the OS as much as possible, including a bunch of new DRM and anti-piracy measures. Your OS of choice probably isn't as secure against your own legitimate use as Windows Vista is.
Re:How Kind of You by Anarke_Incarnate · 2006-10-13 05:46 · Score: 1

your "SIG" is funny. I prefer my CZ though :)
Re:How Kind of You by BSOD+DOC · 2006-10-13 06:37 · Score: 0

That's inconceivable.

--
Nuns. No sense of humor. -Kurgan
Re:How Kind of You by enharmonix · 2006-10-13 07:53 · Score: 3, Funny

You keep using that word. I do not think it means what you think it means.
Re:How Kind of You by myowntrueself · 2006-10-13 08:16 · Score: 0, Troll

Well, I guess it depends on whose security Microsoft is talking about.

I thought it was obvious.

Whenever Microsoft talk about 'security' they don't mean 'computer security for users' they mean 'financial security for Microsoft Corporation'.

--
In the free world the media isn't government run; the government is media run.
Re:How Kind of You by Fyre2012 · 2006-10-13 08:27 · Score: 0

Microsoft has a new version out, Windows XP, which according to everybody is the 'most reliable Windows ever.

Is it still 2001, or did I miss something?
And this 'everybody'... i don't remember offering an opinion, but i guess they don't mean everybody when they say, uh, everybody... =\

--
This is not the greatest .sig in the world, no. This is just a tribute.
Re:How Kind of You by BuBu2 · 2006-10-13 10:23 · Score: 1

Microsoft has been condemned by a court in the UK for deceptive advertising...
Re:How Kind of You by BuBu2 · 2006-10-13 10:28 · Score: 1

I guess you mean the kind of security by obscurity which consists of hiding the system files in the windows explorer ?

Making the OS idiot-proof is not true security anyways...

Maybe, but this does nothing against viruses, spyware and the like...

It's still not proven that a virus can work on Linux or BSDs, so they have a long time to go before they can claim to be the most secure OS...
Re:How Kind of You by nine-times · 2006-10-13 10:35 · Score: 1

I guess you mean the kind of security by obscurity which consists of hiding the system files in the windows explorer ?

No, it was a sarcastic remark, referring to Microsoft's DRM and anti-piracy efforts in Vista.
Re:How Kind of You by jdray · 2006-10-13 11:02 · Score: 1

If only we had a storm cloak. And a lantern.

--
The Spoon
Updated 6/28/2011
Re:How Kind of You by BuBu2 · 2006-10-13 11:40 · Score: 1

Well, I can already tell that this will do nothing for security. Copying an mp3 is not a security risk :-)
Re:How Kind of You by drsmithy · 2006-10-13 21:20 · Score: 1

It's still not proven that a virus can work on Linux or BSDs, [...]
Uh, of course it is. A "virus" will "work" as well on Linux or the BSDs as it does on Windows, all else being equal.
Re:How Kind of You by BuBu2 · 2006-10-13 23:09 · Score: 1

Ok, let's assume this, but what would be the multiplication vector ?

Do you really think a linux user could easily be tricked into saving a suspicious e-mail attachment on the disk, adding the x flag, logging as root and attempting to run it ?

Have you heard such a thing as latex documents, man pages, pdf documents, etc... being infected with rogue macros ?

Why do Unix anti-virus scanners only search for Windows viruses in files that are typically hosted on Samba shares ? Why don't they recognize Linux viruses ??

Have you heard of a Web browser on Unix being hijacked by something like Active-X...

Why wouldn't Bill Gates simply create huge virus outbreaks for Linux instead of attempting to fool the world with ridiculous FUD arguments ?

How many Unix users run word processors, spreadsheets, e-mail clients, web browsers using the root account ? Even a total beginner wouldn't such a thing on Unix because the normal installation procedure asks the user to create a normal user account. Running as root would in fact be more complicated for the end user than running with his user account.

Is there any Unix machine in the world that is transformed in a zombie that sends spam ?

Have you heard of any Unix rootkit that would be automatically installed simply by inserting a CD or a removable device ?

How many Linux or Unix systems have their executable, drivers or system files writeable by users ?

There simply appear to be no credible virus threat on Linux at all, no propagation mechanism, no way that an eventual malicious program run inadvertently by a user could do any significant damage besides on his own files...

And please don't tell that it's a question of market share... Linux is widely deployed on servers which makes it an interesting target.
Re:How Kind of You by drsmithy · 2006-10-13 23:56 · Score: 1

Do you really think a linux user could easily be tricked into saving a suspicious e-mail attachment on the disk, adding the x flag, logging as root and attempting to run it ?
No, but this is because of the Linux *user*, not Linux. (Although many would argue it is indirectly because of Linux requiring more savvy users).
Added to that, the "logging in as root" part is largely unnecessary.
Have you heard such a thing as latex documents, man pages, pdf documents, etc... being infected with rogue macros ?
I seem to recall some problems with PDF documents...
The others, of course, aren't a valid comparison since they can't *have* those kinds of macros in them. Not to mention it's an application, not OS, issue.
Why do Unix anti-virus scanners only search for Windows viruses in files that are typically hosted on Samba shares ? Why don't they recognize Linux viruses ??
Because no-one bothers writing viruses for other platforms.
Have you heard of a Web browser on Unix being hijacked by something like Active-X...
I've heard of remote code execution bugs in versions of Netscape Navigator, yes.
Why wouldn't Bill Gates simply create huge virus outbreaks for Linux instead of attempting to fool the world with ridiculous FUD arguments ?
Because, unlike you, Bill Gates isn't an angry teenager who thinks causing damage is the solution to every problem.
From a technical perspective, because you need more than just malicious code to have a successful virus outbreak. Indeed, the code is the _simplest_ part.
How many Unix users run word processors, spreadsheets, e-mail clients, web browsers using the root account ?
How is this relevant ? You're talking about *users* again.
Even a total beginner wouldn't such a thing on Unix because the normal installation procedure asks the user to create a normal user account. Running as root would in fact be more complicated for the end user than running with his user account.
Bollocks. Running as root is not particularly hard (hey, some distros even do it by default). Running something as root is trivially easy on pretty much every distro ever made.
(And, again, running as root isn't even close to a requirement to be the victim of malicious code.)
Is there any Unix machine in the world that is transformed in a zombie that sends spam ?
Yes. Please don't tell me you're seriously going to try and say unix machines have never been compromised. Back when unix was young, its poor security was infamous.
Have you heard of any Unix rootkit that would be automatically installed simply by inserting a CD or a removable device ?
Nope. Doesn't mean it's impossible to do, however. OS X would be the most likely candidate for such an attack.
(Congratulations, that's the closest thing you've made to a valid point so far.)
How many Linux or Unix systems have their executable, drivers or system files writeable by users ?
OS X (well, everything in /Applications and a few other system areas are writable by "admin" users).
(Not that Windows _does_ have its "executables, drivers or system files" writable by users, mind you, so I'm not sure why you think that's a valid argument to start with.)
There simply appear to be no credible virus threat on Linux at all, no propagation mechanism, no way that an eventual malicious program run inadvertently by a user could do any significant damage besides on his own files...
The propogation mechanism is exactly the same as it is on Windows - users doing something silly.
And please don't tell that it's a question of market share...
Of course it is. Who's going to bother writing viruses that only a handful of users would be dumb enough to run ? At least OS X has the demographic to be a reasonable target for viruses and malware, but it lacks the marketshare for attacks t
Re:How Kind of You by BuBu2 · 2006-10-14 04:28 · Score: 1

>>Do you really think a linux user could easily be
>>tricked into saving a suspicious e-mail attachment
>>on the disk, adding the x flag, logging as root
>>and attempting to run it ?

>No, but this is because of the Linux *user*, not
>Linux. (Although many would argue it is indirectly
>because of Linux requiring more savvy users).

The difference is in Linux and it's application.

When a Windows user receives a zip file containing a file named hello.txt.exe", the default explorer settings makes it appear as "hello.txt", because of the "mask extension of known file type 'feature'".

Then instead of launching a command like "notepad.exe hello.txt" or opening a text editor and opening the file from withing, when you double-click on a file in Windows, it gets EXECUTED.

This is such an ill-design that it's not surprising that so many people are tricked.

>Added to that, the "logging in as root" part is largely unnecessary.

Ok, but in that case, the use would only be able to destroy its own files, which he's allowed to do anyways... Without Admin access, there is no spyware installation, no dirty tools added at the startup and the like. This makes a huge difference.

In the linux a stupid user would destroy its own data, in the Windows case, he has destroyed the whole OS and potentially infects other machines around...

>>Have you heard such a thing as latex documents, man
>>pages, pdf documents, etc... being infected with
>>rogue macros ?

>I seem to recall some problems with PDF documents...

Right, that was a security issue that was patched. To my knowledge noone had the time to exploit it, no user was victim of this. Again there is a big difference here. On Windows such flaws remain for years and MS only correct them when there are hundreds of thousands of machines infected.

>The others, of course, aren't a valid comparison since
>they can't *have* those kinds of macros in them.
Which is perfectly sensible from the security point of view.

>Not to mention it's an application, not OS, issue.
This is also an OS issue. Per default, on Windows, users are running with admin privileges. One small problem in an application and the whole system is compromised.

>>Why do Unix anti-virus scanners only search for
>>Windows viruses in files that are typically
>>hosted on Samba shares ? Why don't they recognize
>>Linux viruses ??
>Because no-one bothers writing viruses for other platforms.
Which is wrong. In the 80s and beginning of the 90s, there were numerous viruses for Amiga, Atari and Macintosh (the old generation before Mac OS X) Amiga and Atari were much more marginal than Linux.

So here again the difference is in the OS. Amiga, Atari and pre-OS X Macs had no security at all. Virus writers didn't wait for the market share to rise to write viruses.

>>Have you heard of a Web browser on Unix being hijacked
>>by something like Active-X...
>I've heard of remote code execution bugs in versions
>of Netscape Navigator, yes.
Again, same problem as with the pdf. This typically a security flaw in a particular version and that was corrected rapidly enough. I've never heard of anyone being actually attacked by this.

And also, there is an OS issue here. If such a flaw is exploited, it's obvious that OS were people are typically running as admin would create much more trouble.

>>Why wouldn't Bill Gates simply create huge virus
>>outbreaks for Linux instead of attempting to fool
>>the world with ridiculous FUD arguments ?
>Because, unlike you, Bill Gates isn't an angry
>teenager who thinks causing damage is the solution
>to every problem.
I'm not a teenager first of all. And yes, Bill Gates tries to damage Linux. Simply look at the SCO/Baystar/Microsoft scandal and the FUD from Redmond.

>From a te
Re:How Kind of You by drsmithy · 2006-10-14 19:15 · Score: 1

The difference is in Linux and it's application.
No, the difference is the average (and even below average) Linux user isn't going to randomly execute attachments they receive as email.
When a Windows user receives a zip file containing a file named hello.txt.exe", the default explorer settings makes it appear as "hello.txt", because of the "mask extension of known file type 'feature'".
This is a UI semantic, nothing more.
Then instead of launching a command like "notepad.exe hello.txt" or opening a text editor and opening the file from withing, when you double-click on a file in Windows, it gets EXECUTED.
Of course it gets executed - it's an executable file. Why wouldn't it ?
This is such an ill-design that it's not surprising that so many people are tricked.
Most of them would open the attachment even if it had .exe on the end.
Not that you can directly open executable attachments on any remotely recent version of Outlook or Outlook Express in the first place, making your whole argument moot.
(The real irony here is that GUIs like KDE and GNOME are, if anything, *more* vulnerable to this style of attack because they don't make any attempt to verify whether a file's extension matches its type. So a file called blah.txt, if it's really an executable binary, will be run as an executable binary regardless - rename a .exe to .txt in Windows and Explorer will just open the file in notepad.)
Ok, but in that case, the use would only be able to destroy its own files, which he's allowed to do anyways...
The user's files are typically the most important on the machine.
Without Admin access, there is no spyware installation, no dirty tools added at the startup and the like. This makes a huge difference.
Of course there is. The malware gets hidden away somewhere in ~ and the user's dotfiles and GUI are modified to relaunch it whenever they login (KDE, GNOME, etc - most have some sort of "launch on login" functionality).
In the linux a stupid user would destroy its own data, in the Windows case, he has destroyed the whole OS and potentially infects other machines around...
"Destroying the OS" barely qualifies as a minor irritation compared to losing all your data files - and root access is in no way a requirement to "infect other machines around".
Right, that was a security issue that was patched.
So are most of those holes you are talking about (launching executables from emails, etc)
To my knowledge noone had the time to exploit it, no user was victim of this.
This does not change the fact that the vulnerability existed (and exists, on any machine that is unpatched).
Again there is a big difference here. On Windows such flaws remain for years and MS only correct them when there are hundreds of thousands of machines infected.
With Windows, a flaw only needs to exist for a few hours and hundreds of thousands of machines are infected. That's why the marketshare aspect is so significant.
Which is perfectly sensible from the security point of view.
But not from a functionality point of view, if such macros are what you need. Ergo, the comparison is meaningless. It's like sayig Linux is a bloated piece of crap because DOS 1.0 can run on machines with 64k of RAM.
This is also an OS issue. Per default, on Windows, users are running with admin privileges. One small problem in an application and the whole system is compromised.
No, a vulnerability in an application is solely an application issue.
Or would you argue that a vulnerability in a daemon running as root is a Linux problem ?
Which is wrong. In the 80s and beginning of the 90s, there were numerous viruses for Amiga, Atari and Macintosh (the old generation before Mac OS X) Amiga and Atari were much more marginal than Linux.
I f
Re:How Kind of You by BuBu2 · 2006-10-15 05:00 · Score: 1

>>When a Windows user receives a zip file containing a file
>>named hello.txt.exe", the default explorer settings makes
>>it appear as "hello.txt", because of the "mask extension
>>of known file type 'feature'".
>This is a UI semantic, nothing more.

Right, but this is dangerous (this allows to lure users) and this doesn't bring anything to the user. After all the trouble it caused, why hasn't MS simply made the default to show the complete filename ?

>>Then instead of launching a command like "notepad.exe hello.txt"
>>or opening a text editor and opening the file from within, when
>>you double-click on a file in Windows, it gets EXECUTED.
>Of course it gets executed - it's an executable file. Why
>wouldn't it ?

Because an application like a mail reader shouldn't expect to
receive executable code from an e-mail. So the file shouldn't
be executable. Again, a minor tweak that could save people a lot
of problems. Why on hell should a data file (a file generated with
a "Save As..." dialog) be executable ? It would be a minor tweak in
default Windows permissions, not to put the "Execute" flag.
Like on Unix: saving a file puts the permissions to "-rw-------", not to "-rwx------".

>Not that you can directly open executable attachments on any
>remotely recent version of Outlook or Outlook Express in the
>first place, making your whole argument moot.

Ok, so some minor progress from MS...

>(The real irony here is that GUIs like KDE and GNOME are,
>if anything, *more* vulnerable to this style of attack
>because they don't make any attempt to verify whether a
>file's extension matches its type. So a file called blah.txt,
>if it's really an executable binary, will be run as an executable
>binary regardless - rename a .exe to .txt in Windows and Explorer
>will just open the file in notepad.)

No, sorry this is wrong. The mechanism is to associate a file extension with a program to view it. mpg files are associated with xine or mplayer typically. If you feed mplayer with an executable, it would say something like unknown file format, no codec found for this file, etc... txt files are associated with KEdit, typically. When there is no extension, the file isen't associated with anything and the user can eventually choose a program to open with. But the file is never run.
Doing a command like:
$ mplayer malicious.mpg
is very different than:
$ chmod u+x malicious.mpg
$ ./malicious.mpg
The former requires only a mouse click and can happen by accident, but is harmless.
The latter not.

>>Ok, but in that case, the use would only be able to destroy
>>its own files, which he's allowed to do anyways...

>The user's files are typically the most important on the machine.

I agree for a home PC. (mono-user) Else there are other's users files that are more important.

>>Without Admin access, there is no spyware installation, no
>>dirty tools added at the startup and the like. This makes
>>a huge difference.

>Of course there is. The malware gets hidden away somewhere in
>~ and the user's dotfiles and GUI are modified to relaunch it
>whenever they login (KDE, GNOME, etc - most have some sort of
>"launch on login" functionality).

Right... There could be an attack vector here. But this assumes that the user has already executed a rogue executable.

>>In the linux a stupid user would destroy its own data, in the
>>Windows case, he has destroyed the whole OS and potentially
>>infects other machines around...

>"Destroying the OS" barely qualifies as a minor irritation
>compared to losing all your data files

Well, we're talking here about people needing to reinstall Windows every 6 months due to spyware
Re:How Kind of You by drsmithy · 2006-10-15 16:47 · Score: 1

Right, but this is dangerous (this allows to lure users) and this doesn't bring anything to the user. After all the trouble it caused, why hasn't MS simply made the default to show the complete filename ?
Same reason Apple hides them - because numerous UI studies have shown that most end users don't like them, don't know what they mean and generally find them confusing.
Because an application like a mail reader shouldn't expect to receive executable code from an e-mail.
People use email for exchanging files. Lots of people seem to think this is a bad thing, but nevertheless, that's what it gets used for (largely because there aren't any alternatives that are similarly quick and easy).
So the file shouldn't be executable. Again, a minor tweak that could save people a lot of problems. Why on hell should a data file (a file generated with a "Save As..." dialog) be executable ?
Because *it's an executable binary*.
It would be a minor tweak in default Windows permissions, not to put the "Execute" flag.
And a UI nightmare as people try to figure out why they hell they can't run things.
Ok, so some minor progress from MS...
That happened years ago. Your criticisms would carry more weight if they were a bit more current.
No, sorry this is wrong.
No, it's not. Most GUIs like KDE and GNOME try to identify filetypes by snooping inside them to see what they are (equivalent to the file(1) utility). They typically make no attempt to determine whether or not a binary that just happens to be called "blah.txt" really is a text file.
The mechanism is to associate a file extension with a program to view it.
This is how Windows works.
mpg files are associated with xine or mplayer typically. If you feed mplayer with an executable, it would say something like unknown file format, no codec found for this file, etc... txt files are associated with KEdit, typically. When there is no extension, the file isen't associated with anything and the user can eventually choose a program to open with. But the file is never run.
If you copy a binary (say, xeyes) onto your GNOME or KDE desktop, rename it to something like xeyes.txt then double-click it, xeyes will open (or should, at any rate - it does on Ubuntu). It will *not* open it up in a text editor (which is what Windows would do, because its filetype handling is based on extensions).
I agree for a home PC. (mono-user) Else there are other's users files that are more important.
This discussion is not about managed desktop PCs. They are a completely different ballgame to unmanaged (ie: home) desktop PCs with radically different exposure and risk profiles. Servers are radically different again.
Right... There could be an attack vector here. But this assumes that the user has already executed a rogue executable.
As do most of your Windows examples.
Well, we're talking here about people needing to reinstall Windows every 6 months due to spyware and the like...
Which is basically irrelevant compared to losing, say, twelve months worth of Doctoral thesis work or all the original photos and movies from your daughter's wedding.
Sorry, this does not really work like this.
Yes, it does. A particularly prolific virus could easily infect thousands of Windows machines in a matter of hours.
A software developer first badly codes something.
Virus and malware attacks are frequently not the result of bad coding.
After a delay between hours and years, it's discovered by someone and eventually other people.
Viruses and malware do not typically exploit OS vulnerabilities.
In the open source world, it's then corrected.
If someone can be bothered.
In the Windows world, noone cares to correct this. (In fact, people are typically not even allowed to correct it)
False. No ma

default password by gEvil+(beta) · 2006-10-13 05:33 · Score: 4, Funny

I heard a rumor that the default admin password is "chair"

--
This guy's the limit!

Re:default password by hkgroove · 2006-10-13 05:39 · Score: 1

Yes, if you want to access the new Spike feature of Longhorn.
Re:default password by entrylevel · 2006-10-13 05:44 · Score: 5, Funny

You just FUCKING KILLED any hope of this being the most secure Windows ever!

--
Karma: Incomprehensible (Mostly affected by posting at +5, reading at -1, and metamoderating everything unfair.)
Re:default password by Klaidas · 2006-10-13 06:00 · Score: 1

*insert "that's the same thing I have on my luggage!" unfunny joke*
*wait to be modded +5, Funny*
???
Profit! No, wait...
Re:default password by cpu_fusion · 2006-10-13 06:05 · Score: 1

Hilarious.!!!!.
It's either that or "developersdevelopersdevelopers"
Re:default password by PPH · 2006-10-13 06:23 · Score: 5, Funny

If you try 'chair', it will be thrown as an exception.

--
Have gnu, will travel.
Re:default password by querist · 2006-10-13 07:41 · Score: 2, Funny

I thought throwing chairs was the rule, not the exception.
Re:default password by Anonymous Coward · 2006-10-13 08:52 · Score: 0

Will Steve Balmer's head catch it, then?

chair

chair

chair

oh, what the heck!
while (1) printf("chair\n");
Re:default password by techno-vampire · 2006-10-13 10:53 · Score: 1

Considering the number of munchkins out there, I'd have expected the default password to be ponies.

OMG!!!! PONIES!

--
Good, inexpensive web hosting
Re:default password by MarkRose · 2006-10-13 13:17 · Score: 1

Those chair jokes aren't sofa king funny any more...

--
Be relentless!

Bend over by Anonymous Coward · 2006-10-13 05:34 · Score: 0

cuz your organization's network is about to get fsck'd.

If this is true... by gg3po · 2006-10-13 05:34 · Score: 1

Then the last thing left that MS had promised for Vista just got cut. After cutting WinFS, Monad, IE7 (not exclusive to Vista, anyway), etc. the only thing left that it had going for it was supposedly going to be the tighter security. Well, I guess you still have a flashy (read: annoying) new gui to look forward to.

--
---

Re:If this is true... by cnettel · 2006-10-13 05:52 · Score: 1

A local setup of Vista, with default settings, will deny remote access for accounts with an empty password. (The same is basically true in XP SP2, at least.) The efforts in Vista hasn't been centered on physical security of the machine, "click to login" won't give you malware. I would rather assume that this fact in the current release of Longhorn Server would rather be the very result of the code sharing with Vista, where they probably haven't focused on getting the setup UI right for the server version with each change in the client. The Server version will be released several months after Vista, with another Beta 3 still not released, followed by some RCs, so they have plenty of time to fix this. (The setup and configuring wizards have been among the things that can change a lot quite late on in the game, this was true of XP, and it has also been true of Vista).
Re:If this is true... by From+A+Far+Away+Land · 2006-10-13 05:52 · Score: 3, Informative

Don't forget that it includes PVP DRM, meaning Microsoft can compell your monitor not to show video unless it's sure that you've bought a comercial video disc.

--
Oh You POS
Re:If this is true... by Ucklak · 2006-10-13 05:57 · Score: 1

...you still have a flashy (read: annoying) new gui to look forward to.

Only to those who shell out $250+ for it.
I believe the under $200 ones don't have that fancy schmancy, hoity toity see through gui.

--
if you steal from one source, that is plagiarism, if you steal from many, well, that's just research.
Re:If this is true... by gg3po · 2006-10-13 06:01 · Score: 1

Don't forget that it includes PVP DRM, meaning Microsoft can compell your monitor not to show video unless it's sure that you've bought a comercial video disc.

I just can't believe how brazen they've become. All these new "features" are really bugs. DRM, Trusted computing, first-born demanding EULA's, annoying swirling, flashing, transparent interfaces -- I don't want any of that! They seem to be relying entirely on their marketing department this go around.

--
---
Re:If this is true... by TrancePhreak · 2006-10-13 09:16 · Score: 1

You belief is probably based on a novel you read while sleeping during a large drinking binge.

--

-]Phreak Out[-

Should I tag this.... by Omnivorax · 2006-10-13 05:35 · Score: 2, Funny

...both "fud" and "notfud", to save everyone else the trouble?

Re:Should I tag this.... by Anonymous Coward · 2006-10-13 05:37 · Score: 0

"yes" and "no"
Re:Should I tag this.... by Pharmboy · 2006-10-13 05:45 · Score: 1

maybe?

--
Tequila: It's not just for breakfast anymore!
Re:Should I tag this.... by Anonymous Coward · 2006-10-13 09:51 · Score: 0

Done

Microsoft always says... by zwilliams07 · 2006-10-13 05:35 · Score: 2, Funny

"Most secure ever."

Then about 10 minutes later there about 30 pieces of malware, and 120 holes in the system.

Re:Microsoft always says... by Anonymous Coward · 2006-10-13 05:59 · Score: 1, Insightful

"Then about 10 minutes later there about 30 pieces of malware, and 120 holes in the system." - by zwilliams07 (840650) on Friday October 13, @01:35PM (#16426139)

It said -> 'most secure Windows ever'

Note the word Windows there, you slashdot OpenSource Pro-Linux loser?

Ha... no wonder your OS is always in last place: Your type can't even READ properly!
Re:Microsoft always says... by Anonymous Coward · 2006-10-13 06:55 · Score: 0

But hey, that's down from 5 minutes and 200 holes . . .
Re:Microsoft always says... by Anonymous Coward · 2006-10-13 08:21 · Score: 0

They really do. Anybody know of a version of Windows that Microsoft hasn't claimed is the most secure ever?
Re:Microsoft always says... by The+Friendly+Grizzly · 2006-10-15 06:37 · Score: 1

Windows Version 1.0?

Asparagus by justinbach · 2006-10-13 05:36 · Score: 4, Funny

To me, this is like saying that asparagus is 'the most articulate vegetable ever.'"

I think I'd want to check with the corn on that one--after all, aren't they the ones with *ears*?
*ducks*

--
I left my wallet in El Sigundo!

Re:Asparagus by Anonymous Coward · 2006-10-13 05:41 · Score: 0

He said articulate not auriculate.
Re:Asparagus by gEvil+(beta) · 2006-10-13 05:45 · Score: 1

Since when has having ears ever made anyone articulate? That's right up there with saying that potatoes must be smart cos they have eyes...Sheesh...

--
This guy's the limit!
Re:Asparagus by salzbrot · 2006-10-13 06:28 · Score: 1

Well, that's why he is checking with the corn, because that would be the vegetable that knows... Sheesh, use your eyes, umm, I mean brain :)
Re:Asparagus by smoker2 · 2006-10-13 06:34 · Score: 1

To me, this is like saying that asparagus is 'the most articulate vegetable ever.'
And there was me thinking it was the oesophagus !.
Re:Asparagus by Anonymous Coward · 2006-10-13 07:17 · Score: 0

May I point out that the cauliflower is the brain of the fruit kingdom...?
Re:Asparagus by jimlintott · 2006-10-13 07:25 · Score: 1

Corn isn't a vegetable.

It's a grass and therefore a cereal crop.

Did you know? by Anonymous Coward · 2006-10-13 05:47 · Score: 5, Informative

Accounts with blank passwords CANNOT be used as a network credential EVER! No remote service. No terminal server. No shares. No printer. No nothing! Since XP SP1.

Maybe not the brightest thing in a beta install (will this be in production?). But you would have to have local physical access to the server terminal to exploit this security hole.

Server is dead by Anonymous Coward · 2006-10-13 05:47 · Score: 0

I took me 5 minutes to get through.

"Windows Vista is the most secure Windows ever!" -- or so Microsoft claims. That's not much of a boast however, I mean, if an operating system doesn't get more secure as it progresses and evolves, there is certainly something fishy going on. So we weren't too impressed by those claims in particular. But that doesn't mean Vista isn't actually secure (especially when compared to the competition). In fact, Windows Vista's end-user security is down-right excellent, as we reviewed it back when RC1 came out.

"So what's the problem?" Windows "Longhorn" Server is!

No, we're not joking. Under the circumstances, we wish we were too. But we're not. While Windows Vista's security has steadily improved build-by-build, and while Longhorn's kernel and applications may be more secure, Windows Longhorn Server as a whole most certainly isn't. Why?

* Because it never prompts you to set an Administrator password!
Longhorn Server actually completely installs, sets up the firewall, dowloads the latest security updates and then "forgets" to set an administrator password. Maybe it's not that bad -- after all, these are IT admins using this product, certainly they won't forget to set a password, will they? Even though Windows Longhorn Server can go the whole way and install Active Directory and create a Domain Administrator account without asking for a password! But maybe Microsoft just has faith in our IT administrators today...
* What about password complexity models?
Yes, they're gone too. Everyone at some point complained about Microsoft's extremely stringent password complexity requirements that every user - domain admin or otherwise - had to comply to in order to protect their account. Yet, it most certainly was better than letting users pick any old password - but even that was better than nothing. Because that's what Longhorn Server's password complexity requirement is: nothing! It doesn't care if you assign new users a password or not; and should you choose to use the user's name as his or her password, it doesn't mind. Your password can be a letter or ten, it can be all numbers or symbolic, 1337-speak or not, to Longhorn Server: it doesn't matter.

What happened to Windows Server? Where did all of the stringent security checks and ultra-protection of Windows Server 2003 go? Windows Server 2000 was quite insecure, and Windows Server 2003 turned over a new leaf.. But it seems Microsoft is more than willing to flip that page back - even Windows Server 2000 required an Administrator password at the very least.

Like we hinted earlier though, the entire structure of Windows Longhorn Server is more secure. The way it processes data, the way IIS 7 has been designed, the intelligent firewall that ships with the Server OS (for the first time), and more; Longhorn Server really did look quite good. But now it doesn't even ask for a password.. What's up with that?!

It's Like Voltron... by A+Wise+Guy · 2006-10-13 05:47 · Score: 1

Every week a new and more powerful RO-Beast comes out with improved powers capable of defeating voltron but voltron prevails....Not that I'm implying that Voltron is windows of course.

If Vista's licensing is any indication of... by Anonymous Coward · 2006-10-13 05:48 · Score: 1, Funny

...whatever kind of harsh new license will ship with the longhorn server, then it will likely indeed be the most secure server software ever, since by the time longhorn ships, the license will undoubtedly forbid you from installing it on any machine period.

Bummer by HangingChad · 2006-10-13 05:49 · Score: 2, Funny

You mean asparagus isn't the most articulate vegetable ever? Dang, guess that means I'll have to send back that plaque I ordered for the Articulate Vegetable Awards show.

--
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage

I've got your secure Windows right here bud by davidwr · 2006-10-13 05:56 · Score: 1

As with any operating system, Windows is only as secure as the people allowed to touch it.

Show me an isolated computer network behind a locked door in an EMF-proof room where nothing unapproved ever comes in or out, and I'll show you a secure network.

This assumes of course that you can trust your people.

Short of that, we must do the best we can. As the anonymous reader points out, Microsoft isn't.

--
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.

Venus Fly Trap by Nick+Driver · 2006-10-13 06:01 · Score: 1

Well... if we stretch the definition of "vegetable" to include plants that aren't historically eaten by humans, then the Venus Fly Trap would have to win the "most articulate" title.

Re:Venus Fly Trap by i.r.id10t · 2006-10-13 06:16 · Score: 1

Mimosas (clicky for GIS) fold their leaves up at night and after touching things like my face when I'm mowing the lawn, and they are much bigger (therefore more moving parts) than a VFT, so maybe they'd be more articulate?

--
Don't blame me, I voted for Kodos
Re:Venus Fly Trap by gardyloo · 2006-10-13 08:12 · Score: 1

Mimosas (clicky for GIS) fold their leaves up at night and after touching things like my face when I'm mowing the lawn [...]

Man, how *are* you mowing that lawn?
Re:Venus Fly Trap by mackyrae · 2006-10-13 08:23 · Score: 1

But VFTs have mouths, and mimosas don't.

--
look! it's a bird, it's a plane, it's....a girl? yes, a girl browsing Slashdot on Linux

If the author is creating a new domain in Longhorn by Utopia · 2006-10-13 06:02 · Score: 1

server then the machine Admin password is the same as domain admin password.

Re:Need Some Help with FTP by Anonymous Coward · 2006-10-13 06:05 · Score: 0

I hope this was a joke.. If not, just give us your ip so we can have a giggle. I'm sure it will be full in about a week.

windows 2000 server is insecure? by Anonymous Coward · 2006-10-13 06:05 · Score: 0

Really? Not if you configure it right.

Windows 2000 is very solid, well documented and well understood. It doesn't have any of the bloat, desktop eye candy, activation crap or psycho licensing requirements. Works great under vmware. Easy to clone with ghost. Migrating to differe

Which is why there still is a large installed base of windows 2000 in the business world. There will be big problems when microsoft stops releasing security patches for win2000 in 2010 or so - do you stick with a great OS or move to something else?

Re:windows 2000 server is insecure? by TheNetAvenger · 2006-10-13 06:47 · Score: 0, Troll

And it runs at 20% slower than Windows 2003 Server, oh and has less features and capabilities as well.

Why people insist on using older OSes because they thinking they are gaining something amazes me.

Why not install CPM or Novell 2.11 as well they were 'secure' for their time?

Not to mention all the software hacks and incompatibilities and limitations, like not even being able to run the lastest RDP protocols to running something like SQL Server 2005. Why on earth would you stick or choose Win2k, if you are going to spend money on a Server OS? You would be far better off with Windows2003.

This stuff amazes me, and these are probably high paid techs steering every company down a bad path just because they think they 'know' better.
Re:windows 2000 server is insecure? by BSOD+DOC · 2006-10-13 06:53 · Score: 0

You are a Micro$oft Marketing Department wet dream, wanting to buy any crap they spew out, thinking it must be better, because the other stuff is older.

--
Nuns. No sense of humor. -Kurgan
Re:windows 2000 server is insecure? by Petaris · 2006-10-13 07:19 · Score: 1

I use win2k servers, they do what I need and they are secure enought for this enviornment. If it serves the purpose and there is no improvement that you need badly enough to want to upgrade then why do it? Upgrading just to upgrade is not only a waste of money but a waste of time, there has to be some feature or security patch you need bad enough to justify the cost of the licenses, the cost of all new CALs, the down time to implement, and your time to do testing and planning. Basically it boils down to the age old addage of "If it isn't broken, don't fix it."

That being said I am planning a move to Novell OES, as it better supports cross authentication for my other Linux servers and workstations.

--
~Petaris "The world is open. Are you?"
Re:windows 2000 server is insecure? by Anonymous Coward · 2006-10-13 09:34 · Score: 0

has less features and capabilities as well.

Yes, there are new features in win2003. Not all of them are useful to all companies though.

Why people insist on using older OSes because they thinking they are gaining something amazes me.

Well, I'm getting less complexity, and avoiding the cost & hassle of an upgrade. The costs of an upgrade (licensing, validation, testing, deployment) are not trivial in the real world.

like not even being able to run the lastest RDP protocols

You're right, RDP was greatly improved in win2003. RDP now supports sound and 24-bit color. You know what? Many businesses don't care about that. If an employee is using win2000 RDP with 8-bit color and no sound, then they aren't spending lots of time on youtube. Many businesses like that kind of thing.

Especially if you have to throw away all your old terminal server licenses and buy new ones for 2003. The license fees will cost about $150 per user to convert our terminal servers to 2003, not to mention the admin time. Multiply by a thousand users, and it's not chump change. The benefits of upgrading are not great for us, and the upgrade costs are substantial.

You would be far better off with Windows2003.

Having evaluated 2003 (MS lets you download a 6-month version of win2003 for free), my company would only be slightly better off. And slightly better off is not worth the upgrade cost. Your company might be different.

This stuff amazes me, and these are probably high paid techs steering every company down a bad path just because they think they 'know' better.

In the real world, highly paid IT people look at costs & benefits of IT decisions. And for many, the benefits of win2003 don't outweigh the costs.
Re:windows 2000 server is insecure? by TheNetAvenger · 2006-10-13 14:35 · Score: 1

Actually I have a large team of engineers that professionally test and work with Servers, software and hardware in general.

Our teams can also explain advantages to various *nix server solutions from Linux and BSD to Solaris and even OSX server implementation models.

Since this was about Win2k Server specifically, we have our own hard facts and selling Win2k to your customers over Windows2003 is just plain stupid for many reasons.

Oh and I don't work for MS...
Re:windows 2000 server is insecure? by TheNetAvenger · 2006-10-13 14:41 · Score: 1

I use win2k servers, they do what I need and they are secure enought for this enviornment. If it serves the purpose and there is no improvement that you need badly enough to want to upgrade then why do it?

This I agree with...

My point was for people putting out money for new server installations. We run across techs all the time that STILL deploy Win2k (not saving any money over Windows2003), because they think it is a better solution. Often many of these techs are afraid of or know little about Windows2003, so they stick to what they know and try to sell the customer that it is the best solution.

You are correct there is no logical reason to force and upgrade unless there is a need for the upgrade by the customer. This is something I should have made more clear in my post.

We still have closed system clients running NT 4.0 systems because they are in a locked network environment and the customer does not need the extra features or cannot afford the upgrade costs.

However for customers or techs out there that are getting a new installation with Win2k on the Desktop or the Server, you are being conned by a bad tech or you are a bad tech conning your customers.
Re:windows 2000 server is insecure? by TheNetAvenger · 2006-10-13 14:54 · Score: 1

I would argue that there are many benefits of Windows2003 over Win2k that often get overlooked, or are not factored in by many techs. There are also some strong reasons that should be considered to compel businesses that can afford the upgrades to move to Windows2003. One little feature like more advances in clustering or even something as simple as shadow mirror files or even the replication features of Windows2003 R2 can save businesses money in the long run and even save data that is irreplaceable.

However, I wasn't arguing for everyone to upgrade. Unless there is a clear need for the upgrade, then I agree 100% that the cost of upgrades are not necessary, even if they are running Windows NT 3.1 or Novel 3.x. (Yes, we even have clients that use old Server software, because they can't afford it nor do they have a need to change.)

I was making a point that for a new deployment it would be stupid to choose Win2k Server or Windows2003 Server.

I see all too many times that there are techs and deployment projects that are still dropping NEW installations with Win2k, usually because the techs are only certified for Win2k or don't have enough knowledge of Windows2003. This is insane and hurts the customers, even if the techs try to justify the use of Win2k with myths about it being the same, or faster, or several other non-true cons.

If you are paying for the software anyway, why get an older version that truly isn't as secure, fast or advanced?

This is a beta OS. Everything can and will change. by postbigbang · 2006-10-13 06:06 · Score: 3, Informative

Lots of testers and researchers give VERY LOW SCORES when passwords aren't treated like they ought to be. What with machines that can do 100,000+ dictionary attacks per second, busting weak passwords is comparative childs play.

So it's a bit specious to lob this at Microsoft, when the operating system isn't even due to be at RC for as much as a year. If you use this in production environments, you're not very wise.

Not that I particularly like Microsoft, but fair is fair-- this is far from release code.

--
---- Teach Peace. It's Cheaper Than War.

Remember the Audience by Chabil+Ha' · 2006-10-13 06:11 · Score: 1

Those who get the Longhorn Server hopefully aren't dopey attachment clickers, either. Remember who your audience is. As an admin, sure it would be nice if it asked me for the password, but passwords are another item on my checklist anyway. For those who are going to be administering the server, I see it as a non-issue.

--
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others

Re:Remember the Audience by Ajehals · 2006-10-13 08:08 · Score: 2, Insightful

You are giving the admins - even some of the non attachment clickers a lot of credit... - This is an OS Small and medium business' use because it "just works"(tm) ad because windows admins are cheap. Its almost completely configurable by wizard for Christs sake, and the wizards do not include everything that you may need to look at from a security point of view.

Now I am not suggesting that everything should be configured in at a CLI or eve that the admin should just be presented with a load of MMC snapins and no guidance, but the ease with which an apparently working server can be set up and configured is worrying - especially if security related tasks are not included in the wizards...

I have come across enough 2k/2k3 server admins who do not understand the OS at all and don't really understand what they are doing with it, they are sort of learning as they go (in production environments). This is not because they are stupid (inexperienced, ill qualified certainly.. but nor stupid) but because they were "good" at using windows and just scaled up, all the nice step by step wizards meant they didn't have to bother with learning anything more complex or in depth. In effect there are a huge number of windows admins out there who are really power users, and who really do need their hand holding fully, or need to come across an OS where everything is of by default, and to turn it o you need to have an understanding of what you are doing, or in the very least have to do some research..

Just - additionally these tend to be the admins who are unaware of and do not take advantage of whole segments of their OS's capabilities (Active Directory / Group Policy / Scripting / RIS / DFS etc.. (its been a while sorry if the names have changed..)) ad ed up convincing even less knowledgeable management to buy software that either puts a shiny front end over an existing feature (the multitude of AD Management suits that do nothing to enhance manageability) - or that replicates functionality (like software deployment) without using the component that is present - leading the company into even more of a lock in situation, but now with multiple products...

Ad yeah I know you get what you pay for, and I know its down to management etc.. but Windows server is *deceptively* easy to manage...

--------

just as a side note on your "hopefully aren't dopey attachment clickers" comment - I do penetration testing and security audits on a fairly regular basis, one of the simple tests we used to run was emailing an executable attachment that simply wrote a file to disk (or some such activity - initially we had it display warnings etc... then found the silent ones more interesting..) ad what we found was that most of the IT admins that received it (initially somewhere in the 60% area) virus scanned it and then executed it - this was when it came from a legitimate company address with a note saying that "X received this and needs it to do Y"... on a number of occasions admins executed it whilst logged into their personal machines with domain level admin accounts (which they should never have been logged in as anyway...).

On a couple of occasions instructions in a mail from a random email address and with spuriously written c0NTent advising the user to rename the attached .doc to .exe and report back to a fictitious person were actually carried out - and repeatedly by the same guys - all because the AV thought it was OK.

Ad this is after awareness training and having a laugh about who got caught out last time. So no admins are not necessarily and better at not clicking attachments as common users - they just have less of an excuse

(Not sure I got my point across - brain is not working...)
Re:Remember the Audience by toadlife · 2006-10-13 11:34 · Score: 1

"Not sure I got my point across..."

You did. I guess I am one of those rare Windows admins who use all of the tools that Windows provides. You forgot a really useful one: IPSEC. Though I've met a few online, I've yet to meet a Windows admin in "real life" that doesn't rely on tons of really expensive "front ends" to things that Windows allready has.

The part about the IT admins executing the attachments...as a $&%#$! domain admin...is familiar. I pestered my coworkers for the better part of two years before finally convincing them to stop logging onto their damn machines as domain admins. My next challenge...getting them to run their machines without local admin privs.

One step at a time I guess. :\

--
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.

Deja vu? by larien · 2006-10-13 06:13 · Score: 1, Troll

Microsoft have been touting the "more secure" and "more stable" line for about 10 years, much as washing powder manufacturers would tout "New Ariel, washes even whiter".

In short, Windows NT was buggy, unstable and full of security holes. Which we all knew at the time, even if MS didn't admit it. Unfortunately, people don't question them on this and say "so, if this is more secure, runs things twice as fast and doesn't crash, what is this pile of shit you've been selling us for the last few years? Mmm???"

Re:Deja vu? by ad0gg · 2006-10-13 06:21 · Score: 1, Insightful

Win NT was crashed? Ummm. Yeah. Pass me what your smoking. I count on one hand all the times i've seen NT 4.0, win2k and 2003 crashed on one hand. And thats dozens of servers of the course of 7 years.

--
Have you ever been to a turkish prison?
Re:Deja vu? by kwark · 2006-10-13 09:10 · Score: 1

So what YOU can't see doesn't exist? My limited experience with NT servers showed me some rock solid machines, but also machines that needed scheduled reboots to avoid unpredictable lockups (similar machines with similar tasks).

But from the small sample of machine I have personally seen, I can tell that the latter category was bigger.
Re:Deja vu? by hotdiggitydawg · 2006-10-13 10:34 · Score: 1

I count on one hand all the times i've seen NT 4.0, win2k and 2003 crashed on one hand.
Eh? You could count all the times you've seen NT 4.0, win2k and 2003 crashed on one hand, on one hand could you? So how many times have they crashed on one hand then? Perhaps you shouldn't have touched what he was smoking after all...
Re:Deja vu? by Anonymous Coward · 2006-10-13 15:43 · Score: 0

I can count to 32 on one hand, and 1024 on two hands using binary.

Re:If the author is creating a new domain in Longh by Utopia · 2006-10-13 06:16 · Score: 3, Informative

I should also point out that by default the machine administrator account is disabled.
So no amount of password-cracking software will let you log-in as admin.

What do you do.... by LordPhantom · 2006-10-13 06:20 · Score: 1, Insightful

when Longhorn Server lets you install the OS, set up Active Directory, and initialize the domain without once asking you even to create an administrator password?

Some ideas:

* Hire intelligent administrators who won't put a box without password on the network?

* Don't use it, or use it as little as possible for your specific needs?
|
->(caveat) If your CIO tells you you -must- use windows servers, explain to him that you would, but they require a "token ring" and all of them fell into the "ethernet" and they must be found first. Much like telling an idiot to sit in the corner of a round room, it will distract him for the better part of the next quarter.
.

Re:What do you do.... by jimicus · 2006-10-13 08:13 · Score: 1

If your CIO tells you you -must- use windows servers, explain to him that you would, but they require a "token ring" and all of them fell into the "ethernet" and they must be found first. Much like telling an idiot to sit in the corner of a round room, it will distract him for the better part of the next quarter.

Your CIO doesn't need to demand Windows servers.

Certainly IME, what actually happens is the powers that be demand something on their desktop which happens to depend on a Windows server - something like Outlook complete with all the shared calendaring features (yes I know plugins for alternative server solutions exist, show me one which doesn't suck and is cheaper than Exchange), or some financial or reporting software package which demands SQL server.
Re:What do you do.... by Slashcrap · 2006-10-13 10:13 · Score: 0

->(caveat) If your CIO tells you you -must- use windows servers, explain to him that you would, but they require a "token ring" and all of them fell into the "ethernet" and they must be found first. Much like telling an idiot to sit in the corner of a round room, it will distract him for the better part of the next quarter.

The BOFH is strong in this one.
Re:What do you do.... by LordPhantom · 2006-10-13 10:15 · Score: 1

As Slash____ below this has noted, the *woosh* sound is the humor in that going over your head - obviously the reason the CIO needs to demand Windows servers is that the Users have obviously tried to talk to you before, but a few well placed sexual harassment lawsuits and a mysterious wave of vandalism to employee cars from the HR department has caused them to suspect that the issue might be better taken up with your superior.

Right, this is a question of physical security by brokeninside · 2006-10-13 06:21 · Score: 5, Insightful

Physical access to a machine already gives a local attacker everything they need to change the admin password. If it's a Linux box, it's simply a matter of booting into single user mode. If it's a Windows box, it's simply a matter of using any of half a dozen freely available utilities.

But if there is no admin password, the server cannot authenticate the Administrator account from across the network. This essentially means that by default Administrator is a physical access only account. I don't see how that is startling insecure. In fact, it's a step in the right direction.

Re:Right, this is a question of physical security by Anonymous Coward · 2006-10-13 06:46 · Score: 0

Think sudo su, and pressing enter for empty password prompt

or

right-click->run as.. -> administrator -> ok
and you're in with admin access..

All it takes is one local user with weak password.
Re:Right, this is a question of physical security by dave562 · 2006-10-13 06:53 · Score: 1

It's good read a post from someone who understands what is going on, and the actual dynamics involved in the situation.
Re:Right, this is a question of physical security by Anonymous Coward · 2006-10-13 07:31 · Score: 0

No, that doesn't work either.
Re:Right, this is a question of physical security by toadlife · 2006-10-13 07:43 · Score: 2, Informative

Nope.

By default, an account with a blank password cannot be used with "runas".

--
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Re:Right, this is a question of physical security by mackyrae · 2006-10-13 08:26 · Score: 1

On Ubuntu, you can't get past the "log in" screen without a password. If you walk up to a computer that's already logged in, you'll get a password prompt if you try to do anything administrator-ish. Either way, they only way you're getting is if you know the password.

--
look! it's a bird, it's a plane, it's....a girl? yes, a girl browsing Slashdot on Linux
Re:Right, this is a question of physical security by RajivSLK · 2006-10-13 21:44 · Score: 1

1) Throw in a knoppix cd
2) boot
3) vi /etc/passwd OR /etc/shadow and delete the garbled text between colons
4) eject cd drive
5) reboot
Re:Right, this is a question of physical security by Gnavpot · 2006-10-14 01:08 · Score: 1

1) Throw in a knoppix cd 2) boot 3) vi /etc/passwd OR /etc/shadow and delete the garbled text between colons 4) eject cd drive 5) reboot
6) Find that your /etc/passwd and /etc/shadow is unchanged. Try this command: 'man mount'.

How about by El+Lobo · 2006-10-13 06:32 · Score: 0, Informative

reading the fucking manual nwebie? If you are installing a server as a member of a domain, it will use the domain administrator account because the LOCAL administrator is anyway DISABLED, so there is no need to PROMPT you for a password that already exists. Gee, you don't even deserve to be in this site. Or maybe 98% of this site's users are like you?

--
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!

Re:This is a beta OS. Everything can and will chan by DrScott · 2006-10-13 06:32 · Score: 1

Until SP2 comes out, it's still a beta.

remote logins disabled? by mikeormike · 2006-10-13 06:35 · Score: 0

Correct me if I'm wrong, but I thought remote (administrator) logins were disabled until the password was set. (I know this still doesn't bode well for physical security, but I think this deserves mention if true.)

Re:If the author is creating a new domain in Longh by BSOD+DOC · 2006-10-13 06:42 · Score: 0

Just make the password the same as the domain name.

--
Nuns. No sense of humor. -Kurgan

Re:Need Some Help with FTP by Anonymous Coward · 2006-10-13 06:50 · Score: 0

We don't have it on the internet yet. Our network guy will set up some kind of translation for full access next week, so I don't yet have an IP to post. But we're in the 66.93.10.0 network. That's our ISP's (Covad in Seattle? That's what one of the guys in the networking office thinks) network anyways from what I can see on the default gateway here. Once I have an IP address I'll be more than happy to post it so we can all test together. I'm still having trouble figuring out how to get anonymous logins full access to the /mnt/data directory. Also, how do I get 'ls' in the unix command prompt to show me how much the total space is on the drive? The box came preconfigured from a vendor, but they don't support us Unix level-wise. In Windows I just type DIR and I get a list of what's in the folder and how much I have free. The ls help doesn't tell me how to do the same thing. Thanks.

Sounds like a bug in the installer by PPGMD · 2006-10-13 06:52 · Score: 3, Insightful

IMO it simply sounds like a bug in the installer, the Windows 2000 and 2003 both asked for you to set the default administrator password during the install, sounds like someone forgot to put that in the install options. It's an early beta, with 6 months or more until release, bugs like these often happen.

If it makes it's way into the shipping product at least how it's described I'll eat my own hat.

Re:Sounds like a bug in the installer by Joe+U · 2006-10-13 07:11 · Score: 1

Actually, it sounds like it's still mostly Vista.

Since they both use the same codebase, I'm betting the installer isn't anywhere near finished. They're too busy working on the client to worry about the server beta right now.
Re:Sounds like a bug in the installer by getwhipped · 2006-10-13 09:48 · Score: 1

If it makes it's way into the shipping product at least how it's described, I'll eat my own hat.

I'm going to hold you to that.

--
get whipped (you know you like it)
Re:Sounds like a bug in the installer by archen · 2006-10-13 11:19 · Score: 1

Personally I don't think this is a big deal, but keep in mind that Microsoft is supposed to be keeping to the "security is everything mantra". The fact that authentication is sort of bolted on afterwards makes me wonder where else MS is just stuffing in security stuff as an afterthought.

Just a minute ... by taniwha · 2006-10-13 06:54 · Score: 1

Doesn't that mean it's NOT running as administrator? if it gets hacked they don't get admin access to the account .... why that's almost like .... linux. All they need to add now is a chroot jail and they'd be cooking ....

Re:Just a minute ... by ConceptJunkie · 2006-10-13 08:01 · Score: 1

"chroot jail"? Is that something for incarcerating cigars?

BWAHAHAHAHAH!

(It's 4 p.m. on a Friday, cut me some slack).

--
You are in a maze of twisty little passages, all alike.

Better by Drakin020 · 2006-10-13 07:12 · Score: 0

The way I see it, it allows for the administrator to set it at his own will. I thought this is what everyone wanted? An OS that stays out of the way and lets you make the choice. If you are an administrator that does not think to set a password then you dont belong in the field.

--
The greatest revenge in life is massive success.

What's "Longhorn" by raftpeople · 2006-10-13 07:14 · Score: 1

Wasn't that some product from a few years ago? I can't even remember what it did.

Re:What's "Longhorn" by Anonymous Coward · 2006-10-13 07:34 · Score: 1, Informative

"Longhorn Server" is still the code name for the successor to Windows Server 2003. "Longhorn" was also the code name for Windows Vista prior to them giving it a new name for marketing purposes.

-ShadowRanger
Re:What's "Longhorn" by vtcodger · 2006-10-13 08:05 · Score: 1

***Wasn't that some product from a few years ago? I can't even remember what it did.***
It did anything you wanted. Imaginary products are like that.
I'm still waiting for Cairo. I believe that if they ever build it, it'll satisfy my computing needs for a decade or two. Assuming of course that the license allows me to install it.

--
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey

Re:This is a beta OS. Everything can and will chan by postbigbang · 2006-10-13 07:17 · Score: 1

Longhorn Server, a/k/a Windows 2007 Server Editions (seven that I count) are not due until at least six months from the release of Vista. My take is that means roughly May for gold code, and the SP2 is by Microsoft's formula, a year behind that, so 2008.

But worry? Is there something hot in Windows 2007 Server that I'm missing?

--
---- Teach Peace. It's Cheaper Than War.

Well, on the other hand... by Jugalator · 2006-10-13 07:26 · Score: 3, Insightful

Any admin that have such a non-existant sense of security that he/she don't bother setting any admin password, regardless if the setup routine force the admin to do it or not at some point, has pretty much doomed the overall security of that system anyway. An admin that need to be nannied through every aspect of setting up a server, including such basic things as controlling the passwords are OK, shouldn't really touch a live server somehow related to network connectivity.

--
Beware: In C++, your friends can see your privates!

Chair by Fallen+Mongoose · 2006-10-13 07:31 · Score: 2, Funny

Now there's a word you don't hear people throwing around as much these days.

I *really* hate to come out swinging for MS... by Dputiger · 2006-10-13 07:43 · Score: 3, Interesting

But I have to, as far as the Dave Barry quote goes, especially since it wasn't even related to the story being linked. I've used every Windows OS going back to 2.0, and run my main system on 95, 98SE, ME (briefly, and just to see if it was really that bad), 2K, and XP. I've done tech support for both businesses and consumers, I've built systems for people, and I've reviewed computer hardware for years--and in the process of doing all that, I've seen a lot of Windows installations on a lot of different hardware, from brand-new to dying of old age.

There are a lot of things I don't like about Microsoft, and there are a lot of areas where I think their products could be improved and streamlined--but I think a lot of people (both here and elsewhere) throw out disparaging remarks about XP in certain areas just because it's fashionable, or convenient, especially about system stability. XP may have had its kinks early on, but I'd say its been incredibly stable / reliable since at least SP1. I reboot my home rig, on average, maybe once a month--and that's typically a choice, not a forced situation. I've had one hard crash / reboot situation in the past 6 months. It's not just a system that sits idle all day, either--I work from home, game, and do all my multimedia / browsing, IM'ing, etc, all from the same box. Now yes, if you start to factor security updates into the "reliability" equation, WindowsXP starts to look a bit less shiny. If you assume that "WindowsXP" also means "WindowsXP + IE6", that's even worse...but hey, that's why I use Firefox.

People can argue that they hate the XP GUI--that's opinion. You can argue it's bloated, or you hate WGA, or Product Activation, or whatever, and you can argue about security issues all day long. But measured in terms of basic reliability--no BSODs, no inexplicable driver failures or failed device detection, and no random reboots--XP blows the doors off any of the Win9X products, and is arguably better than 2K in some performance and multimedia areas. (Hyper-Threading is the one area where I distinctly remember XP outperforming 2K--other areas I'd have to dig for at the moment).

I'm all for calling a spade a spade, but part of doing that fairly means admitting when a company gets something right--and anyone still pretending that Microsoft hasn't made huge strides in stability, reliability, features, and performance since the Win9X days needs to go out and actually try to set up (and then modify) a 98SE box. I've had to do so recently, and it's not a pretty picture. I still remember how to jump through all the various hoops, but that doesn't mean I miss them.

Re:I *really* hate to come out swinging for MS... by pandrijeczko · 2006-10-13 10:48 · Score: 1, Insightful

I am primarily a Linux user but I also use XP and cannot honestly remember the last time it blue screened or crashed one me.
Yep, it feels bloated compared to my GCC flag-optimised Gentoo Linux machines running a streamlined GUI like XFCE4 but whether I like it or not, I can knock out the best looking and quickest presentations in PowerPoint.
May be one day I'll be proficient enough in OpenOffice to knock out documents as quickly in that, maybe one day games companies will release games natively on Linux. But until then, I've got the choice of the best applications from "both worlds" and can edit stuff in vi or Word along with the best of them.
The sooner people stop *taking sides* as a fashion statement and just using the tools they need to get a job done, the better. There are too many damn zealots about on Slashdot - and, yes, I'm also talking about the Windows zealots that feel they have the right to an opinion on Linux without ever having tried it.
What's more important is that people from both camps unite in the fight against the evils of DRM and overly strong copyright laws - you can still use Windows and not use Media Player's DRM features and if you're that worried about security then start off by using Firefox instead of IE and Thunderbird instead of Outlook.

--
Gentoo Linux - another day, another USE flag.
Re:I *really* hate to come out swinging for MS... by smash · 2006-10-13 11:58 · Score: 1

So you do security updates once a month then?

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Re:I *really* hate to come out swinging for MS... by Dputiger · 2006-10-15 11:02 · Score: 1

I assume you're referring to my "I reboot once a month" comment, and the answer is no, I do security updates when I feel they're necessary or important. As for rebooting, I'd say the biggest two reasons I do it are either because I'm planning to dust out the system (which I do about once a month), or because a random bit of software actually needs one after being installed or updated. If it's not those two, it's because I like to periodically give the system a fresh boot, the same way I like to periodically vacuum the house vents (pick your periodic chore, here). The point is, it's no longer a matter of "Oops, gotta reboot after 24 hours or else my performance in applications X, Y, and Z will suck."

Re:I agree by Anonymous Coward · 2006-10-13 07:46 · Score: 0

Fat chance of that.

root has no password on my Mac by brokeninside · 2006-10-13 07:50 · Score: 1

I type sudo on my Mac and the system asks for a password. I hit enter and it tells me that the password is invalid. Why? Because sudo doesn't work like that. It asks for the password of the user account calling the sudo, not the root password.

Also, the last time I installed Ubuntu, the default setup was to not use a root password.

You're assuming, probably fallaciously, that Vista is not going to be similarly structured.

Speculations by bruno.fatia · 2006-10-13 07:51 · Score: 2, Insightful

Everybody just keep speculating about Vista and Longhorn server, why don't you just leave Microsoft alone for once and wait for them to lose some money with defective OS? Gee..

Re:Speculations by Anonymous Coward · 2006-10-13 08:15 · Score: 0

"why don't you just leave Microsoft alone for once and wait for them to lose some money with defective OS?"

Because a few will die before Longhorn is released and most will die before MS loses money on a OS.

Old Joke by TheNinjaroach · 2006-10-13 07:59 · Score: 1

Not funny anymore, I move to retire "chair" jokes on Slashdot.

--
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..

Re:Old Joke by Anonymous Coward · 2006-10-13 09:27 · Score: 0

On Soviet Slashdot, chair jokes retire YOU!!

Linux vs. Windows, Apples and Oranges by Anonymous Coward · 2006-10-13 08:31 · Score: 0

I can't wait until Linux/Unix gets mainstream and Average Joe starts using it.

I wouldn't expect it to last long before everyone starts bashing Linux for how unreliable and annoying the UI is.

That's Apples and Oranges for you, I guess.

Re:Linux vs. Windows, Apples and Oranges by pandrijeczko · 2006-10-13 10:29 · Score: 1

Then you have a long wait...
It won't go mainstream and that's speaking as someone who uses Linux far more than Windows - no, I'm no zealot either. To me an operating system is just a toolkit, I find a greater degree of satisfaction using Linux but am also more than happy to knock out training presentations in PowerPoint - end of story.
But using Linux effectively requires investment of time to learn how a computer works and how to make the OS work for you - Joe Average who just wants to play a few games, download his photos and write a few emails has no need for Linux. He should stick with Windows and good luck to him.
And would you care to explain to me *which* UI is annoying? I have to ask as Linux has many of them including the Bash shell, KDE, Gnome, XFCE, Enlightenment, etc. etc. as you will no doubt already know since you deem yourself qualified to make this kind of generic statement about them.
If there's one thing worse than a true Linux zealot, it's someone like yourself that bases their opinion on hearsay rather than true experience or fact...

--
Gentoo Linux - another day, another USE flag.

ya, but..... by Anonymous Coward · 2006-10-13 08:47 · Score: 0

...you better keep that mower at full throttle and in high gear if you are mowing around kudzu....

no way!! by DeadboltX · 2006-10-13 08:49 · Score: 1

who in their right mind would use a beta server as a production OS anyway

Re:This is a beta OS. Everything can and will chan by PaxTech · 2006-10-13 09:30 · Score: 1

If you use this in production environments, you're not very wise.

And this differs from "finished" versions of Windows exactly how?

--
All movements for social change begin as missions, evolve into businesses, and end up as rackets.

Local Admin account disabled by default by Grandpa+Elwood · 2006-10-13 11:01 · Score: 1

And you can't remotely connect using an account with a blank password. So this is more secure.

Re:This is a beta OS. Everything can and will chan by BuBu2 · 2006-10-13 11:52 · Score: 1

Don't worry to much about weak passwords in Windows...
The most important security problems in Windows are:
1) Users running on their machine with admin privilege. This is completely stupid (no Unix user would read mail and surf the web as root), but this is Microsoft default.
2) Bad code which allows buffer overflow, stack smashing, etc.. attacks.

There are hundreds of millions of Windows PC infected with malware and this is not due to weak passwords...

It's called "faint praise"... by argent · 2006-10-13 11:57 · Score: 1

XP blows the doors off any of the Win9X products, and is arguably better than 2K in some performance and multimedia areas.

Windows NT4 and Windows NT 3.51 and Windows NT 3.1 all blew the doors off Windows 9x. So did OS 2, BeOS, AmigaDOS, and... well, the only OS that wasn't significantly better across the board was classic MacOS... and for most users Mac OS (bad as it was) was more reliable.

So the point is that saying XP was "the most reliable Windows ever" was such faint praise that for most people it made it sound much much worse than it was.

You forgot the most important security feature by caller9 · 2006-10-13 12:26 · Score: 1

Longhorn will introduce double whammy IKE/kerberos/samba. You thought your samba client dropped a turd when you got 2003 running, just wait for Longhorn. Each XP(minimum) client system will have a unique copyrighted certificate that requires the server to call home to validate it before temporarily adding it to the cert store. This will be used to create a tunnel that must be used on all further transactions until it expires in 2 hours and the mothership must be contacted again.

Each copyrighted cert on the XP machines cannot be duplicated legally and requires activation and replacement from Redmond every 48 hours.

Thus it is somewhat more secure.. but mostly secure from non windows interlopers due to copyright and need for almost constant contact with the internet.

I made all this up but honestly wouldn't put it past them. Good news is there are plenty of linux based NAS solutions out there...which will be locked out of AD/LDAP by some proprietary garbage or the other.

I just hope I'm there when MS drives the final nail into their own coffin. There has to be a tipping point somewhere.

Re:This is a beta OS. Everything can and will chan by postbigbang · 2006-10-13 14:48 · Score: 1

The goofy thing is that Lindows users do in fact run as root. Go figure.

Bad code? No one does that, either.

I sincerely believe that the next version will be better, but XP was swiss cheese. Can you learn a lesson that big in six years? Sorry for being rhetorical.

--
---- Teach Peace. It's Cheaper Than War.

IBM? by Rhinobird · 2006-10-13 22:54 · Score: 1

while the other results in "You have offended my operating system of choice, prepare to die...

My name is Inigo B Montoya, you killed my OS, prepare to die.
IBM was wronged as a child, who knew?

--
If Mr. Edison had thought smarter he wouldn't sweat as much. --Nikola Tesla

Wrong. by Anonymous Coward · 2006-10-14 01:32 · Score: 0

Since XP SP1 at least, accounts without passwords cannot be be used remotely. That means no file / print sharing, MMC admin or remote desktop. As the GP said, the account effectively does not exist.

Re:Wrong. by techno-vampire · 2006-10-14 05:35 · Score: 1

I was thinking of direct access, not remote. You don't even need to run any special program to reset the Admin password, just log on. That can lead to people logging on as Admin on impulse, just because they can, and messing up your box while you're at lunch. Not a Good Idea!

--
Good, inexpensive web hosting
Re:Wrong. by Anonymous Coward · 2006-10-14 16:46 · Score: 0

I was thinking of direct access, not remote. You don't even need to run any special program to reset the Admin password, just log on. That can lead to people logging on as Admin on impulse, just because they can, and messing up your box while you're at lunch. Not a Good Idea!
It generally considered a really bad idea to not have important boxes locked up in a room with strong physical security. If I can put my hands on the box, I can generally circumvent your security. It is possible to takes some extraordinary measures that would resiste most attacks, but almost nobody takes those measures.

Why bother waiting 'til the login screen comes up? by brokeninside · 2006-10-14 02:37 · Score: 1

1. Boot to single user mode at lilo or whatever boot manager is being used.
2. Boot from an external device.
3. Replace the harddrive.

Unless the existing disk in cryptographically secure and/or the machine is physically built with security in mine (locked case, password on the bios, etc.) physical access gives the user everything they need.

Re:Why bother waiting 'til the login screen comes by mackyrae · 2006-10-14 08:07 · Score: 1

I've looked in the boot options in Grub (had to, I had a kernel that didn't support my ethernet card and had to boot on an old one for a bit), and there's no "single user" option in there. A password on the BIOS isn't hard to do either though. But I'll agree, stealing the hard drive can make anything easy.

--
look! it's a bird, it's a plane, it's....a girl? yes, a girl browsing Slashdot on Linux

Admittedly, I've never used Grub ... by brokeninside · 2006-10-15 06:43 · Score: 1

... but Google suggests you're wrong about single user mode and Grub.

But that is neither here nor there. The point is that physical security trumps all. The point I was answering seemed to be claiming that an Administrative password somehow increases security at the local layer. At a practical level, it might deter the 5% of people who want administrative access and aren't familar with how to get it without knowing the password for an administrative account.

Slashdot Mirror

Longhorn Server's "Improved" Security

151 comments