MS Security Guy Wants Vista Bugs Rated Down

jcatcw writes "Gregg Keizer reports that Michael Howard, an MS senior security program manager, says that the Microsoft Security Response Center (MSRC) is being too conservative in its Vista vulnerability rating plans. Microsoft's own bug hunters should cut Windows Vista some slack and rate its vulnerabilities differently because of the operating system's new, baked-in defenses."

Comments

Hmmmm. . .

[bplipschitz]

Sounds a little like Michael Howard might be "baked in". . .

Re:Hmmmm. . .

[Raven42rac]

And I want a pony and a dodge viper.

Re:Hmmmm. . .

[galenoftheshadows]

How 'bout just plain baked . . .

Isn't that .....

[edwardpickman]

rate its vulnerabilities differently because of the operating system's new, baked-in defenses."

...half baked?

Re:Isn't that .....

[Anonymous Coward]

No, I believe Michael Howard is totally and utterly baked. He clearly needs to stop hitting that bong.

Re:Isn't that .....

[numbski]

You'd have to be smoking some pretty good weed to go along with this. :P

Let's say on *nix there's a vulnerability that allows for remote ssh access. You can only get in as an unprivileged user, heck, you may even get /dev/null as your shell, but it lets you in. Do you rate down the remote access flaw because of *nix's "baked in " defenses? No! You fix the bug and update.

Just because your system is overall more secure doesn't mean that you don't blow the whistle on the flaws just as hard. It's called VIGILANCE.

Re:Isn't that .....

[turing_m]

Yes, it looks like those new security defenses could do with another session in the oven.

Re:Isn't that .....

[Locutus]

It sure sounds like "the most secure Windows ever" has been over cooked.

LoB

Re:Isn't that .....

[ericlondaits]

Just because your system is overall more secure doesn't mean that you don't blow the whistle on the flaws just as hard. It's called VIGILANCE.

Mmmm... while it's true that the price of freedom is eternal VIGILANCE, remember that you can get Vista Ultimate for as little as $399.95.

Re:Isn't that .....

[Gnavpot]

Do you rate down the remote access flaw because of *nix's "baked in " defenses? No! You fix the bug and update.

Did you intend those two scenarios to be mutally exclusive?

Rating a bug low does not necessarily mean that it is fixed slower.

Re:Isn't that .....

[Hierarch]

Let's say on *nix there's a vulnerability that allows for remote ssh access. You can only get in as an unprivileged user, heck, you may even get /dev/null as your shell, but it lets you in. Do you rate down the remote access flaw because of *nix's "baked in " defenses? No! You fix the bug and update.

Well, actually, you do rate it down. This is basic risk assessment, and if it comes to a prioritization of resources — which bug should we fix next? — I want that priority set according to the impact of the problem. Cold, hard, rational assessment, not “ZOMGRemoteAccessExploitWTFBBQOver”

You seem to assume that reducing the rating of a flaw means you don't fix it.

Now, more importantly, from TFA, we have

[The] rating system is clear-cut. If an Internet worm can spread without user action -- the MSRC's definition of "critical" -- on Vista, the vulnerability will be so tagged, Vista-specific security technologies notwithstanding.

This is different from the case you're outlining, and if the bloke in this article is really trying to change these criteria, I've got a real problem with that. If it's the difference between a buffer overrun that allows remote access versus a buffer overrun that allows an outsider to crash that process, I think it's the MSRC that needs to correct their own criteria. Either way, it shouldn't be driven by an outsider, although he can and should make the suggestion to them that certain criteria should be revisited.

Re:Isn't that .....

[Anonymous Coward]

Just because your system is overall more secure doesn't mean that you don't blow the whistle on the flaws just as hard. It's called VIGILANCE

Really? Because that seems to be the rationalle used by all the anti-MS people as a reason to switch from Windows: that the non-Windows OS's are more secure because of their obscurity.

If I had a dollar for every time I heard some OS X or Linux tool trying to convince someone to "switch" because, and they spew almost the exact same FUD every time, supposedly "Spyware and Virus writers only write them for Windows".

That doesn't seem like a very vigilant attitude to me... whereas Windows users tend to gain at least a basic appreciation for proper security practices.

Re:Isn't that .....

[Seumas]

Nothing says security like naming your flagship product after the part of a house that is made of thin glass and can be broken with a small rock, stick or an elbow and allows everyone outside to see everything going on inside.

Re:Isn't that .....

[UncleTogie]

whereas Windows users tend to gain at least a basic appreciation for proper security practices.
Don't take this personally, but:

What frickin' planet are YOU on? Most Windows users expect Windows to take care of all that FOR them....and boy, are they surprised to find that clicking that "You're infected! Click here to pretend to fix your computer whilst actually infecting it!" actually DOESN'T fix a darn thing. I'm not talking ALL Windows users, but it's a frighteningly large group.

What MOST Windows users want is a system that doesn't make them THINK.

Re:Isn't that .....

[Miseph]

"That doesn't seem like a very vigilant attitude to me... whereas Windows users tend to gain at least a basic appreciation for proper security practices."

While the first part is true, Windows users (myself included), by definition, are ignoring one fundamental security practice... they aren't using a secure system in the first place. It's like making sure your front door is bolted shut and you've got bars over all your windows, but your house only has three walls (and it's not triangular).

Re:Isn't that .....

[ozbird]

remember that you can get Vista Ultimate for as little as $399.95.

"You keep using that word. I do not think it means what you think it means."

Re:Isn't that .....

[Anonymous Coward]

Because that seems to be the rationalle used by all the anti-MS people as a reason to switch from Windows: that the non-Windows OS's are more secure because of their obscurity.

Really? Where have you seen this argument being made? Knowlegable people tell you to switch from Windows because other systems are actually designed with some sense of security in mind. Calling non-Microsoft operating systems "obscure" just makes you a troll; go take a look at who's systems are running on servers across the globe and get back to us. I'll give you a hint: Microsoft don't have the majority share.

Re:Isn't that .....

[tdelaney]

There's a difference between severity and priority.

A bug may be high severity (e.g. remote access) but low priority (e.g. because it's believed that other factors mitigate the remote access).

Another bug may be low severity (e.g. a user interface quirk) but high priority (e.g. because reviewers have seen it and are talking down your product because of it).

Severities should be based on how much damage may be caused to the *users* of the program. Priorities are usually determined by how much damage the bug causes to the *developers* of the program ...

Re:Isn't that .....

[VertigoAce]

Either way, it shouldn't be driven by an outsider, although he can and should make the suggestion to them that certain criteria should be revisited.

To give some context to who Michael Howard is, he is one of the head security guys at Microsoft. One of his roles is to improve the development process across Microsoft to improve security. So the MSRC responds to actual security vulnerabilities, while Michael looks at why the development team missed the bug and how to avoid it in future products.

If you read what Michael actually said the issue becomes more apparent. A security bug that affect Vista and XP will usually be given the same rating, even if Vista has defense mechanisms that it make it extremely unlikely that it can be exploited. In the security alert they will list any defense mechanisms that make it harder to exploit the bug, but they don't change the rating.

Re:Isn't that .....

[suv4x4]

What MOST Windows users want is a system that doesn't make them THINK.

You're saying that as if it's a bad thing. Do you insist on an OS that makes you think a lot?

While you're thinking on the OS you could be thinking on the next YouTube or something. Why waste so much talent? Anyway, if Microsoft survives Vista (which it'll most likely do), and has success with Vienna, we'll have exactly that: proliferation of managed, secure code and deprecation of binary code (which will run in sandbox) except for a range of professional applications (media processing, database engines and so on resource intensive tasks).

Re:Isn't that .....

[causality]

While you're thinking on the OS you could be thinking on the next YouTube or something. Why waste so much talent?

You say that as though the amount of thinking a person can do is a finite quantity, and that each time you think you decrease this quantity, so therefore the wise thing to do is conserve it as much as possible.

However, it's really more like a muscle -- the more you use it, the more able it becomes. Linux made me think very much when I first began using it, especially considering that this was 1997 so as you can imagine, the automatic graphical/menu-driven installers were not nearly as good as they are now. It took a decent amount of thinking to come to an understanding of why the system works the way that it does, but having done this I can now make related decisions instantly. I also learned a lot about how to find my own answers, which is also a skill that comes more easily now than it did before.

You're saying that as if it's a bad thing. Do you insist on an OS that makes you think a lot?

Depriving me of the ability to make security decisions on my own, on the premise that making those decisions requires thinking and well that's just too hard, is not my idea of the proper role of an operating system. The OS is not "making" me think, because all of the thinking done is inherent to the task performed; for example if I am setting up a network then I am thinking of how I want this done, what steps I will take to secure it, which computers will be used for what tasks, etc. The thinking is inherent in the task, just as sowing seed is implied by wanting to reap a harvest.

The thinking required cannot really be separated from the task; the best approximation is to have the designer of the system (Microsoft, in this case) try to determine in advance what you will and won't do and set defaults that attempt to please everybody. This is, of course, directed more by marketing's idea of what they think most people want rather than the developers' ideas of what is technically superior. That is (imho) the biggest difference between the Microsoft approach and that used by most Linux distributions.

To sum it up, no I do not believe that thinking is a bad thing, and thinking in particular is one of those things that I would much rather do myself than have someone try to do for me.

Re:Isn't that .....

[mgiuca]

Really? Because that seems to be the rationalle used by all the anti-MS people as a reason to switch from Windows: that the non-Windows OS's are more secure because of their obscurity.

Actually, "security through obscurity" is the term for the security practise of locking up your source code, keeping encryption keys secret, hiding bugs from the public, and hoping nobody finds them.

You know, the Microsoft way?

But I do get what you're saying (that there are more viruses on Windows because it is more popular). This is true, it's a factor. But another huge factor is the fact that Windows is built on a horribly flawed security model. Almost all other OSes (Linux, Mac, FreeBSD) are built upon the UNIX security model, which is far superior from the ground up.

Re:Isn't that .....

[lanzz]

while it's true that the price of freedom is eternal VIGILANCE, remember that you can get Vista Ultimate for as little as $399.95. perhaps they should release a new edition, Vista Vigilante?

Re:Isn't that .....

[LifesABeach]

I can not help but think that,"Vista Ultimate", should be viewed as a "Warning Label".

"...And I should know..." - Doritos Advertisement

Re:Isn't that .....

[Ximogen]

In my experience what most users of Windows, MacOS, OS2 etc. want is an OS 'that doesn't make them THINK', in this respect the typical Linux user is probably an exception.

I am a Windows user* and general user of PC's since the mid 80's and even I would admit that I'd like an OS that didn't require me to think, I have enough trouble with the applications!

* You just can't get decent music production tools for anything but Windows and MacOS, and I'll not touch anything from Apple with a bargepole. If you belive otherwise let me know as I'd be interested to find out. I currently use Cubase 4 as my primary music production application along with an extensive library of VST instruments, effects and mastering tools. So any Linux (either open or closed source) alternative would need to support VST 2.0 & 3.0.

Re:Isn't that .....

[db32]

You must be new here. Can you restate that analogy in reference to a car? Thank you.

Re:Isn't that .....

[greginnj]

...while it's true that the price of freedom is eternal VIGILANCE, remember that you can get Vista Ultimate for as little as $399.95.

Underscoring the point that Vista and Freedom have very little to do with each other...

Re:Isn't that .....

[suv4x4]

You say that as though the amount of thinking a person can do is a finite quantity, and that each time you think you decrease this quantity, so therefore the wise thing to do is conserve it as much as possible.

However, it's really more like a muscle -- the more you use it, the more able it becomes.

It's separation of concerns - the basics of team work and higher organisations. It's a very basic premise which most open source software folks miss.

You may be learning hella lot, and be great everything, train that "brain muscle", but when you're trying to succeed in a certain project/business, anything which could be separated as a concern but is not, is noise which makes you less productive.

Never mind how much you train your gigantic brain, punch cards will lead to lower performance than a good gui/cli combo.

When you train, it helps you lift more and more weights, more and more times. But you still won't grow extra arms, legs and attention spans that let you use all the equipment in a gym *at once*.

Hal Howard

[Anonymous Coward]

I work at Microsoft, I can get Vista for practically free but I refuse to even touch Vista with a bargepole and dont recommend it to others. They dont need it anyway even if it was "finished" and secure.

Re:Hal Howard

[Anonymous Coward]

Same here, except for me its the lack of mission critical third party support thats killing me.

Re:Hal Howard

[Anonymous Coward]

Man, you aren't even *good* at trying to sound like an insider. Regardless of how you view Microsoft's products, their employees are smart people (several friends of mine from college, whom I respect quite a bit, are up there as we speak). You sound like a twelve year old haxor.

Re:Hal Howard

[seaturnip]

You sound like a twelve year old haxor.

Uhh, he didn't even make any spelling mistakes? I don't see any particular reason to doubt his claim.

(I combed through your post to point out spelling mistakes of your own, but you even managed to use "whom" properly, so this usually reliable form of Slashdot comeback fails for once. Nicely done, sir!)

Re:Hal Howard

[Anonymous Coward]

I work at Microsoft, I can get Vista for practically free but I refuse to even touch Vista with a bargepole and dont recommend it to others. They dont need it anyway even if it was "finished" and secure.

You sound like a contractor that is bitter you didn't get hired on. Those of us are employees of MS want to make certain that we get the remaining bugs fixed. That isn't going to happen if we point fingers and play the blame game.

I work on embedded devices at MS and we won't have Vista support ready for a couple more months. Once the Visual Studio GDR is released in Apr/May Windows Embedded 6 will release SP1 and it will then be possible to develop/debug embedded devices from Vista and I will update all of my machines. Until then I have machines running Vista and XP. If you did work at MS you would have been interested enough to take a look at it. You would have grabbed the source code for both Vista and XP so that you could compare them, but since you are obviously just a contractor you don't have that ability. If you could do it you would find that the Vista code base is much cleaner. The 70% rewrite that was done was worth it. The new kernel is modular and agile. There is still room left for some performance tweaks, but from an engineering standpoint it is beautiful. Over the next few years this will become very important. It took years to get the embedded version of XP ready, but thanks to the changes to the Vista kernel we should have Vista Embedded ready in less than a year. Once we strip out the shell, the graphics, and most of the managed code we will have a nice version that will run on a fraction of the resources required on the desktop.

When people ask me whether they should switch to Vista I generally tell them to stick with what their computer came with. If they are ordering a new computer then I ask them what they are ordering and recommend Vista if they are ordering a powerful machine. There are currently a few issues left with some applications, and there are many drivers that are not yet available for Vista. However, that situation is changing rapidly, and when Vista SP1 is released many of those problems will be fixed. A large part of the problem is that in order to make security better there were massive changes to the interfaces between user and kernel space, and the entire driver subsytem was rearchitected so that all drivers run in user space. We painstakingly went through and added as much backwards compatibility as we could into the system. However, there are literally millions of Windows programs that have been written, and we do not have copies of all of them. When a user finds a new program that doesn't work we do add it to a list of programs that are known to not work. Developers are constantly working to add back-compatibility support for the applications that don't work based on the popularity of the application.

Re:Hal Howard

[pallmall1]

Wow, you really do work for Microsoft! With typical Microsoft doublespeak, you just said Vista is really great, a major improvement in every area. It's beautiful, (as long as you don't actually try to use it.)

Re:Hal Howard

[Seumas]

Only practically free? I'm surprised you can't get it for absolutely no cost whatsoever, Mr. Balmer.

Re:Hal Howard

[LinuxIsRetarded]

I work at Microsoft, I can get Vista for practically free but I refuse to even touch Vista with a bargepole and dont recommend it to others. They dont need it anyway even if it was "finished" and secure.

Nice try, Linus.

Re:Hal Howard

[joeme1]

Just wondering here, what the hell is a bargepole? I looked it up in my trusty (maybe not so trusty?) dictionary. I couldn't find it.

Re:Hal Howard

[innocent_white_lamb]

A bargepole is a long stick that is used to push a small boat (barge) away from the dock, other boats, or any other objects that it may be necessary to go around.

Re:Hal Howard

[smash]

How about this: I *don't* work for microsoft. I have a copy of Vista's Ultimate Edition ISO and a timer-stop crack. I have a PC that will run it quite happily (2gig, p4-d 3.0, nvidia 7600, ~ 0.7tb of disk with about 300gb free).

I haven't installed it, and don't plan on it any time soon, because there is no incentive for me to do so.

Re:Hal Howard

[smash]

The new kernel is modular and agile

If this is really true, then why the hell do you need 1-2gb of ram for acceptable performance?

Sure, it will boot with 512mb, but it's like watching paint dry trying to actually do anything with it.

Re:Hal Howard

[techno-vampire]

Once we strip out the shell, the graphics, and most of the managed code we will have a nice version that will run on a fraction of the resources required on the desktop.

And at that point, you'll have a kernal that's almost half as fast as XP instead of the current one third as fast.

Re:Hal Howard

[rts008]

You are living in the present....shame on you!

A bargepole is anochronistic...get with the Winblows pogram!

Re:Hal Howard

[PastaLover]

When anybody asks me whether they should run Vista I tell them to at least wait till SP1 and preferrably SP2. And that is the only sane advice you can give them. Heck, I personally find XP to be the best windows so far and even that took till SP2 to be halfway usable (and secure). Running Vista now is like running linux 2.6.21. It might be cool, but it will probably just blow up in your face and you get to keep the pieces.

Re:Hal Howard

[jo42]

I don't work for Microsoft. I can get Vista for free. I refuse to touch Vista with a cattle prod - well, maybe to zap it into crispy bits.

Top that.

Re:Hal Howard

[joeme1]

Thanks.

A rough translation to human speech...

[dyfet]

"Your making us look bad, cant you lie a little, we do all the time..."

This was a public service translation, for those who have trouble understanding Microspeak...

Michael howard

[Ramble]

According to Michael Howard my post has been downgraded to only second post.

Its about the bug, not the environment

[Anonymous Coward]

This guy is IMO a narrow minded fool. Sure, Vista may have extra security features which can limit the extend of damage which a certain bug can do. But does this mean that these features have any impact on the severity of those bugs? Lets "translate" this to Linux:

Say a new local SSH exploit has been found allowing attackers to gain root privileges. Does the fact that you'd need user accounts which are actually useable by people make any difference on the severity of the exploit? "Gee, cut the homeuser some slack since they won't have any real user accounts to begin with. So stop scaring them and rate the bug as it really is?" ? But... The bug really is what it says to be. In my example its a critical issue, in the case of a Vista bug its Important.

Just because you may benefit from the extra security enhancements doesn't imply everyone else does. So please; cut out the idiocy and the desperate attempts to push Vista forward by focussing on all good points and ignoring the bad points, and simply keep calling things what they are. I for one now question the professionality of this guy.

Re:Its about the bug, not the environment

[NearlyHeadless]

If you've read Michael Howard's writings, he's certainly not a "narrow minded fool". On his blog, he talked about security features in the compiler and linker such as /GS and /SafeSEH. With these in place--and OS-based onese, such as Address Space Layout Randomization and Data Execution Prevention-- buffer overflows still exist, but are much harder to effectively exploit. Yes, the process will abort, so you could still have a denial of service attack, but you've greatly reduced the chance of a more serious remote code execution.

Note that OpenBSD is also adopting similar defense-in-depth strategies, including SSP and N^X. Adoption is much more haphazard on Linux Distros, so you may be at much more risk running an application such as SSH on Linux than on OpenBSD even when it is compiled from the same source code.

Re:Its about the bug, not the environment

[Anonymous Coward]

Actually, a slightly more accurate Linux version:

An vulnerability has been found that is exploitable only when the vulnerable application is running under sudo.

Since Linux doesn't guarantee that an application run as sudo is isolated from other apps running in the same window manager, and because Linux doesn't guarantee that there's no way that an application might be launched via sudo without the users permission, there is no security boundary around that application (Linux might have one - I don't know what Linux's security guarantees are).

This vulnerability is a critical vulnerability by Microsoft's measurements, but if there was a security boundary between sudo applications, the vulnerability would only be rated "important". Now to the vast majority of Linux users, it's only "Important", but because the sudo mitigation MIGHT be bypassed, it gets upgraded to "Critical"

Vista has a number of features that are intended to mitigate attacks - for instance there's ASLR (address space layout randomization (system code is loaded in a different place in each process)), NX (No-Execute (data pages can't be executed)), and most importantly LUA (Limited User Access (applications don't run as administrators)). But while these mitigations are almost certainly enough to stop most attacks, they aren't considered security boundaries - the OS doesn't guarantee that they're effective - a malware author MIGHT be able to bypass them.

So even though it will be extraordinarily difficult to exploit a vulnerability that is mitigated by any of these features, it still MIGHT be possible to mitigate the vulnerability. Because the Microsoft security people are totally conservative when it comes to measuring risk, they assume that every one of these mitigations has been bypassed (or disabled), and measure vulnerabilities accordingly.

Re:Its about the bug, not the environment

[Anonymous Coward]

I agree with the sentiment, but please don't make it sound as if OpenBSD is just now adopting those security strategies with that last paragraph of yours.

Re:Its about the bug, not the environment

[Anonymous Coward]

Note that OpenBSD is also adopting similar defense-in-depth strategies, including SSP and N^X. Adoption is much more haphazard on Linux Distros

Err, what? It's pretty easy to get in Linux and has been for years, but not everyone uses it because it is only found in packages for more recent versions (however, SSP has been available for about eight years, n^x for about seven).

Similarly, nobody in their right mind runs Vista in production, so uptake is slow in Linux and Vista for the same reasons. In OpenBSD, measures like these really are the standard, and have been for a while, and they are used in production, so I don't know what the fuck you are smoking on that one.

Re:Its about the bug, not the environment

[kripkenstein]

Err, what? It's pretty easy to get in Linux and has been for years, but not everyone uses it because it is only found in packages for more recent versions (however, SSP has been available for about eight years, n^x for about seven).

I have heard some Linux distros have been using SSP for a while now, but am not sure of details; Ubuntu, in any case, uses SSP as of Edgy Eft, that is, since late 2006.

Re:Its about the bug, not the environment

[OmegaBlac]

Adoption is much more haphazard on Linux Distros, so you may be at much more risk running an application such as SSH on Linux than on OpenBSD even when it is compiled from the same source code.

SSP is included with recent versions of GCC 4.1 and above. If your specific distro is using GCC 4.1 or newer, then they are compiling with SSP already.

http://gcc.gnu.org/gcc-4.1/changes.html

Re:Its about the bug, not the environment

[hxnwix]

Right, and that's why OpenBSD pretends that remote exploits are warm & fuzzy happy ponies. Because of their "baked in defenses." ...
Errr, NO , this guy promulgating deceptive doublespeek. But perhaps he knows better - perhaps he's just a dishonest jackass and not a retarded jackass. What was your point again?

Re:Its about the bug, not the environment

[penix1]

Because the Microsoft security people are totally conservative when it comes to measuring risk, they assume that every one of these mitigations has been bypassed (or disabled), and measure vulnerabilities accordingly.

And that is a correct assumption to make. If a security "feature" can be bypassed or disabled, you can't make any other assumption. I firmly believe the biggest threat to Microsoft security is Microsoft itself. Policy from one section of Microsoft is fighting policy from another section. The security folk are fighting the "ease of use" folk. The piracy folk are using the critical updates as a means of checking legitimacy. WGA thinks you're not legit? You stay vulnerable making Microsoft a menace to networking. All these are policy fights that make being a Microsoft user less and less attractive.

B.

Re:Its about the bug, not the environment

[driftwolf]

If Vista is so much more "secure", then any flaw should be much MORE serious, not less. After all, aren't they supposed to have worked so long and hard to reduce the flaws in this one? If one advertises a secure system, then any breach is, by definition, important. MS Vista is being pushed as a highly secure system to many businesses. Hence, security issues are that much more important, as they were used to sell the system in the first place.

As we've heard that much (some?) of their vaunted security is actually just optional smoke and mirrors (several of the user security features for instance), I don't think MS Vista should be given any easier ride than any other operating system. Let it be judged independently, on its own merits, and not through re-definition of what is critical or not for political (and of course publicity and monetary) purposes.

Any system that defines itself as "secure", but isn't, deserves to be ranked accordingly. Microsoft (and it isn't alone by a long shot) has a very long history of selling one thing and delivering another. Changing the criteria based on what they are selling isn't warranted until what they deliver matches that in every respect. So far, they aren't doing that with MS Vista either.

Re:Its about the bug, not the environment

[Anonymous Coward]

"Address Space Layout Randomization and Data Execution Prevention"
Uh... randomized mmap() and non executable stack?
By his logic, quite a few unix bugs, especially on OpenBSD, should be downgraded as well....

Re:Its about the bug, not the environment

[kscguru]

His security features are /GS, /SafeSEH, layout randomization and an execute bit? Okay, he really is full of it.

• /GS. In theory works fine. In practice, you MUST (1) get the software publisher to compile with the switch, (2) cannot use inline assembly (/GS bails out on such code), and (3) must be willing to sacrifice a small bit of performance. In other words, a fair amount of real-world code can't use this. And oh by the way, this doesn't protect against all buffer overflows - it only protects against the easiest category. It's still quite possible to corrupt data with a buffer overflow, and maybe use that data to gain control.
• /SafeSEH. Right ... how many common languages don't have good exception handling? You said C only, right? And how often do you use Windows exceptions in C? Not much, you say? When I've seen SEH code, it's almost always very narrowly scoped and thus easy to get right - in real code, Windows SEH is just a trampoline to get into another exception mechanism. Making it "safer" adds no value.
• ASLR. This one makes generating a sucessful exploit a little more difficult - moves it from medium-easy to medium, because it's harder to hit a "target buffer". Of course, for compatibility reasons, a fair number of apps turn this off (they have assumptions about where code lives, and/or need the wasted address space). It helps - statistically. But a lucky guess is still going to succeed, and I don't trust luck for security.
• DEP. A two-pronged technology, which (1) uses the NX bit and (2) disallows syscalls from data segments. Oh but wait, (1) requires having a fairly recent processor and (2) is fine for some apps, but breaks for anything that does dynamic code (e.g. a Java runtime), so it's also disallowed for many, if not most, apps.

So what do we find out from this list? You get defense-in-depth - IF you are running the latest hardware, IF you use only software built with MSFT's favorite options (some of which are opt-in), and IF you only run apps that embrace all these strategies. How many Joe Consumers fit into those ifs? Datacenters might be closer, but I'll bet even they can't generally say all these hold true.

I'm glad open-source is adopting some of these measures. But let's be realistic - all any of these technologies do is make a sieve less leaky by putting a second sieve underneath. Something is nice, but we would be fools to treat any of these security "features" as more than a speed bump.

Re:Its about the bug, not the environment

[Anonymous Coward]

This guy is IMO a narrow minded fool. Just because he said this doesn't make him a fool of any kind.

First of all, I'm not a Microsoft customer, and I do not use their products. Secondly, I completely disagree with his statement. I use a more secure OS (that could get a virus). I do not live in the state of Washington, and I don't have friends, relatives, or investments at Microsoft.

But why shit on the guy because he said something that makes no sense? Maybe even regretably and in error? He is a faux spokesman, not a spokesman. And therefore he only deserves a minor public beating, not a crazy unfounded thrashing.

Now the poor guy has to go to work and go home with everyone calling him a "narrow-minded fool". Even Anonymous Cowards are shitting on him. Does he deserve it? Not for this statement.

There are much better applications of the "narrow minded fool" label. Use it thoughtfully.

Re:Its about the bug, not the environment

[LO0G]

Has he EVER refered to those as "security features"? I'd be surprised, Michael Howard doesn't usually make those kinds of mistakes.

Usually those are described as mitigations, since there are no security guarantees associated with them (since they can be bypassed, they're not security features.

Re:Its about the bug, not the environment

[strider44]

Add to this that the memory randomisation and data NX support has been in the linux kernel for years...

Yes the point still remains. The bug severity must be in some way comparable to other operating systems and Vista's security features are no better than Linux's

Re:Its about the bug, not the environment

[davester666]

Any system that defines itself as "secure", but isn't, deserves to be ranked accordingly. Microsoft (and it isn't alone by a long shot) has a very long history of selling one thing and delivering another. Changing the criteria based on what they are selling isn't warranted until what they deliver matches that in every respect. So far, they aren't doing that with MS Vista either.

MS doesn't say Vista is secure. They say Vista is more secure than XP. Like smearing glue in a sieve will make it less porous. It's all relative. MS can honestly say "Vista is the best/most secure/fanciest OS THEY have every released."

It's only when they imply and/or say things about Vista versus non-MS OS's that it might be not quite so honest...

Re:Its about the bug, not the environment

[I'm Don Giovanni]

You're not making sense.

Here's an example of the real issue:
Say there's a buffer overflow in IE7. On XP, such would allow a remote attack to take over the whole machine, or, if the user is running as limited rather than admin, then at least the whole user account.

Under Vista, IE7 runs with priveleges even less than the standard limited accounts, such that it can only touch its own directory and registry settings (unless the user explicitly allows it through UI such as File-SaveAs), so the remote exploit would do nothing to the system nor even the user's files.

So, the same exploit on both XP and Vista result in vastly different degrees of danger. That's the issue here, not your strawman that Microsoft claimed that that Vista had zero exploits.

Re:Its about the bug, not the environment

[Anonymous Coward]

> (1) [DEP] requires having a fairly recent processor

You're reaching. Such processors have been out for better than five years, and are standard. You can't get a new x86 that doesn't have it. And Java works fine with DEP.

Cut my Moose-Turd pie a little slack, won't ya?

[sizzzzlerz]

After all, I just baked it.

You keep using that word

[Gothmolly]

I do not think that the word "security" means what you think it means.

Or, you're a FUD-peddler whose job it is to convince Gartner that you don't suck... I'm not sure.

New rating for new system?

[Jimbitz]

I can't believe someone known as microsoft security guru would make a statement like that.
An exploit is still an exploit. It doesn't matter if it's found in a brand new OS or the predecessor.

Thank god there are people who doesn't agree with him.

Re:New rating for new system?

[GIL_Dude]

Well, I think the point would be something more like this:

A buffer overflow is found in lsasrv.exe. It's remotely exploitable on Win2k3 server and Windows XP and can run arbitrary code and doesn't require an account on the system (remote wormable). It's only locally exploitable on Vista, requires a local (even if low privileged) account to be logged on an run the code (possibly via social engineering - click here for SomeStarNaked.exe).

He's talking about the rating - a rating should be in relation to something. Otherwise - what does "5 star movie" mean? Is 5 stars the best? Is it 10 stars for the best? So, you need a rating that puts them in relative perspective. In this case, the same overflow should get an "extremely critical" for XP and Win2k3 server. It MAY not deserve as high a rating on Vista though depending on its ability to be exploited and spread. Possibly on Vista it could get just critical or maybe even just important.
I think it is key when rating the vulnerability to take into account how it can be utilized and what is required to exploit it.

Re:New rating for new system?

[rbochan]

Yeah, threat rating: "waaah... security is hard!"

Re:New rating for new system?

[JasonTik]

The key word there is microsoft security guru.

Re:New rating for new system?

[Jimbitz]

thanks for pointing that out. I thought the keyword microsoft security guru would be more meaningful. ;)

Re:New rating for new system?

[Jimbitz]

I get what you mean.. It MAY not deserve as high a rating on Vista though..
but it still MAY deserve it..
Nevertheless.. instead of worrying about the rating..
shouldn't they focus their resources on fixing the damn bug? :)

Re:New rating for new system?

[cnettel]

As quite a lot of organizations decide what patches to install, and when, depending on the ratings, it's not like they are pointless. By giving proper ratings, MS might get less of a crying wolf mentality for patch Tuesdays, and hopefully get the "right" patches widely deployed quickly.

Re:New rating for new system?

[Anonymous Cowhead]

"Security guru" is just Computerworld headline hype. His title is "program manager", meaning he really works for Marketing telling Engineering what to build. The "program" he's managing is the one to make the security of Microsoft operating systems not look so bad. As is obvious from his comments, his interests are more in perception than facts and metrics. He's trying to use "relativist" arguments to convince us that Vista is better than the facts would indicate. He's trying to get some press that says: "It's better than XP!"

Re:New rating for new system?

[Jimbitz]

So is it safe if we relate him to a politician then? :)
There's some similarities there..

Re:New rating for new system?

[shutdown -p now]

As I understand, what he's really talking about are all the new memory protection features Vista boasts which do indeed reduce the possibility of successfully exploiting something like a buffer overflow. So. in theory, a buffer overflow in IIS on Vista is potentially less dangerous than a buffer overflow in Apache on Linux.

Re:New rating for new system?

[rbochan]

So is it safe if we relate him to a politician then?

No, because someone who does marketing is incapable of telling the truth, a politician can at least try.

Re:New rating for new system?

[Anonymous Coward]

So. in theory, a buffer overflow in IIS on Vista Who in their right mind would run IIS on Vista or any desktop-oriented Windows system? Other than a developer? Even in that case it should be firewalled off from the internet.

dangerous than a buffer overflow in Apache on Linux. Depends on what "Linux" you're talking about. If it's Adamantix, you have SSP+PaX+RSBAC limiting what an exploit can do. If it's RedHat/CentOS, you have SSP+ExecSheild+SELinux. If it's SUSE you have SSP+AppArmour. Etc.

Re:New rating for new system?

[julesh]

Well, I think the point would be something more like this:

A buffer overflow is found in lsasrv.exe. It's remotely exploitable on Win2k3 server and Windows XP and can run arbitrary code and doesn't require an account on the system (remote wormable). It's only locally exploitable on Vista, requires a local (even if low privileged) account to be logged on an run the code (possibly via social engineering - click here for SomeStarNaked.exe).

To be fair, that's not the point. That would currently be rated Critical on 2k3 and XP and Moderate on Vista. According to the current rules, to be "critical" something must be remotely exploitable.

I think his point is more like, "well, this might *theoretically* be remotely exploitable, but address-space layout randomization makes it rather difficult, so can't we downgrade it?" -- to which I think MSRC's answer ("No.") is totally correct.

This is not wise

[EXMSFT]

Don't challenge the hackers. It's great that Windows Vista has some built in low-level security protections. It's also great to see that Michael is discounting the significance of UAC. And he should - most people will wind up turning it off. But I think that attempting to say that Vista is fire retardant is most likely going to serve as a method to encourage hackers and script kiddies to try and set fire to it. Saying "because it's Vista means the exploit isn't as bad" is a horrible argument. It's an OS, and an exploit is an exploit.

In short I don't think Michael should assume. When you assume, well, you know.

Re:This is not wise

[seaturnip]

I don't think you are up to date with the motivations of attackers nowadays. Sure ten years ago writing viruses and such was mainly an ego thing for petty vandals -- who might well have been influenced to attack more by bluster on the part of operating system makers -- but nowadays most attacks are done by organized crime for real money (spyware, spam, blackmail, information theft). Whatever claims Microsoft does or does not make will not make much difference to the incentives of attackers.

Re:This is not wise

[cerberusss]

In short I don't think Michael should assume. When you assume, well, you know.

Yes, we know. Assumption is the mother of all fuck-ups.

Re:This is not wise

[earthbound kid]

Don't challenge the hackers.

Yeah, like how Apple made those "Get a Mac" ads about how OS X has less malware in the wild than Windows, but then when hackers heard about it...

*Crickets chirping*

Well, now the crickets are loud as hell. I assume we can blame this on the hackers somehow.

Re:This is not wise

[nuzak]

Most viruses are exploited by organized crime nowadays, but someone has to discover the exploits in the first place. The motivations still remain for the various eccentric lone hacker genius types -- who are often well-paid by the organized crime types.

Who it really motivates are the white/grey-hat crowd who love to publicize a new exploit, and despite all the grumbling about disclosure, this sort of thing helps security in the long run.

I still have to remind people that the term "rootkit" didn't originate with Windows, and that Linux's defenses against them are still thin. How many distributions even run SELinux by default? How many entry points can be found to loading arbitrary kernel modules?

Re:This is not wise

[seaturnip]

Do you seriously think finding exploits is such a black art that only "eccentric lone genius"es can do it? It's mostly a matter of tediously attempting all conceivable attack vectors. Any competent programmer can learn to find exploits, and the "well-paid" business you mention is motivation enough.

Re:This is not wise

[Jesus_666]

Successful attacks on poorly secured systems are easy and thus cheap. Attacks on brand-new, supposed-to-be-secure systems are harder (= less common) and more actual, thus you can sell them for more, thus there is a higher incentive. Also, when users hear about how their system is so secure that its mere existence causes bugs to be rated down, they might become less vigilant in securing and patching their systems.

In any case, saying "Vista is so secure that we should care less about those bugs" sends all the wrong signals.

Re:This is not wise

[Jesus_666]

s/actual/relevant/

A good sign of being tired is when you do click Preview but still only spot obvious errors after posting.

Re:This is not wise

[nuzak]

You've got a point. AV researchers have a lot of methodological research techniques, so I guess I shouldn't be surprised that the same amount of rigor goes into the opposition force. My thinking comes from an era where rigorous technical analysis is still something of a novelty in programming, so it's the leaps of insight or just single insanely-productive people that tend to come up with the best solutions (and attacks). I still think it's like that to a big degree, but you're right, malware creators certainly have the incentive to do the hard work without needing the l33t sk1llz.

stop whinning and just....

[3seas]

...fix the bugs.

Re:stop whinning and just....

[rucs_hack]

They can't

Not because of anything so simple as crap coders or Microsoft being shit (lame reasons when there are so many others that can be justified with examples) . They can't because it's too complex, subject to too many attack vectors, and closed from peer review of code.

Time was this refusal to allow external entities to search for and fix bugs in their code was acceptable as normal business practice. Since Linux got more popular, people have started to see that peer review of code is superior when it comes to finding and fixing errors.

I'd be willing to bet that if Linux was closed source it would be as defective as Windows is. That it isn't testifies to the usefulness of open source/bsd style approaches.

Re:stop whinning and just....

[tuzzer]

I'd be willing to bet that if Linux was closed source it would be as defective as Windows is. That it isn't testifies to the usefulness of open source/bsd style approaches. Something being closed source doesn't mean it can't be peer reviewed. We use peer reviews at my job all the time. The rule is you don't check your own code, others do. It helps. A lot.

Re:stop whinning and just....

[Orion Blastar]

What? Do you know how much money it costs to fix the bugs? Wait until next year when they release the Vista SP1 update. The bugs are a low priority because they still have Vista Server to bring out.

Re:stop whinning and just....

[HiThere]

It does, however, meean that those who review it will be few in number, and will have a similar perspective. These are both strong indications that the peer-review is weak.

P.S.: Note that OpenSource programs with few developers interested in the code run into this same problem. Good peer review takes lots of eyes in multiple environments over an extended period of time. A structured code walkthrough just isn't the same thing. It helps, but it's not the same.

Re:stop whinning and just....

[rucs_hack]

Oh I agree. However I mean Microsoft don't put the code out there for others outside of Microsoft to review. Well they can't, it's 'proprietary', so this is kind of obvious.
That's their business model, it can't be helped.

Re:stop whinning and just....

[chef_raekwon]

We use peer reviews at my job all the time

yes, typically all development shops do. the difference, i believe, is 20 eyes vs 20,000 eyes. which would you prefer to make sure your code is bug free?

Re:stop whinning and just....

[Kalriath]

What are you talking about? Other companies than Microsoft DO have access to Windows source code. Most governments, as an example. Just because YOU can't get at the code, you can't claim that it can't be peer reviewed. With that attitude, the Windows users should feel fortunate that you don't have access to their source code.

Re:stop whinning and just....

[rucs_hack]

Other people who pay lots and lots of money or are required by law get access, but it is not for peer review and assistance with bug hunting, it's for customising aspects to work with their own applications, or tailoring applications to work with the existing code base.

Availability of code under these conditions is not comparable to an open peer review process.

Re:stop whinning and just....

[Kalriath]

But if they do see a vulnerability or bug, they are certainly free to report it. This equates it with something akin to a peer review process, as people trying to build an application see a flaw in an area they actually understand are able to say "hey guys, there's a problem here with xxxx, where yyyy could happen if zzzz happens". Availability of code under these conditions is comparable to a peer review process. Note that I didn't say open. Unlike the typical OSS zealots, I don't believe all software should be open.

Re:stop whinning and just....

[rucs_hack]

I'm not an OSS zealot (although I know the type of person you mean), I have four open and one closed source project (a game), and that isn't what I meant by open. I mean an open process where there is a free flow of information, not open source.

I dispute that what you describe amounts to a proper peer review process. In windows a bug may only become apparent when a piece of apparently bug free code accesses code from another portion of the windows tree. Vendors and so on mainly wouldn't have the entire tree to play with, or the time.

What you describe is a thing that might happen by chance, not a deliberate act of bug hunting and code checking. That does not compare to an open peer review process where all the code is available, people spend their time just on bug hunting and there is a free flow of information on request.

Re:stop whinning and just....

[Kalriath]

Indeed. But then, can we even say that such a process does not occur? There may well be something like what you describe, after all "Peer Review" does not necessarily entail outside peer review - nor even by your definition does "open peer review" entail outside organisation - but we just don't know what they do internally.

Missing the point

[UnknowingFool]

Why is it that MS always misses this point: Secure is relative. Advocating that MS can be more lax in its procedures because Vista is more secure is like saying you don't need to train anymore because you didn't finish last in a race. Microsoft may have better security than its predecessors; however, that remains yet to be seen whether or not it is adedquately secure. Given the companies history of boasting about security and then failing to deliver, it would be best if they were conservative when it comes to security. Wasn't there a recent slashdot article on how OpenBSD had an its second security issue in a decade? Compared to that, Microsoft security is a joke.

Tired article on a stupid statement.

[lancejjj]

Microsoft's own bug hunters should cut Windows Vista some slack and rate its vulnerabilities differently because of the operating system's new, baked-in defenses, according to [Michael Howard, a senior security program manager in Microsoft's security engineering group] who is often the public persona of the company's Security Development Lifecycle (SDL) process. Microsoft shouldn't have this guy as the "public persona" of security if he isn't 100% within both the security & public communications loops at Microsoft. "Vista" is supposed to be all about security. Why are they having this guy "chat" about it when he isn't a communications expert and when he isn't representing Microsoft's corporate opinion?

I'm sure we've all said a few things that were externalized "thought experiment" instead of "well thought out conclusions". And I think I can see how his line of thinking was going, although I disagree with his statement. And I wouldn't be surprised that in hindsight he disagrees with his own statement.

Microsoft has inadvertently set this guy up as a fall guy by anointing him as a semi-official spokesperson. Hopefully he won't find himself on the street due to what is a failure of his management.

Re:Tired article on a stupid statement.

[Anonymous Coward]

"Vista" is supposed to be all about security. No. Vista is about a fancy new composited desktop and "DirectX 10 games".

Re:Tired article on a stupid statement.

[Anonymous Coward]

Well, Microsoft will probably find out who this guy is, and terminate him immediately because of negative PR.

Obligatory

[dkleinsc]

You are trying to cover your own ass. Cancel or Allow?

Re:Obligatory

[Anonymous Coward]

Allow. You never read what UAC tells you anyway.

Re:Obligatory

[Anonymous Coward]

What he needs is an "anal bum cover". Ask Sean Connery about it; he has undoubtedly invented one by now.

sniff sniff....

[Anonymous Coward]

...hmmm...whats that smell?

Re:sniff sniff....

[Anonymous Coward]

1) weed
2) bullshit

Re:sniff sniff....

[hotdiggitydawg]

3) Profit
4) CowboyNeal

Oops, wrong thread...

Re:sniff sniff....

[I'm Don Giovanni]

Yep.
The sad thing is that (as I write this) the bullshit post has been modded as "interesting". Quite sad, that.

That's a hard one.

[pilsner.urquell]

Lets see, Microsoft has been selling crap all these years and now wants to be cut some slack? Yea, right.

progman.exe

[Anonymous Coward]

all I think of when I hear 'Program Manager' is the program launcher from the Windows 3.1 days.

Was this naming deliberate??

A little late for that...

[Jasin Natael]

By this logic, then, shouldn't most of the bugs for Linux and OSX have been rated as "relatively unsafe", while the Windows bugs were almost universally labeled "Über-pWnz0r3d"?

It seems like he wants this just so he can compare turds to turds, boosting the sales of Vista by saying the Windows 98 and 2000/XP bugs of yesteryear were worse because the same bug is arguably less severe under Vista. It may be true, but he should hope that if anyone takes him seriously, they don't start rating severity relative to similar bugs in competing products.

Be careful what you wish for...

Microsoft's own bug hunters...

[Ruvim]

Microsoft's own bug hunters will not get the extra bonus because Vista sales suck so much, because Vista has bugs which hunters found... Hm...

More like "half-baked"...

[Anonymous Coward]

"Built in defenses".

Yeah, right. He's been reading too much William Gibson...

Re:More like "half-baked"...

[beckerist]

Too bad it wasn't Mel Gibson. A little rehab should patch that right up.....

softer...

[beando]

Vista making microsoft became microsofter...

Don't be surprised

[it071976]

Vista includes security techniques and technologies that Windows XP lacks, the MSRC should reconsider how it ranks Vista when a vulnerability affects both Microsoft's new operating system and its predecessor, Windows XP. Don't be surprised if you see a bug that's say, Important on Windows XP and Important on Windows Vista, even if Windows Vista has a few more defenses and mitigations in place. Vista includes a number of new security features that randomize memory, check code for buffer overflows and require user permission for potentially risky operations. On Vista, the vulnerability will be so tagged, Vista-specific security technologies notwithstanding. Analysts and outside Microsoft security professionals took the MSRC's side and blasted Howard's idea. MSRC won...yes!!!

I take it...

[jrothwell97]

...that's not the Michael Howard who Paxman asked 12 times whether he threatened to overrule Derek Lewis... Thank goodness it's not the same person.

It would seem..

[ChePibe]

That Mr. Howard has yet to come to the sad realization that the rest of the Vista-using world has...

Re:It would seem..

[Anonymous Coward]

This is insightful? You must feel special.

Why you think there are so many car commercials on TV? For the most part they are not memorable, except to people who already own the car advertized. You see one of the core functions of advertizing is to convince those who already made an expensive purchase (like a car or Mac) feel good about their purchase and avoid buyer's remorse. You need advertising to feel good. Oh well, to each their own.

MS Security Guy?

[Psx29]

Are you sure it wasn't a PR guy?

A slip of the tongue...

[Stumbles]

I'm certain when he said "and rate its vulnerabilities differently because of the operating system's new, baked-in defenses." what he really meant was "and rate its vulnerabilities differently because of the operating system's new, half-baked-in defenses. "

N^X a big deal? Those that don't understand Unix..

[Anonymous Coward]

are condemned to reinvent it.

How's that 64-bit architecture coming in the Windows world, fanboy? Solaris has been 64-bit since when, 1995?

Awww

[Centurix]

They're hurting your feelings, come here and rest on my man boobs. There there, that's better isn't it mr security person. What, they're not as soft and comfortable as your moms boobs? Excuse me, I'd like you to rate my boobs better than that, after all, I am a MAN!

Re:Awww

[cyphercell]

that was funny

Re:Awww

[Anonymous Coward]

Man boobs? Maybe you should go on a diet, you fatass.

Threat Down: Vista?

[voice_of_all_reason]

At least this will let bears retake their proper spot at #1.

Re:Threat Down: Vista?

[Anonymous Coward]

At least this will encourage the jock-sniffers like you to spew your mindless obsessive horse shit where it isn't solicited and does not belong, such as a forum about Vista. Hey why don't you tell me how the job performance of professional athletes could possibly affect your life in any way other than your imagination?

Calling Dr. Howard

[Locutus]

For some reason, this guy reminds me of one of the "Three Stooges".

"Calling Dr Howard, Dr Fine, Dr Howard"...

Maybe it's because he needs a brain transplant. ;-)

LoB

A new car

[Ec|ipse]

That's like buying a new model car and the dealer saying, "Sorry it just keeps stalling on you, but it's a newer model and were still working out all the bugs. In the mean time, here's a coupon for a free oil change, just don't complain to loudly."

Of course!

[RMingin]

Obviously any Vista security bugs should be rated less severe... I mean, nobody's running that OS, right? Minimal impact!

Rate Vista's Security Differently?

[Anonymous Coward]

Allow or Deny?

An interesting response

[Trelane]

From a Red Hat hacker

Comment removed

[account_deleted]

Comment removed based on user account deletion

baked in?

[DragonTHC]

in Linux and Unix and Mac's BSD, what's higher than root?

in Microsoft Vista, what's higher than administrator?
    root
          superroot
                supersuperroot

that's right, there are three privilege layers above administrator in Vista.

users cannot access those, but software can.
"Oh, you're a process, here's the keys!"
"Oh you're a user? You want to access your computer, confirm or deny?"

Re:baked in?

[pallmall1]

that's right, there are three privilege layers above administrator in Vista.

Do they have to press a button to get to ludicrous root?

Good Lord Knows

[Anonymous Coward]

If Microsoft were to have a flaw, it would be that they are too modest and grade their own security issues too harshly.

OS bakers poem

[bl8n8r]

wake-n-bake lets all take
a look at microsoft half-baked
hit the bong and sing this song
windows got security wrong
Around we go with disclosure fud
Michael Howard please pass the bud

I think MS needs to talk to a lawyer

[SmallFurryCreature]

Simple send each and every person who works for the company in anyway to a lawyer and tell the obey the first rule.

SHUT THE FUCK UP

Just stop talking, do NOT say anything, remain silent.

MS just can't do that and keeps blurting out things that make it seem extremely silly indeed.

This latest claim is like saying that a grease fire in your kitchen isn't dangerous if you live near a firestation. That getting shot through the chest isn't as much a of a hassle and shouldn't count as an attempt on your life because you happen to be in a emergency room.

A bug, is a bug, a security hole is a security hole. That they are even rated is already bad enough. They should have just one variable "fixed" wich is a boolean.

Claiming that a so called critical bug isn't as severe because the unproven untested OS it runs on has some safety measures, which by the way have been programmed by the same people who programmed the bug, is not exactly raising my opinion of MS.

Had they simply listened to the lawyer they would have kept their mouth shut and not dropped another notch in my estimation.

Perhaps it is all part of a cunning plan with them hoping that humans like computers suffer from wrap around and if they lower my opinion far enough it would wrap around to positive again.

or they are stupid.

But I liked the end, unless Vista picks up it will receive the same non-attention as OS-X, now that gotta smart.

OMG, It's True....

[coastin]

The Security is really baked-in

They want to do something about security?

[argent]

The first thing Microsoft needs to do to get ANY credibility at all where security is involved is to take immediate and rapid steps to eliminate the role of the HTML control as an element of the security system.

That means getting rid of "Security zones". All documents displayed by the HTML control must be considered "untrusted".

To do this, start by getting rid of the ability for documents viewed in the HTML control to request the use of ActiveX objects, since no documents are considered trusted, ActiveX can't be used anyway.

At the same time, provide a mechanism like IO Slaves for applications to install controls... a mechanism that can not be requested by a document.

Modify Windows Explorer and Software Update to use this application-controlled mechanism to install components into the HTML control.

Create an IE shell that installs an "ActiveX IO Slave" to restore the existing behaviour. This shell will display windows with some visual indication that they are untrustable and dangerous. Users who acually require this functionality during the transition can run the "Insecure IE" shell.

In the next major release of Windows, remove that component.

In my defense...

[ChePibe]

This was actually intended as a joke. I suppose I should have added a smiley face or something.

If Vista is more secure than XP

[stites]

then there should be exploits reported as attacking XP but not working on Vista.

------------------
Steve Stites

BTW, this is the guy who lectures MS devs on secur

[melted]

BTW, this is the guy who lectures MS devs on security and likes to point out how insecure Linux is compared to W2K3. He's living in a bubble, which is fine by him as long as he gets a paycheck. To be fair, most of what I heard him say was sound advice, if overly verbose. I wish he wouldn't degrade himself to a bullshit robot when talking about Linux and Vista, though.

Re:N^X a big deal? Those that don't understand Uni

[Achromatic1978]

How's that 64-bit architecture coming in the Windows world, fanboy? Solaris has been 64-bit since when, 1995?

Spoken like an AC dickhead. When it was `95 I was all content with my 486 DX2 66. I'd love for you to point me to the x86 CPU that was around then.

Conservative?

[julesh]

"The MSRC folks are, understandably, very conservative and would rather err on the side of people deploying updates rather than trying to downgrade bug severity"

Err, right. So if they're so conservative, how come they'll rate a remote code execution bug as "moderate" if the code is run in a restricted context (see, e.g. http://www.microsoft.com/technet/security/Bulletin /MS06-013.mspx - particularly the DHTML bug)?

Spoken like someone with very low standards

[Anonymous Coward]

When it was `95 I was all content with my 486 DX2 66. I'd love for you to point me to the x86 CPU that was around then.

1. You seem very easy to make "all content". Get out of the toy-computer, x86 kiddie playground some time.

2. By your own words, your own 486 DX2 66 was an x86 CPU around in 1995.

Re:Spoken like someone with very low standards

[Anonymous Coward]

Yeah, keep reveling in the glory of what you guys did with your 64-bit computers. I'm sure the graphics, video editing, and other CPU-intensive apps were really amazing.

Oh wait... you were working on a fucking terminal, weren't you? Bwahahaahaha!!!

Welcome to the real world, pal!

Re:Spoken like someone with very low standards

[Hewligan]

You do realise that in 1995 most of that sort of stuff was done on 64-bit computers like SGIs or Suns, right? Well, either that or a Mac.

Still, I'm sure both of Corel Draw's users thank you for announcing they're the only ones living in the real world.

Re:Spoken like someone with very low standards

[donaldm]

I can got back to 1982 and SUN, SGI and Apollo Domain (it's OS was sort of Unix like) were using high res graphics in the order of better than 1024x1024. They did cost though but when you consider MS-DOS was still tty with just floppy disks and had very few applications these Graphincal Workstations did have their uses especially in areas such as CAD/CAM and visualization.

If your site were worth visiting

[Anonymous Coward]

Then you wouldn't need to spam it here. Must be low on ad revenue for that site of yours, you fucking spammer.

Re:N^X a big deal? Those that don't understand Uni

[Kalriath]

Actually, Windows XP x64, and it's Vista successor, are quite good. They put the 32-bit versions of themselves to shame in terms of performance (with native mode applications, i.e. 64-bit compiled) and security (don't ask how, I don't know. But Windows does leverage the processor's built in anti-buffer overrun protection).

You, clearly, are an idiot.

Obligatory mention: Linux, BSD and Unix have all been 64-bit for some time as well, and I believe most would pick Linux or BSD over Solaris.

we're not in seond grade anymore

[v1]

you no longer get a good grade for trying.

RESULTS are all that matters in the real world. I don't care how hard you're trying to make my fries, if you stil burn them, you SUCK.

It's Simple - This is the "new" Microsoft spin

[Master of Transhuman]

Vista is going nowhere, so now they trot out some bozo to say that Vista security problems won't be as bad as XP's.

Then they also had some Microsoft bozo post on his blog that he was going to compare vulnerabilities - actually, not even vulnerabilities but FIXES - between OS's - using the same discredited methodologies they've been using since forever. Naturally Windows came out ahead. He even tried to head off criticism by admitting he was a Microsoft bozo. Naturally, that didn't work.

In other words, Microsoft is trying to spin Vista's failure to be a "Windows security cureall" - especially since OneCare has been a PR nightmare by failing antivirus checks and then deleting users Outlook email files.

It's just another pathetic Microsoft pack of lies.

Remember, folks: ANYBODY authorized by Microsoft to talk to the public is a LIAR.

Microsoft does NOT sell software. It sells LIES.

Did anyone bother to RTFB?

[TwoSeven]

Did anyone bother to read the guys blog that this article is sourced from? I'll quote the relevant section: We will also see some bugs that are unique to Windows Vista. But I believe this number will be reasonably small. There is one thing you will see that I'm not too thrilled about, but it is what it is. The MSRC rarely reduces the severity of a buffer-related security bug because a defense with no security guarantees such as /GS or /SafeSEH is in place. UAC will be a speed bump, but I doubt we would reduce the severity of many bulletins if UAC is the sole mitigation. The MSRC folks are, understandably, very conservative and would rather err on the side of people deploying updates rather than trying to downgrade bug severity. So don't be surprised if you see a bug that's, say, Important on Windows XP and Important on Windows Vista, even if Windows Vista has a few more defenses and mitigations in place. As I understand it, the MSRC will call out defenses that come into play. He's splitting hairs over SECURITY UPDATE CLASSIFICATIONS that arn't(at time of patching) exploitable on vista but are on xp, being rated with the same level of severity. Imho, thats pretty fair. Look at the BSD guys recently, it wasn't a escalated from a bug to a vunerability until it was proven it was exploitable. This bothers him because it is going to make vista look bad when it comes time to compare vistas first couple of years to xp's first couple of years, if all you go on is the patches vunerability ratings... Ok, so theres a buffer overrun in MS_arbitary.exe that causes a crash in vista, but can result

Re:Did anyone bother to RTFB?

[I'm Don Giovanni]

LOL
Did you really expect the average slashdotter to read the article or the originating blog when the (misleading) summary provided enough fuel for Microsoft-bashing based in ignorance? Slashdotters (generally) would rather be ignorant of a situation if such ignorance allows them to bash someone.

Too Soft...

[triso]

Vista making microsoft became microsofter... More like Microflaccid.

We're secure-that remote exploit's nothing-really

[Anonymous Coward]

"No, you don't need to count that remotely-exploitable vulnerability that can take over your computer. Our Trusted Advanced Security (TAS) will Stop It Cold (patent pending on phrase)!"

That's one reason why I use GNU/Linux.

lker@cmosnetworks.com

Vista as secure is OS X?

[dilvish_the_damned]

"The limited pickup of Vista installs [means that] until Vista is more popular, it will enjoy the same limited attention from hackers as OS X"

He should know by now that its not the install base of OS X, its that the hacker bullies only pick on those that cry.

Agree, kinda

[bobdehnhardt]

On one level, this makes sense. A vulnerability should be judged by the risk it poses to the system, and security tools and settings can, in some cases, mitigate the risk and should be factored in. So on the surface, rating cross-Microsoft-platform vulnerabilities differently for Vista than XP makes sense, if Vista's security measures in their default or most common configuration are a truly effective mitigation for the vulnerability.

The crux of the matter is determining if the security measure is effective. Who decides? At work, I use MS's ratings as the barest of indicators as to the vulnerability's severity. I look elsewhere, like here on Slashdot, on the Internet Storm Center, Vulnwatch mailing list, to get a better idea of how much attention is being paid to the vulnerability. I look to see if any exploits are in the wild. And I look at our environment, and determine our own risk exposure. A home user might not havve the time/ability/resources to do this sort of checking for themselves, and in that case, they should probably follow MS's advice. But for a business, knee-jerk reactions are rarely the best course.

Half-baked defenses

[Jesus_666]

"UberWormz0r.exe has been terminated due to the system being too stoned to understand what an 'msvcrt.dll' is or where to find one. Sorry, dude."

Hey, at least you can't say it's not innovative.

List of people not to hire for security

[Anonymous Coward]

- Michael Howard