The Fine Line Between Security and Usability

SkiifGeek writes to ask, "Where should vendors be required to draw the line when supporting deprecated file formats and technology? In a recent case independent security researcher cocoruder found a critical bug with the JET engine, via the .mdb (Access) file format, he reported it to Microsoft, but Microsoft's response came as a surprise to him — it appears that Microsoft is not inclined to fix a critical arbitrary code execution vulnerability with a data technology that is at the heart of a large number of essential business and hobby applications."

Comments

In my opinion

[moogied]

Microsoft is a company, there goal is profit. Not security, not saving the enviroment, not making linux geeks smile. They want money. As every company on earth does. That is where the line is drawn. Exactly where it becomes unprofitable.

Re:In my opinion

[actiondan]

Microsoft is a company, there goal is profit. ... not making linux geeks smile

Explain Vista then.

Re:In my opinion

[timeOday]

Where else should the line be drawn? Unfortunately there is no line nicely "between" usability and security, because the two are in direct conflict. Computers would be so much easier to use in every way if we didn't have to worry about abuse - it's a huge part of the configuration burden that plagues computers today. That's the world we live in. The line has to be drawn somewhere, but "absolute security" isn't it (and neither is "absolute convenience").

Whether Microsoft draws it at the right place is, of course, another question entirely.

Re:In my opinion

[a_n_d_e_r_s]

Thats not a bug - its a feature!

Re:In my opinion

[fm6]

The fact that it's a feature makes it a bug!

Re:In my opinion

[jmv]

That's what really bothers me about the libertarian-neocon view on corporations. You have at the same time:

1) Companies are only there to make a profit and don't have to care about things like environment, security, ...

2) Regulation is evil, let the companies do whatever they like and the market will sort it out.

Logical conclusion from 1) and 2) is that we're pretty much screwed and back to some kind of feudalism. And no, most people do not vote with their wallets and the Market will not sort it out magically (otherwise, CO2 emissions would already be on the way down and there wouldn't be all these environmental problems).

Re:In my opinion

[mrbluze]

Microsoft is a company, there goal is profit. Not security, not saving the enviroment, not making linux geeks smile.

As correct as you are, there does not need to be a fine line between usability and security. There needs to be (and of course there will be) an ongoing evolution in software design to offer usability without compromising security. I reckon it won't be a long time before any software program that gets run in userspace (or any space) has to go out on bended knee requesting to do anything - forced to abide by a security policy by default which limits its access. I don't mean the old broad-brush users/groups/device permissions etc. model that is everywhere now, but stuff like "only allowed to read from this folder, only allowed to talk to this or that application, etc." with very low level behaviour controls.

I don't think this needs to result in a "the mouse pointer wants to move, confirm/deny" scenario, but that the software designers need to submit with their product a security policy within which their applicaton has to function. The user should be able to very easily browse this policy and see what the program expects to be able to do, and override things, such as "access the internet using HTTPS at port 3232 to server www.phonehome.net" or sloppy things like "read contents of /etc recursively" instead of "read contents of /etc/mostlyharmlesswidget/config".

I know things like this already exist and there is a limited implementation of it, but to me that just confirms the point that it is the obvious next step.

Re:In my opinion

[fm6]

Microsoft is a company, there goal is profit.

So what? You think there's no connection between security and profit? Next you'll be telling me that Ford's goal is profit, not reliable cars. Of course, nowadays they have neither...

This whole discussion is based on a faulty premise, that MS is leaving its Access users without a fix. They have a fix, and they've had it for some time: stop using MDB format and convert your databases to a data engine that isn't a POS. They've deprecated MDB and Jet Engine. That means they're telling their customers "Don't use that stuff any more, it's faulty." The fact that they continue to support customers who ignore the deprecation doesn't change that.

There is the little detail that Access itself is a POS. But that's designed in — not much they can do about that.

Re:In my opinion

[squeeze69]

Vista? uooops... a "SVista" (more or less an italian wordfor an "error" made by distraction). :-D Sorry, I couldn't resist.. :-D Jokes apart, MS has to make money, like any other company, I don't understand "trolling" and hate against MS. Note: I personally like both *nix and windows worlds (and make some development in both worlds, too). No one if forced to use Windows or other MS products, you can use alternative software any time you like.

Re:In my opinion

[CastrTroy]

And if people had written their applications with proper database abstraction layers, moving from one database to another wouldn't be all that difficult. The fact is that a lot of programmers did a really bad job when they designed their applications, and now they want MS to fix some ancient technology, just so they never have to upgrade their systems.

Re:In my opinion

[seaturnip]

Who the hell is a "libertarian-neocon"? Nice job knocking down that straw man.

Re:In my opinion

[Attila Dimedici]

What environmental problems are you talking about? Twenty years ago, several species of fish that were native to rivers near me, that had not been seen in them in the at least 30 years were once again found in the rivers. The populations of those fish have steadily risen since then. The polar bear population is larger than it has been in two or three human generations. The air in the cities near me are cleaner than they were a century ago. 40 years ago if you had talked about CO2 as pollution, environmentalists would have told you to worry about a real problem. The fact that CO2 is our biggest pollution worry, means that we have made huge strides at addressing pollution and other environmental problems.

Re:In my opinion

[TheLink]

I hope it continues becoming more and more obvious, getting tired of proposing it to people who don't find it obvious :)

e.g.
https://bugs.launchpad.net/ubuntu/+bug/156693

Re:In my opinion

[jmv]

It's not *a* libertarian-neocon, but what I'm saying applies to both (admittedly very different) groups.

Re:In my opinion

[seaturnip]

Ah, okay, you should've used a slash then.

And, anyway, actually the logical conclusion from 1) and 2) is that we should incentivize externalities via such measures as tradable pollution credits, thus making them directly bear on companies' bottom lines and encouraging a market-based solution, instead of imposing regulations by fiat.

Re:In my opinion

[jmv]

The fact that CO2 is our biggest pollution worry, means that we have made huge strides at addressing pollution and other environmental problems.

No, it means we've ignored the problem (partially because less was known about it) for a long time and now there's no other choice but to face it. All the environmental issues you've mentioned are mostly on a local scale (less particle-based pollution in a city == cleaner air) and obvious. They are easier to deal with partly because a local change can make a difference (as opposed to the tragedy of the commons) and because they didn't affect "core" economic aspects. On the global scale, the only "victory" I can think of is on the ozone layer (even if the benefits will only come later) and even that didn't touch all that much of the economy, so was "relatively" easy. The problem with CO2 is that you can't just "improve the processes" to eliminate it. If you burn fossil fuel, you get CO2 no matter what you do. You may be slightly more efficient at getting electricity out of it, but that it. Compared to that, the river next to your house is a joke.

Re:In my opinion

[jmv]

we should incentivize externalities via such measures as tradable pollution credits, thus making them directly bear on companies' bottom lines

Isn't that considered ligislating and taxing (two things which neocons and libertabians are opposed to)?

Don't get me wrong. I do agree that ultimately companies should pay the real (environmental, social, ...) cost of whatever they do. Then dumping waste would no longer attract a small fine for creating pollution, but rather prosecution for "stealing from the environment".

Re:In my opinion

[Anonymous Coward]

Vista doesn't make us smile, it makes us weep.

Re:In my opinion

[Draek]

well, the problem *is* that people aren't voting with their wallet on those issues and prefer to save a few bucks over buying from an enviroment-friendly company, or prefer continuing to use what they already know instead of switching to an OS whose security doesn't suck. What are you going to do, then, force them to do so? a possible choice, certainly, but one with enough drawbacks to cause it's rejection by many, myself included.

the problem with capitalism (the system you're pretty much describing, not libertarianism) is that it depends on people not being a bunch of stupid, clueless morons who'd rather follow Big Corp's marketing dept. instead of educating themselves about the issues that affect them, which largely isn't the case, hence the current situation.

Re:In my opinion

[jmv]

the problem with capitalism (the system you're pretty much describing, not libertarianism)

I don't believe it's a fundamental problem with capitalism itself. It's a problem with *unregulated* capitalism.

clueless morons who'd rather follow Big Corp's marketing dept. instead of educating themselves about the issues that affect them

Unfortunately, that won't be fixed unless the govt were to spend at least the same amount on advertisement as Big Corps to, which is highly unlikely (and possibly undesirable anyway). Otherwise, it's a lost battle. You've got billions spent on ads telling everyone to eat junk food (just one example) and a couple millions into actually telling people it's bad for you. You can say "people could stop paying attention to ads", but that would be missing the point. The fact is that ads *do* work. Otherwise Big Corps wouldn't be spending billions on it in the first place. If you can't get people to stop buying food that makes them sick, how the hell are you going to stop them from buying from companies that destroy the environment at a global scale. This is why I do not believe "voting with your wallet" will ever work except for a few rare case.

Re:In my opinion

[Upphew]

In my opinion company's goal is what owners/founders set it to be. It's the US of A way to simplify everything to money. I hope to see more businesses and companies where profit is a mean to a goal, not a goal in itself.

Re:In my opinion

[Attila Dimedici]

Actually, the best evidence is that it would be a more efficient expenditure of money (that is less cost for bigger impact) to develop programs to deal with the negative effects of global warming than it would to reduce the amount of temperature change by reducing CO2 emissions.
Oh yeah, I should be as worried about CO2 in the air as about heavy metals in the water supply.

Re:In my opinion

[Anonymous Coward]

If you actually did your homework you'd recognize the fundamental difference between libertarian and neocon policy on pollution: libertarian policy gives you the right to fight back against polluters, through strong property rights and the ability to protect your property. See this article if you are interested in educating yourself. Neocon policy, on the other hand, would simply make you sit there and take it -- just as you have been by law for some time, under the policies of both the republicans and the democrats.

Re:In my opinion

[TheRaven64]

I don't believe it's a fundamental problem with capitalism itself. It's a problem with *unregulated* capitalism. Specifically, it's a well-known problem with free-market capitalism which has an informed consumer base as one of its axioms. Any logician will tell you you can prove anything if you start with false axioms[1].

Unfortunately, that won't be fixed unless the govt were to spend at least the same amount on advertisement as Big Corps to, which is highly unlikely (and possibly undesirable anyway). Otherwise, it's a lost battle. Corporations are only allowed to advertise what, when and where the government permits. Advertising tobacco products was banned in the UK around a decade ago, and there are now moves to ban advertising unhealthy foods during children's television. Advertising prescription medicine to the general public is also illegal here.

If you advertise a financial product, then you must display the small print (interest rates etc.) in the advert. It would be possible for a government to pass a law requiring an environmental impact metric to be included with adverts. This is already the case when selling consumer electricals such as fridges in the UK (I think all of the EU), where they are rated by power consumption on a simple-to-understand scale.

[1] Some proofs actually need you to go through a step where you assume something you suspect is incorrect and prove a contradiction. Thus far, automated theorem provers have been unable to do this step.

Re:In my opinion

[Tom]

Microsoft is a company, there goal is profit. Not security, not saving the enviroment, not making linux geeks smile. They want money. As every company on earth does. That is correct, but that doesn't make it right.

Jimmy is a paedophile, his goal is fucking six-year old girls. Not health, not being socially responsible, not making the priest happy. He wants sex. As every paedophile does.

Same simple truth, still doesn't make it ok, acceptable or justified.

Re:In my opinion

[stry_cat]

That is not the Libertarian viewpoint on corporations.

While Libertarians believe that individuals should be free to make money as long as there is no force for fraud, they do not believe that corporations should have rights or even exist in most cases. Corporations are a construct from the government to protect the investors from whatever wrong doing the corp might do. This is directly counter to the way a Libertarian free-market would work.

Re:In my opinion

[bluefoxlucid]

Where else should the line be drawn? Unfortunately there is no line nicely "between" usability and security, because the two are in direct conflict.

Bruce Schneir needs a slap for ever perpetuating this lie. Some security measures do decrease "usability," while others just make a developers' job harder but not an end user's (do you ever feel the need for root access to do non-administrative tasks on Linux? No? Yet on Windows stuff breaks why... oh badly coded apps that write to Program Files/ to store settings in a .ini). When done right, a lot of the "usability loss" involves having to enter a system admin password to do administrative tasks, or some other such thing.

Address space layout radomization, non-executable stacks, and proper fixes for broken code like this trivial bounds checking error (hint: these MDBs are broken anyway, they will crash access, if it can't open them because of the fix you haven't lost anything) all irritate developers to no end. Why should I have to fix my code just so some end user can use it without crashes and security breaches? But when it comes to the end user, it works now so he doesn't care, and "usability" doesn't really go down at all while "security" goes up.

Stop wasting your time with that usability-security juxtaposition argument. Spend your time trying to solve the problems instead. Minimize the interaction of security systems with the user, but make sure it does interfere with them where it has to (for example, see Pidgin ticket 3381 about an SSL/TLS bug where the user isn't involved enough, and how to properly annoy them in the least invasive way possible).

Re:In my opinion

[Toonol]

People don't eat junk food because of ads, they eat it because it's full of salt, sugar, and fat, which the human body craves. The ads mainly just give one fast food place an advantage over another.

And, despite being outspent 100::1, the people criticizing fast food have got their message out. Everybody knows fast food, in excess, is bad for you. What you're mad about... is that people eat it anyway. Well, we have the freedom to do so. Capitalism is a logical consequence of living in a free society. You don't lay down rules for my benefit.

Re:In my opinion

[fm6]

Your logic is sound, but it doesn't really apply to programs like Access, which are meant to be general-purpose database applications, not frameworks for creating database applications.

Re:In my opinion

[operagost]

Logical conclusion from 1) and 2) is that we're pretty much screwed and back to some kind of feudalism.

Use hyperbole much? The point of capitalism is that the market DOES decide. I'm sure you'd prefer an oligarchy of smart people such as yourself, right? And you have made the assumption that the the public believes that high CO2 emissions are affecting the environment-- and that this is more important than other factors-- just because you do. Tell me: exactly what companies should a consumer invest in if he wishes to use fewer fossil fuels? Many people can only buy power made in a coal-burning plant because environmentalists opposed nuclear plants (and sometimes wind farms), not because of a lack of competition.

Re:In my opinion

[operagost]

No, it means we've ignored the problem (partially because less was known about it) for a long time and now there's no other choice but to face it.

No, it's because in the 1970s we were worried about global cooling.

Re:In my opinion

[jo42]

We should be calling it what it is, i.e. "The Pile of Poop Known as Vista".

Re:In my opinion

[Anonymous Coward]

Why is this so hard...

Their goal. Not there. There indicates a place. Is public school so horrid that people can't figure out proper homonyms?

Re:In my opinion

[SonicSpike]

CO2 emissions have not proven to be a problem yet.

And in a free market people are free to choose the competition or even start their own company; hardly feudalism.

I always go with OpenBSD.

[Anonymous Coward]

When I put together a system and security is paramount, there's really only one choice: OpenBSD.

Their no-bullshit policy with regards to security and high-quality code is what allows them to put together such a stable, secure, and high-quality operating system.

And I always use their security-hardened versions of GCC and Apache, just to ensure that the web sites I'm serving are as secure as possible.

Re:I always go with OpenBSD.

[TheRaven64]

OpenBSD is also one of the most useable UNIX systems I've encountered. It doesn't have oversimplified GUIs, but it does have a remarkably consistent userland feel. Why? Because the team regard usability as part of security. A security system that is so hard to use that people turn it off is a useless security system. The best security system is a competent administrator and a good user interface lowers the bar for competence.

Re:I always go with OpenBSD.

[grub]

I've always been a fan of Windowmaker which plays nicely on OpenBSD. It's quite lightweight, customizable and doesn't interfere with what I want to do.

Oblig. Dilbert

[damn_registrars]

Mordac, the preventer of information services, makes a statement on security versus usability:

http://dilbert.com/comics/dilbert/archive/dilbert-20071116.html

Re:Oblig. Dilbert

[kc2keo]

I read that in the paper. Was hilarious. Made my morning before school worthwhile.

Re:Oblig. Dilbert

[mcrbids]

Funny - as CTO of my company, I sent a link to this just the other day to all staff in our company.

Yes, we take security seriously. And yes, we have fun doing it!

This is not news to me...

[rickb928]

... that Microsoft doesn't want to fix Jet.

They'd rather you re-wrote your app and used MSDE, or something with .NET in it.

Not a lot of money in supporting the db engine they give away.

And this is not the first time. Does no one remember they tried to Kill Jet in XP -and- Vista?

A pox on them all. I hope we re-write our app in mySQL.

Re:This is not news to me...

[moderatorrater]

I hope we re-write our app in mySQL Thems're fightin' words around here...

Re:This is not news to me...

[zentigger]

A pox on them all. I hope we re-write our app in mySQL.

If more people share this attitude it will become "profitable" for Microsoft to fix this.

If not, well, you will have a secure app anyway, and MS can bugger off and die in a gutter somewhere, and all the dumb bastards that decided to rely on a free piece of software from a company with a horrible reputation for customer support and secure coding practices get what they deserve!

Re:This is not news to me...

[argent]

You prefer PostgreSQL?

Re:This is not news to me...

[argent]

I hope we re-write our app in mySQL.

If Jet was adequate, you may be better off using SQLite.

Re:This is not news to me...

[berzerke]

...all the dumb bastards that decided to rely on a free piece of software from a company with a horrible reputation for customer support and secure coding practices get what they deserve!

Except with the Internet and massive databases floating around, we are all interconnected. Jet DBs may not be massive, but that doesn't mean the company doesn't have access to other real databases. OK, so the stupid company gets owned. Now, if they have any info on me, that's in the criminal's hands, and good luck getting compensation even if the company admitted full responsibility. Their Internet connection can now be used to spam or DOS me. If they go out of business, think about all the employees who had nothing to do with the IT decisions (and those who opposed this particular one). They get to stand in the unemployment line. Vendors might get shafted on unpaid invoices.

Just because your system is secure doesn't mean you don't get affected by someone else's insecure system. And no, I don't know what the solution to that problem is.

Re:This is not news to me...

[moderatorrater]

I'm MySQL through and through, but honestly, the worst flame wars I've ever seen on the site were mysql vs. postgres. I would say pirates vs. the "thou shalt be honest, even unto the music industry" folks, but there aren't too many of the latter around here...

Re:This is not news to me...

[einhverfr]

I don't know. It seems to me that whoever did the triage screwed up. This is not unusual. I remember working at Microsoft and running into issues getting a number of issues fixed. However, the organizational structure of the company often makes it impossible to get problems fixed because nobody wants to act as a cost center for the security (passing the buck).

When I worked at Microsoft, I remported what I felt was a serious security flaw. Despite the fact that the exploit I remorted resulted in one of the lead engineers handing me his Hotmail password, this was seen as a user issue and not a security one (it had to do with options for encoding URL's so that the @ sign could be sufficiently obfuscated that nobody could be expected to see what was going on), that is, until a few months later when someone sent out phishing emails appearing to come from Microsoft. (It was then fixed in a hurry).

I have had other experiences at Microsoft suggesting that only when it becomes a PR problem for Microsoft will they fix something which does not fit their ideas of how the software is supposed to be used. Their answer in this case suggests that the feeling is that the solution is not to use untrusted sources of Access dbs. Just wait for someone in a business to show how this can be done using Access with far fewer permissions, and then it might get fixed.

Re:This is not news to me...

[Allador]

Theres just one small problem with your premise.

All of the alternatives to Jet and Access are also free (at least in the same sense that Jet and MDB is free).

SQL Server 2005 Express is free
MSDE (SQL Server 2000 desktop) is free .NET is free .NET SDK and compilers are free
all the drivers to interact between the two are free

Many people choose to purchase Visual Studio (or an MSDN subscription), but its not at all necessary. There are other IDEs.

Re:This is not news to me...

[argent]

I'm MySQL through and through, but honestly, the worst flame wars I've ever seen on the site were mysql vs. postgres.

Ah, youngsters these days, how soon they forget the dark times, the great OS wars, when geeks everywhere stood up for their right to use their OS of choice. Now all that is left is UNIX, and UNIX wannabes... even Windows bears the mark of the Beastie these days.

Re:This is not news to me...

[TheRaven64]

MOD PARENT UP. I'm not sure which Microsoft product I'd recommend replacing with MySQL. Actually, I'm not sure what use I'd consider for MySQL.

If JET is adequate for your needs, SQLite is likely to be much better. If you are using SQL Server then you would be better off considering PostgreSQL as a migration path than MySQL.

Re:This is not news to me...

[rickb928]

Currently, we do not have to install the Jet engine for our app to be installed. Yes, we use AC97 tables.

Is SQL 2005 Express so free that you don't even have to install it?

How about MSDE? .NET framework?

We are riding on the coattails of Windows 2000/XP/Vista, to be sure, but the alternatives require our users to also install some DB engine,and our users are unsophisticated to the extreme. Leaving Access opens us up to the entire world of DB engines.

We also need to encrypt data now. This limits things a bit more.

But Access is surely as much trouble as it is good. We'll be changing soon, though it won't be SQL 2005 Lite, as the developer teams we have auditioned for that are clueless. Not about SQL, but about users - they spend much of their time telling us how our users use our app. Trying to substitute your nonexistent experience in a field for that of 14 years worth of experience is not always successful. Sometimes, you overlook why the product exists in thne first place. Our current pretenders to the throne are well on their way to proving they don't understand anything of our business. Why won't they just code? Please?

but i digress...

Re:This is not news to me...

[Anonymous Coward]

... that Microsoft doesn't want to fix Jet.

They'd rather you re-wrote your app and used MSDE, or something with .NET in it.

Not a lot of money in supporting the db engine they give away.

You contradict yourself as they also give away MSDE, and SQL Server Express, and the .NET framework SDKs and Visual Studio Express...

Re:This is not news to me...

[Allador]

I understand what you're saying, that the Jet drivers are built into windows ... but that has nothing to do with being free.

Why not just add a silent installation of SQL 2005 Express or SQL 2005 Compact to your app installer? It's pretty straightforward once you've done the work on your app installer. I mean you have to do things like check for the right version of the Jet driver and Access runtime, etc.

If your audience is all windows, sql 2005 express or compact are excellent choices. They're as or more capable than other equivs (myssql, sqllite, etc), and you get the added benefit that they get automatically patched by windows-update/microsoft-update/automatic-update.

do users care?

[larry bagina]

a few years back, I started up a software company. Although some of our stuff was open source, starving isn't a hobby, so some of it was closed. One thing we tried was (for a slight increase in price) guaranteeing to fix any critical bugs even if we no longer supported the software. If we couldn't provide a fix, the source code was in escrow so they could access it. There was zero interest in it.

Re:do users care?

[cdrguru]

Source code escrow was far more interesting in the late 1980s when some folks actually believed that if they paid for an application (and often a substantial fraction of its development) that they should have access to the source code if the author wasn't available. Part of this came from companies that got burned by the author abandoning their work for one reason or another. Part of it was also that it was a marketing tool - see, the source code can be gotten...

Today that fantasy has mostly dispersed. Most companies know that if they don't develop an application internally they are at someone else's mercy. There are fewer failures of larger software publishers but even the larger ones sometimes abandon some application leaving the users in a bad spot. But having the source for a 150,000 line (or more!) application doesn't mean a company could compile it, much less fix a serious bug. In general it would take someone a long time to get familiar enough with something like this to be able to work on it with any degree of confidence. Especially a company with a mission-critical application needing a bug fixed - it would take months, often paying a consultant $150+ an hour.

The "new" strategy seems to be:

1. deal with larger, established companies whenever possible and hope their user base is large enough that they can just keep pushing out updates and have the product remain revenue-positive.
2. Write off stuff that is abandoned because it is cheaper to switch to something else than try to independently resurrect something dead.
3. Never ever do anything internally that could possibly be bought as off-the-shelf.

Mostly, this is a lot smarter than the late 80s strategy.

Re:do users care?

[whitehatlurker]

There was zero interest in it.

Until a potentially disasterous bug was found in a system critical piece of software. People don't always have enough vision to see the worth in something like this. Bravo for trying!

Fine line?

[Anonymous Coward]

I may have misunderstood, but it seems TFA is not about a fine line, but a chasm?

It's a fine line between madness and genius. Between cool and corny, or even between love and hate.

But there is no point where usability suddenly flips over into security, is there? And they are both good things.

Because it's not mainstream

[arbenin]

It's a very old technology. No new projects start with Access in its heart.

Re:Because it's not mainstream

[JoeCommodore]

You haven't been outside much? Access is a part of Office 2003, a lot of people with just enough tech skills to be dangerous make their living off of writing Access dbs in critical situations.

Not to mention MS Access files being used by some electronic voting Cos.

Easy

[Jeremiah Stoddard]

If someone has paid for the software, the vendor should be obligated to fix malfunctions and security risks for as long as the software is in use, or until they release the source. If you pay for something, you have the right to expect it to work; if you're not given the means to correct issues with it, you have the right to expect that the company who took your money corrects those issues.

Re:Easy

[Anonymous Coward]

If someone has paid for the software, the vendor should be obligated to fix malfunctions and security risks for as long as the software is in use, or until they release the source.

If that's what you want, then put that in the contract when you purchase the software. But be prepared to pay more, a lot more, for your software.

If you expect that sort of support from off-the-shelf software you get at your local office supply store, then be prepared to pay far more for that software.

Re:Easy

[wasabii]

That's stupid. That's not how any other industry works.

All sales are final, ever heard of it? Perfectly acceptable and legal. If you don't do due diligence before you buy the responsibility is yours. It just so happens providing support is USUALLY in the best interests of both parties. Hence why manufacturors offer limited warrenties for certain durations. Fixing 10 year old code is a net negative for the manufacturor: not doing so does not loose them enough sales to offset the cost.

Re:Easy

[Jeremiah Stoddard]

No; I know of no industry that works like that other than software. First, if a product is defective, I can return it and get it refunded or replaced. Beyond the warranty period, I still have the ability to alter it myself. Not so with software -- I can't return an opened package, even if the program doesn't work, and the EULA prevents me from making ANY modifications. Also, 10 years from now if it is discovered that my model of car has a "security risk", i.e. it explodes at random without warning, the manufacturer can still be held responsible. In this case, the software companies are trying to ditch any responsibility for their product, and require that the user pay them again for a newer version if they want their problem fixed. What's really stupid is your suggestion that the consumer is obligated to deal with a defective product.

Re:Easy

[Jeremiah Stoddard]

Why should I pay more for what any reasonable person ought to be able to expect? If I pay for something, it's my right to expect a functional and safe product in return. Hell, Free/Open Source software gives me that for free, and yet some profit-making enterprise can't afford to do it?

And it doesn't cost the vendor anything more to release the source of an outdated piece of software -- they don't have to use an open source license, just allow me to fix what I paid for.

Re:Easy

[TheRaven64]

Over here in the UK we have such a thing as an expectation of merchantability. If the goods are not suitable for the purpose for which sold, you have a right to a full refund. Unfortunately, this is only valid for one year.

Re:Easy

[Anonymous Coward]

Yay for car analogies. A car can blow up if you throw a lit match in the gas tank. I don't think you can call that "at random". Software can do Bad Stuff® if you do a lot of Stupid Stuff®. That's not random either. It's not like it's easy to do this list of Stupid Stuff®.

Re:Easy

[brown-eyed slug]

Actually, the "fit for purpose" clause in UK consumer protection law specifies durability as one of the criteria. What durability actually means is not specified though, as it will vary according to what you purchase. A £1000 TV might be expected to last at least five years, but a £10 toaster may not be expected to live much beyond its one year guarantee. I'm plucking those figures out of the air as an illustration.

In any case, I don't think trading standards or the small claims court would be very interested in this kind of "old software" issue.

(Of course, IANAL.)

Re:Easy

[jimicus]

Software isn't an end product with only a limited number of accepted uses - unlike a car.

It's more like a toolbox - and there are some tools in there that you look at and think "what on earth would anyone want one of those for?", and some tools which it's easy to misuse, resulting in damaging the thing you're working on.

Re:Easy

[clodney]

Hell, Free/Open Source software gives me that for free, and yet some profit-making enterprise can't afford to do it?

Free/Open Source software does not give you what the grandparent was asking for - a promise to fix bugs so long as the app is in use. FOSS is really more like code escrow. If there is a bug you can fix it, hire someone to fix it, or hope someone else has the same problem and fixes it for you. But the fix won't come automatically.

Re:Easy

[CAIMLAS]

Do you get free maintenance on your car, too?

No, what you propose isn't really workable, re: support. However, it would be reasonable to expect a more open approach to things - like, say, use and/or documentation of file formats used, and public access to the access mechanisms. Most proprietary software works in such a fashion which would be analogous to, say, a Ford engine breaking if a mechanic hooked up a non-Ford diagnostic tool.

Re:Easy

[Hyperspite]

I'm not so sure we can compare software to standard items. Software has so many lines of code that it's as if you went out and bought a huge finely engineered machine with thousands of parts instead of that dinky 10 part toy car you got at the supermarket. If I bought one of those, it seems reasonable that I could get a contract for repairs for several years and pay for extended service as long as I want. Of course, the average customer isn't paying thousands to millions of dollars to the vendor, but on the whole they are. It seems to me that as long as enough of them are willing to pay more than a certain amount, the fixes should come.

voting

[99BottlesOfBeerInMyF]

Umm, isn't that the format used in the most popular voting machines to store all our votes?

Re:voting

[julesh]

Umm, isn't that the format used in the most popular voting machines to store all our votes?

Yes. And?

Exactly the situation that Open Source wins

[Anonymous Coward]

This is exactly the type of situation that proves why Open Source should exist and be used by any company with a brain and the willingness to retrain or dump their Windows Administration teams.

Well supported and popular technology? Check. Original developer not interested? Oh well, grab the source and fix it. If you can't, someone else will because it's popular.

End result - a secure platform for your legacy (and current!) applications without costly redevelopment costs.

Re:Exactly the situation that Open Source wins

[CannonballHead]

Sounds absolutely great. I wish every business person was as smart, since open source is obviously better in every way than closed source.

End of sarcasm. Yeah, open source is pretty cool, I like it, etc. Does open source guarantee everything wonderful, does open source guarantee a business with a profit? No, it doesn't. Open source is not the answer to everything.

And even open source organizations will stop support for decrepit applications. If you insist on using a 10 year old Linux kernel and demanding that some quirky bug in it be fixed, I'm not sure how much support you'd get :)

Is that an exact analogy, no... but, as a previous poster said, businesses run on profit, not open source feel-good-ness... :)

Re:Exactly the situation that Open Source wins

[Anonymous Coward]

Hint: you can fix it yourself.

Re:Exactly the situation that Open Source wins

[Anonymous Coward]

Hint: Name me one bug you've fixed in the kernel.

Hint: Name me one bug you've even looked through the source and found.

Hint: STFU and GBTW if you're just here drinking the kool-aid.

Re:Exactly the situation that Open Source wins

[cduffy]

Stop free support, you mean. If you want a bug in a 10-year-old kernel fixed, you can pay me to do a backport. Sure, I'll charge completely insane rates (my primary job keeps me busy as it is), but there are enough C developers with kernelspace experience that if you have a reason to use a 10-year-old kernel (and in embedded space, that's not a completely unreasonable thing to do), you can find someone who'll maintain it for you.

Open source may not guarantee you profit in your core business, but it does guarantee that you're not held hostage to a single developer who owns exclusive rights to the infrastructure you built on.

Re:Exactly the situation that Open Source wins

[Anonymous Coward]

Hint: You don't have to be a programmer to find a bug.

Hint: Just because he haven't fixed any bugs, or even found any, doesn't mean he can't pay someone to do it for him.

Hint: You try that with $PROPRIETARY_VENDOR

Hint: You're an idiot.

Re:Exactly the situation that Open Source wins

[TheRaven64]

If you insist on using a 10 year old Linux kernel and demanding that some quirky bug in it be fixed, I'm not sure how much support you'd get :) The amount of support you get generally depends on how much you are willing to pay for it. This cost will go up as the product becomes less mainstream. The upper limit (when you are the only organisation using it) is employing a team of people to become familiar with the code and fix bugs. This is likely to cost a couple of hundred thousand dollars a year, but if you are running a multimillion dollar business on some in-house software that depends on something external, then it may be worth it. It's more likely that it will be cheaper to port your code to something newer at this point, however. This is a last resort with Free Software, but it is not even an option with proprietary code. If the proprietary vendor decides it is not in their financial interest to keep developing the software then you are stuck.

The cost of maintaining Free Software follows a curve. You can fairly easily predict how expensive it will be to keep maintaining something you depend on, and how expensive it is to move away. Once it becomes cheaper to move, that's what you should do.

Re:Exactly the situation that Open Source wins

[Anonymous Coward]

Did an MCSE take your job?

Nope. They're still flippin' them burgers.

Re:Exactly the situation that Open Source wins

[cduffy]

You do realize that slashdot is a pretty lousy place to be challenging the crowd to show their kernel hacking creds, right?

(Me, I've fixed PS2 keyboard support on some obscure MIPS subarchitecture, and ported the MPPE driver to Linux 2.4 [think I was actually the first person to do that, though it's someone else's port that made it upstream], and did a little tooling around the input core, and fixed a DSDT bug that was causing the PCI bus on some Hitachi prototype hardware to be initialized wrong... but then, I'm mostly a userspace type).

Re:Exactly the situation that Open Source wins

[toadlife]

Yes. There are people like you and then there are the other million or so slashdot users who think they are a the shit because they managed to fix their screen resolution by editing xorg.conf with nano.

In my opinion-Line drawing.

[Anonymous Coward]

Maybe the question isn't were the line should be drawn, but who should do the drawing?

Re:In my opinion-Line drawing.

[timeOday]

Maybe the question isn't were the line should be drawn, but who should do the drawing?

That sounds good, though I'm trying to imagine quite how it would be done. One of the credos of security is "secure by default." In practice, this makes it very frustrating to get some things, like Cups remote printing, to work. Again and again, you find things intentionally "broken" and have to make an effort to get them to work. I'd rather allow somebody to run my printer out of paper than waste hours on it. (In practice it's always the bugginess of ghostscript and cups that cause the printer to pump out page after page of gibberish, not attackers, but I digress...)

This doesnt matter

[hcmtnbiker]

IMO this potential exploit is useless unless you're doing something with a JET database that you shouldn't be anyways. JET doesn't have database transactions, sure if you want to you can write them in at the application level but that's incredibly costly. If you're allowing people you don't trust to access a JET database something is wrong. JET will screw up if two users try to modify it at the same time, so why would someone you don't trust be using it, they could just as easily cost you enough damage by just modifying the DB while you are. SQL is used for that sort of thing, NOT JET.

Re:This doesnt matter

[Anonymous Coward]

Jet isn't useless. It's a fairly featureful file-based database which has somewhat decent ANSI support and decent library support via VBA functions. It also does support transactions. Your assessment of Jet is more or less correct, but it's not a failing of Jet as much as it is a failing of any file-based database which lacks a centralized server. Because the client library reads and writes directly to the database files it is possible for write operations to collide. There is no central process in charge of policing the interaction to the database. This is compounded if the database isn't local as the latency for file operations is considerably greater. This is true of all file-based databases, including SQLite.

If it's multiuser or networked, go RDBMS.

Re:This doesnt matter

[Vthornheart]

Exactly. What the hell are websites doing allowing people to upload Jet Databases to publicly accessible folders anyways? Giving out your website's master FTP username/password is a vulnerability as well, but no sane web host would do such a thing. I hope it'd be the same for the former scenario as well as this latter one.

Re:This doesnt matter

[Anonymous Coward]

Yes it does. The PoC is just an .mdb, so there will soon be a significant outbreak of spear phishing and email worms via zips of "the data I said we would send you".
Most people don't get that MS removed access to .mdb attachments by default because they're a potentially unsafe file type to email, they just know that you have to zip them these days for some reason.

Re:This doesnt matter

[Anonymous Coward]

Exchange only "Sort of" used JET. It was a highly customized and optimised version of JET, The 2 were never similar in any real way except the name.

Re:This doesnt matter

[Allador]

Exchange Server never used the Jet that Access uses.

It used something that originated as DAE, and whose team and query engine was merged for a brief period with Jet Red (what Access uses).

But the ESE (sometimes called Jet Blue, even though it has almost nothing to do with the Jet that Access uses) used by Exchange and Active Directory is not that Jet you're talking about.

2 minutes of search on wikipedia for 'jet blue' or ese will clear this all up for you. In particular, read the History section and the 'comparison to Jet Red'.

Re:This doesnt matter

[Allador]

It's interesting talking about things like hand-optimized assembler, and the like. Microsoft did alot of that stuff in the early days of windows, and it worked wonders for them then (fast apps), but now is coming to bite them in the butt.

Take the VBA engine for example, embedded in all the office apps. I read a blog by one of the office team folks, and he talked about what a horrid mess that thing was, so heavily optimized, with big chunks of assembly that it was almost completely unmaintainable at this point. The article was in the context of porting it over to the mac office versions, and he was saying how it was completely impossible because of these issues.

Just an interesting aside in how those early optimizations were great then, but are killing them now.

Re:the fine line between linux and rimming

[The Anarchist Avenge]

I've gotta say, it's comforting to see this again. It felt weird to not have to quickly tab down a few times so that bystanders wouldn't think I was reading about eating someone elses fecal matter. I, for one, am glad to welcome back "Mr. eating-shit-troll" back into the Slashdot fold.

Tough times... People are plagiarizing bug reports

[AngryDad]

This (or similar) bug was reported by HexView in 2005 and they also received no word from MS. http://www.hexview.com/docs/20050331-1.txt

Patching one hole in a pegboard

[Volante3192]

So to fire off this vulnerability, you have to run an .mdb file you found from "somewhere." Never mind these things could have embedded VB macros and other controls that could wreak havoc.

Why not just start running installs you find from "somewhere?"

Access and mdb are insecure as it is when you start running untrusted files; should we expect all of those to go away at the expence of neutering the key selling point: stupid easy to do anything with?

Re:Patching one hole in a pegboard

[Savage-Rabbit]

Why not just start running installs you find from "somewhere? You would be surprised how many Windows admins (and some *NIX admins as well) will think nothing of running scripts and apps from very dubious sources on highly valuable mission critical servers. I have witnessed any number of messes caused by somebody running scripts they got from a link in some forum thread without bothering to get an idea of exactly what it was the thing did or even simply checking if the thing was compatible with the system version they were running them selves. David Hannum was right.... there is a sucker born every minute.

Security News Flash

[flaming error]

some web servers could be at risk if users upload a malicious .asp / .mdb file and then execute it via calls to "ADODB.Connection". Servers could be vulnerable to attack if they allow users to upload and run malicious code? Say it ain't so!

why do people

[sentientbrendan]

keep using access? It is so dinky as a relational database... I'm not honestly sure what it *is* supposed to be used for.

Re:why do people

[mfnickster]

> why do people keep using access? It is so dinky as a relational database... I'm not honestly sure what it *is* supposed to be used for.

Microsoft Access is a demo. It's meant to seduce you into thinking that developing your own database applications is easy and fun, and that Access can address your organizational needs adequately. This puts you onto the path that will eventually lead to you buying MS SQL Server.

At least, that's been my experience! :)

Re:why do people

[kelnos]

Unfortunately, with Access, it's not about the database itself, but about the GUI tools that many people find easy to use...

Re:why do people

[bladesjester]

This puts you onto the path that will eventually lead to you buying MS SQL

Nah. Most people only used/use Access for smaller stuff. They came out with SQL server lite a while back. Free of charge and embeddable into .net apps (much like cloudscape is for java apps).

Re:why do people

[domatic]

Well, that actually is my problem with FileMaker Pro. It too seduces you into thinking that developing database apps are easy and fun. The difference is that when an FM Pro app starts flaking out (public school systems are just eaten up with FM Pro deployments that got too big for their britches) there isn't a "big brother" product to easily transition to that scales.

Yeah it's true that Access is a gateway drug to SQL Server. But that IS a viable upgrade path for that little workgroup app that some PHP decided to expose to a 10,000 node WAN.

Re:why do people

[TheRaven64]

Access is not a database, it's a RAD tool for data-drive apps. You use Access when you want to quickly create a GUI for processing data (well, now you'd probably write a web app, but in the '90s it was the thing to use). Once you've done this, you progressively add features to your simple tool. Eventually, you have something that sprawls over thousands of lines of unmaintainable code, depends on Access, and is vital to your company.

Re:why do people

[SCHecklerX]

I thought it was just a way of keeping a bunch of copies of the same spreadsheet in one file. Not sure why they call them tables instead of spreadsheets though :)

Re:why do people

[Mr2001]

This puts you onto the path that will eventually lead to you buying MS SQL Server. Or installing SQL Server Express for free?

Re:why do people

[NullProg]

Minor correction..

Access is not a database, it's a RAD tool for data-drive apps.
IIRC, Its an single user ISAM database with a separate index. Microsoft tacked on (wrapped) C++/C/VB5/VB6 tools to make it RAD. FoxPro was better (X-Base) at the time IMHO. At the same time I used the Mix C-DATA ISAM database because it worked under OS/2, Unix, DOS, and windows (Truly cross-platform).

Enjoy,

Re:why do people

[ronabop]

The difference is that when an FM Pro app starts flaking out (public school systems are just eaten up with FM Pro deployments that got too big for their britches) there isn't a "big brother" product to easily transition to that scales.

I've scaled FMP out quite nicely, actually. I think the problem you're more likely running into is one where poor database design and implementation does not scale, regardless of the engine used. Since you mentioned school systems, here's some examples of particular design and implementation mistakes I've run into in that environment.

• Keeping all student records in one table, in perpetuity, so the engine has to slog through records from 10 years ago to find today's current students.
• Keeping all records, for all tasks, on one DB machine, in one set of tables, rather than using separate machines (why should the student attendance records *always* be on the same machine as the cafeteria menu, the janitorial schedule, the PTA newsletter, and the 2001 teacher vacation sign-up sheet?)
• The BigTable. Everybody who's worked in cleaning up poor DB design knows this one, the freaking huge table that stores *everything*. As text fields, of course. With no relational links.

These simple design gotchas can be made with *any* db engine, and are often made by inexperienced designers. Easy and fun is setting up the basics, and when it gets slow, paying some geek (or finding a young volunteer who needs to pad their resume) to re-engineer the system.

Of course, there are an awful lot of inexperienced db admins out there, who have only worked with scaling one or two kinds of db engines, and thus lack the history of "scaling" back when 30Hz and 64Mb of RAM was the maximum per desktop (and thus lack the tao of partitioning zen), or are used to using their "clustering tools" (and thus lack the tao of systems connections zen), or any other number of failings which prevent them from understanding how to actually scale something really big.

If you're applying for a job as a DBA (or are the chief teacher/DBA for a school system), and you don't understand how DNS scales, well.... there ya go. ;)

Re:why do people

[TheRaven64]

Keeping all student records in one table, in perpetuity, so the engine has to slog through records from 10 years ago to find today's current students. I've not used FileMaker Pro, but this just sounds wrong. First, searching through a DB table should be a O(1) problem. If it's O(n) then you have some serious problems with your RDBMS. Unless what you are really saying is that your indexes no longer fit into memory so you need to start swapping.

Secondly, you seem to be advocating splitting records between two tables. It seems like the correct solution to this problem is to instruct the RDBMS to partition the table. Splitting it into two tables breaks one of the main points of using a DB; that the client software should not have to know how the data is stored.

Re:why do people

[pedestrian crossing]

depends on a particular version of Access

There, fixed that for ya....

Re:why do people

[Anonymous Coward]

the fact that you regard these as "design gotchas" just points out how stupid you are.

Re:why do people

[operagost]

Even assuming you mean 30 MHz instead of Hz, 64 MB of RAM is out of line for such a machine. A 33 MHz server (say a really old 486 Proliant) usually had 16-32 MB of RAM. A 33 MHz desktop was lucky to have 8-16. We're talking $50/MB here.

Re:why do people

[domatic]

My scalability concerns are a bit more serious than a badly designed table/query structure making the application slow. We have a mission critical third-party app that runs on FM Pro (which I inherited....). During the crunch times when the relevant staff are making heavy and simultaneous use of the app, I've had database corruptions for three years running. Now it may indeed be the case that crappy programming is at fault here (I wouldn't doubt it actually. And yes, we are seeking alternatives. The functionality is difficult to replace.) but the experience hasn't bolstered my confidence in the FM Pro dependency. I've also seen similar behavior from other FM Pro apps.

Given some heavy demonstrations, I may concede that an FM Pro dev who knows what he's doing can build a reliable, robust, and scalable applications. What would still make me a hater is it invites casual development which PHBs are then won't to deploy widely. I see it as an extra shiny Foot Howitzer that begs in a sultry woman's voice "Shoot Me!". In such cases, the worst thing it will do isn't get really slow. It's apt to munch data.

Something like Postgre on the other hand requires at least a journeyman level of competence to even get it to do anything. Things like Access, Postgre, and even MySQL have an inherent bozo filter that weeds out the worst of the poseurs.

Re:why do people

[rickb928]

Gee, sounds like Access. A shared Access table corrupts about as easy as a prom dress. Or something like that.

You'll be looking at something like mySQL,etc, to replace that.

But the functionality you're thinking of isn't in the db engine, it's in the GUI and interface. that is, most likely, completely replaceable, though not cheap to re-create.

You can probably provide the same pretty face in anything from Notes to ASP, PHP, even the dreaded SQL Server variants.

I used FMPro for a long time, with a fairly large contact DB in use by 7-8 people. You may want to look over your networking, especially if it's Windows. Disconnections will cause corruption, and they can be hard to diagnose. Among other things, if your LAN is addressed in the 10. network, watch that any external connection also doesn't go through another 10. net. This is a shortcoming of Windows Networking, if only by design. And awfully hard to diagnose or test. Rotsa Ruck. Rewrite it in PHP! :-)

Re:why do people

[domatic]

That's actually my intent. The package in question is used to write IEPs. For a school district, that is as mission critical as it gets. Having the IEP server consistently take a dump in the middle of IEP season is what made me a major hater of FM Pro. A really gross app at this company I moonlight for hasn't been fun either.

If there is one call I hate to get, it's the one that goes like this, "I have an IEP meeting with the parents in 2 hours and the server gives this table not found error when I went in to print! HELP!!!!" Now imagine getting clusters of those several years in a row. I have hit the point where I am in fact going to develop a LAMP app to do this.

You've also tapped into something I've long suspected about FM Pro. It is RDBMS, widget library, and scripting engine all in one. I believe other database apps gain robustness in all those things being separate modules. It's like an automatic transmission in that trouble in one part spreads to everything else and it is running the thing hot that will do it.

Re:why do people

[jimicus]

... which the IT department know nothing about, which gets broken with the next upgrade.

This is the clear case for OSS

[DarkOx]

Almost all other OSS model vs proprietary model arguments are at least somewhat fuzy. Ethics and economics often seem to be in conflict. In many cases neither is tested or clear and we can't even agree on what goes in the pro and what goes in the con columns for each model individually. This case though highlights the fact very clearly that even if all software in your stack is not OSS at least the platform and common libraries should be.

JET is a depreciated platform and is no longer being actively developed or really supported in new projects by Microsoft. *OK* A perfectly reasonable position to take when you do have functionally replacement products being offered, which they do in the form of MSDE.

Every product has a life cycle which eventually is end of life, JET is old obsolete and makes little since for new work on todays more powerful platforms. *OK*

Lots of projects and products are build around JET, many of them are not obsoleted, replaced, and newer versions based on different storeage backends might be quite a ways off. There is a lot of JET stuff out there, lots.

The OSS model in this case would result in somebody fixing it, simplly because so many people use it for so many things. Even if the original authors could not be bothered lots of organizations or individuals out there would have a vested interest in makeing a fix. They would then be prettly likely to share it because there is no reason not to do so. In other words the entire software ecology around JET could be secure while other people and vendors migrate off those depricated platform components, instead everthing is going to remain vulnerable or broken unless Microsoft(insert any other vendor here for other cases) can be shamed into patching it.

Re:This is the clear case for OSS

[kelnos]

They would then be pretty likely to share it because there is no reason not to do so. Individuals, yes, probably. Organizations? Maybe, maybe not. In my experience, when someone at a company fixes a bug in 'upstream' software, they keep it to themselves[1]. It cost the company money to find and fix that bug, so they figure something like: why should we give that time (money) to our competitors for free?

Not saying I agree or disagree with this attitude... it's just how it is.
[1] Well, except for fixes to GPLed code.

Re:This is the clear case for OSS

[Allador]

JET is a depreciated platform and is no longer being actively developed or really supported in new projects by Microsoft. *OK* A perfectly reasonable position to take when you do have functionally replacement products being offered, which they do in the form of MSDE. Jet hasnt been deprecated, the MDB file format has been. Jet is still present on windows and ACCDB files are the currently supported flavor.

Re:This is the clear case for OSS

[TheRaven64]

The GPL doesn't make a difference if the company is not distributing the software. The reason for distributing code is that it costs more to maintain a fork and that cost increases the more it diverges. The reason for not distributing is that the fix gives you a competitive advantage. If the cost of forking is greater than the financial gain from forking then it makes sense to give the code back. Often, the people they will be helping are not their competitors, but their suppliers and customers (particularly for any piece of software they use for communicating up and down the supply chain).

Yet another shameless self-promotion

[statemachine]

The "article" submitter is only trying to drum up hits to his blog. When it's this obvious, I don't even bother clicking through.

Perhaps it wouldn't solve everything, but IMHO not directly linking the submitter's name to a non-slashdot URL would greatly limit the article spam on here. And, of course, not letting someone use slashdot to blatantly toot his own horn would limit the practice further.

Re:Yet another shameless self-promotion

[Anonymous Coward]

What bugs me is that it's not even about the proverbial "fine line". That expression implies that too much of one will make it tip over into the other.

Re:Yet another shameless self-promotion

[ptbarnett]

The link on the submitter's name should no longer be an issue. The URL has a "nofollow" attribute -- if a search engines honors it. However, the remaining links in the article summary do not have the no-follow attribute.

Surprise?

[Anonymous Coward]

Microsoft's response came as a surprise to him -- it appears that Microsoft is not inclined to fix a critical arbitrary code execution vulnerability with a data technology that is at the heart of a large number of essential business and hobby applications.

Has he been living under a rock for the past 20 years? Why would this come as a surprise to him?

Abusers are losers.

[Futurepower(R)]

"Microsoft is a company, their goal is profit." [spelling correction]

In my opinion, that is a common mistake. Microsoft's main purpose is abuse, not profit. Microsoft is not a software company that is routinely abusive, it is an abuse company that uses software as a means of delivering abuse. If you look at it that way, Microsoft is excellent at what it does.

That follows the general rule that what happens over a long period of time is what the people involved meant to happen.

Being abusive may or may not make money, but it always causes harm to the abusers. That's why Bill Gates has trouble with depression. It's easy to guess that a chair-throwing monkey boy is not a happy camper, either.

Abuse is why Sandy Weill, formerly of CitiBank, had heart trouble, I think. That's why Dick Cheney, U.S. vice-president has heart trouble. (Whaaaat, you say. Dick Cheney has a heart???)

We seem to live in a society dominated by abusers. The dollar is being inflated so that the U.S. government will have enough money to fight a war, so that oil and weapons investors can get control of the oil supply.

Re:Abusers are losers.

[SpaceLifeForm]

You forgot about the spying. Windows software exists so it can be used to spy on you. Therefore, they don't want to close those holes.

the wide chasm between gooed & evile

[Anonymous Coward]

it can be crossed.

consult with/trust in yOUR creators. providing more than enough of everything for everyone without any distracting infactdead personal gain motives, whilst badtolling unprecedented evile, using an unlimited supply of (user friendly, highly secure) newclear power, since/until forever. the lights are coming up all over now. see you there?

But...

[cromar]

Why shouldn't those goals be reflected by our corporate overlords?

I'm starting to believe the conspiracy theorists

[Anonymous Coward]

They completely borked asp support in the sp2 release for the otherwise excellent 2003 server.

How could any test plan have missed that little one. Anyone running any kind of real asp app would be dead in the water with this one. Either they were grossly incompetant, or they purposely nuked asp. Months later and you still have to make a special support request for this patch.

Why MS did this

[Thinboy00]

Microsoft no longer cares about most markets because the only one that doesn't have major competition is the PC. Microsoft can't deal with the Pandora's Box of updating critical, widely used things when Linux is slowly gaining ground. If they lose the PC, they lose their only near-monopoly. So they don't care about other issues because they aren't as important to the incentive of making a profit as maintaining a near-monopoly. Hopefully everyone understands the previous sentence... it basically summarizes the rest of the comment.

Not a big deal...

[Vthornheart]

They're making a big deal of the following in both of the links in the article, repeating the same phrase over and over: "some web servers could be at risk if users upload a malicious .asp / .mdb file and then execute it via calls to "ADODB.Connection"." They say this twice in one paragraph at one point. But what does that really mean? That means a server running ASP, that also is allowing end users to upload .mdb databases to it (???), AND to expose them from whatever location they've been uploaded to so that Connections can be made to them, will be vulnerable. That's a pretty hefty list of "ifs". If you're letting your users upload .mdb databases to your webserver at all, let alone to a publicly accessible folder, you're already asking for severe trouble. I can't imagine a website out there that would allow such uploading/public exposure to happen that doesn't already have severe security flaws merely by the amount of freedom its given its users in what they can do on the site. This is definitely a vulnerability, but the impact to ASP/ASP.NET servers is minimal if the hosts are implementing common sense security practices/user restrictions already.

Re:Not a big deal...

[Somecallmechief]

I'm on the fence on this one. On the one hand, I hate Microsoft with a reverence of the Buddhist order. On the other, I love Access. I would never have learned the 5th normal form without Access. I'm old for this generation, and at 27, I'm 14 years behind the learning curve; but I thought the GUI interface for Access made my transition into SQL blissfully smooth. If it's not the heart of SQL you're after, Access is just another hundred or many more MB of wasted space. As a guide into the world of relational databases, I think Access serves a mighty role. A GUI look at 3rd normal form databases vs. 5th normal form databases helps enormously.

I'm sure there are other, infinitely superior tools out there that I didn't know about. I'll bash MS on every other front, but I'll always have my fondness for Access.

Security != Inconvenience

[flaming error]

That convenience and security are at odds is a flawed premise.

Secure software doesn't have holes. User-friendly software is intuitive and does what it should.

No reason the two can't happily co-exist.

Re:Security != Inconvenience

[TheRaven64]

I don't know why you haven't been moderated up. The belief that secure and user friendly are incompatible is the cause of a lot of insecure, unusable software. Security is a user interface problem. If you make security features that aren't user friendly, then the user will just disable them. If you make it so they can't be disabled, the user will use a different product. If you make them hard to understand, the user will use them wrongly.

Re:Security != Inconvenience

[CAIMLAS]

Oh but security and usability are at odds. While, inside a void, the statement that they aren't at odds is certainly true, that is an idyllic situation and not something even remotely real-world.

In the real world, users have gotten accustomed to the status quo. Any change is, therefore, at odds with them getting their real work done through interference with their work flow - whether it's something like a new OS upgrade, different software to learn, or something as simple as a password change. User friendliness can be defined by how familiar and comfortable the software is for the user, as well as how easy it is to use intuitively - though not one or the other holding higher than the other. Any change, whether for security purposes or not, will mess that up. If a user has to change or interfere with their process of getting work done, then work friendliness has been impeded.

So, a change - an increase - in security is indeed a decrease in user friendliness, no matter how small. Short of using DNA sequences scanned at the time of log-on - and doing so automatically - this will always be the case.

As a crude analogy: having to unlock your front door when coming home with a bag of groceries is an impediment to user friendliness. It would be so much more user friendly to not require the lock - or the door, for that matter. However, that door and lock are necessary components. Inconvenient, yes, but tough shit.

Re:Security != Inconvenience

[TheRaven64]

As a crude analogy: having to unlock your front door when coming home with a bag of groceries is an impediment to user friendliness. It would be so much more user friendly to not require the lock - or the door, for that matter. However, that door and lock are necessary components. Inconvenient, yes, but tough shit. And a key is easy to steal, so it's also an insecure solution. The secure and useable solution would be to have the door recognise authorised people. Very high-security institutions do this in a quite low-tech way; they place a human on the door who opens it for people who are authorised to be there and shoots those who are not. This is both user-friendly (you don't need to manually open the door) and secure. The same is true in the computing world in most cases.

Re:Security != Inconvenience

[CAIMLAS]

There is no such thing as absolute security, and your statement demonstrates an ignorance of this.

A key is not necessarily an insecure solution. It's as secure as any major computing authentication mechanism, at least. No, the key is only as secure as the lock is strong and as careful as the key owner is. Which, in most of both cases, is "not very", but usually it's strong enough to keep out all but the most determined criminal.

I don't disagree about armed guards, but there are plenty of ways in which that's not a perfect system, too. Plastic surgery, synthetics, impersonators, bribes, subterfuge, etc. - they can all be used to circumvent the image recognition of the guard.

If the product is defective, they must fix it

[thogard]

Consumer protection rules are very clear on this. If the product is defective, its still covered under a warrantee and must be repaired or replaced at Microsoft's expense.

It gets very interesting when the problem starts to cause other people problems under "innocent third party" laws. The only draw back is that it too nearly 30 years for these laws (and an act of congress) to take out the lawn darts so I don't think this has any of the legal team at Microsoft losing sleep.

Re:If the product is defective, they must fix it

[db32]

1. Too bad by purchasing this product you agreed that it should not be used for anything important and cannot hold the company liable for it.
2. I can't believe you are seriously upset about lawn darts.
a. Children can still purchase all manner of dangerous toys to include paintball guns, pellet guns, and the good ol bow n arrow. b. If a 12yr old can legally operate a shotgun I fail to see how a lawn dart ban is anything other than a waste of my tax dollars. c. If you are too stupid to observe basic safety or watch your children I fail to see how that should become a tax burden on me to fix. Do you clean a gun while its loaded pointed at your face? Do you let your kids play with that same gun unsupervised? Now I agree that these companies are deceptive at best, I think the proper solution is to nail them for misrepresenting the stability and security of their product while their manual says "don't do anything important with this software and you can't blame us". But really it isn't the software companies fault, that is the poor bastard who decided to make the purchase of the software to use for some critical application with no promise that the shit will actually work as advertised, and even worse, a disclaimer that it probably won't and that you can't hold anyone liable. Should we also ban the sale of rocks because when used improperly you could throw one at someone's head instead of tossing it into a numbered box and then hopping after it?

Access leads to...

[argent]

"Access is the path to the dark side, for Access leads to SQL Server, and SQL Server leads to suffering."

Re:Access leads to...

[mfnickster]

"Is the 'DLookup()' function more powerful, Master Yoda..?"

"Hmph. No. Simpler; easier, more seductive!"

Re:Access leads to...

[Anonymous Coward]

"Access is the path to the dark side, for Access leads to SQL Server, and SQL Server leads to suffering."

Yes, you're funny, but SQL Server is a solid, well-done database. In terms of quality of product, I think it's the best thing that MS sells.

Re:Access leads to...

[argent]

SQL Server is [...] the best thing that MS sells.

Damning with faint praise.

SharePoint ?

[justdrew]

wouldn't they be talking about sharepoint?

Re:SharePoint ?

[Anonymous Coward]

Sharepoint runs on MSDE/MSSQL, not JET.

Basically this is saying that you could call this JET exploit IFF you uploaded mdb file and could write some asp files on the remote site and call them, or otherwise own the box to setup the ODBC connection and activate it.

My issue with this is once you have your scripts/executables upload ready folder why bother putting some shitty jet exploit up when you can do whatever you want.

Also, you can disable use of JET/MSSQL, etc in your web directories, which you should be doing on user writable areas.

I don't understand...

[certain death]

I kinda RTFA, but I don't see how you came up with the title for this article. Have you been using the Bullshit Generator again? You did not, in my opinion link usability and security with your words...get some more words please.

It's not just small businesses

[RipSlider]

No matter what is written above, it's not just "Small business" which use Jet. I'm under an NDA(s), so won't name names, but lets say that, in the course of the last 18 months, I have worked in 1x Top 5 Bank and 2x top 10 financial services houses, in the UK, that would collapse if they loose their Access Databases within one week. ( Guess what my firm was brought in to do?) It's a similar situation to the household name that most people in the UK and US have some direct or indirect monies held in that currently has more than 700 staff in my company working 24 hours a day, 7 days a week to get all their data into a new data ware house after a rather worrying period where their main DB went down. What was the DB? It was a massively hacked about version of a CRM package that a developer got off a coverdisc ( PCPro magazine to be exact ), 6 years ago. Here's the thing: Big companies get into the same messes as small companies. If you truely believe that ALL of the top companies are using Oracle DB's, SOA architectures and data warehouses for mining purposes, your living in a dream world. Working as a solution architect that is meeting 2-3 major, as in top 250, clients a month, and looking at their issues, and the mess that they've got in to, I would be suprised if Microsoft manage to hold their "We're not going to fix it" position for long. Fact is, as soon as CIO's get stressed, they start to shout, and they'll shout at Microsoft if they feel that there is an issue. Remember that a lot of the major firms have 10 and 15 year support contracts with Microsoft, each of them bespoke. If one of them demands a fix, it will immediately be made available to all of the others on bespoke support contracts. At which point there is little reason to hold it back from the other major buyers, and so it cascades down the chain.

Re:It's not just small businesses

[gnuman99]

Read at least the first paragraph before spreading more FUD. This is NOT a security problem as many pointed out here.

"allowing for arbitrary code execution once the victim interacts with a malicious JET-dependent file (such as an Access file)."

It is crazy. Like saying you downloaded a malicious .so file, installed it and it caused a security problem and the OS should not have allowed it. If you download malicious JET files, well, these tend to have code in them that can cause problems. DO NOT do that. So, this is not a critical problem unless your application is critically insecure by design in which case you have a different problem.

Re:It's not just small businesses

[Ozeroc]

Sounds very familiar. I would mod this insightful if this wasn't my very first post ever. Oz

MS Exchange

[flyingfsck]

is not mainstream and not used anymore?

Re:MS Exchange

[Allador]

MS Exchange doesnt use Access, and it doesnt use the same 'Jet' as what Access defaults to.

Exchange uses a database technology known as ESE that was at a time known internally as 'Jet Blue'. Although its got the word Jet in it, it is not the same as the 'Jet' engine that Access uses.

Read more at Wikipedia. Particular note the difference between ESE and Jet Red.

mandatory open-source unless supported

[wikinerd]

My proposal is that, at least for security-sensitive products, closed-source software vendors must be forced by law to release their products as open-source after X years from the moment they stop properly handling user complaints. So, if you release a product used in sensitive installations and you stop supporting it after 3 years, you should be expected to open-source it as to allow the user community to maintain it.

This should solve abandonware, which is a very serious problem in security-sensitive software. Releasing closed-source commercial software and then stopping supporting it is bad, especially when it comes down to security. At least, they should give out the code and allow the users to do their best themselves.

Another idea (a bit more extreme) is that, just like patents, closed-source vendors should open-source their stuff X years after the initial software release. Some companies do this voluntarily and it has helped, rather than negatively affected, their sales.

Even though I dislike having too many laws and too much government, I would feel positive about such laws if any lawmakers would be willing to consider them.

Re:mandatory open-source unless supported

[corsec67]

That should be tied to copyright as well, where after you stop selling/supporting something, it should go into public domain, not more than 15 years after you initially sell something. You could have the source in a secure escrow type service to prevent against a company going out of business.

Copyright is already too crazy, with infinity+ years (in google speak), which needs to be stopped.

Re:mandatory open-source unless supported

[TheRaven64]

A better solution would be to require source code escrow for copyright. If you want copyright on your proprietary software, you have to place the code in escrow. Once you stop supporting the product, the code is released. Even if the code can only be distributed to people who already have a license for the software then this would be useful; at least they could employ third parties to make fixes and (ideally) distribute the diffs.

Comment removed

[account_deleted]

Comment removed based on user account deletion

MS monopoly = Limited choice = Forced to use Win

[zooblethorpe]

No one if forced to use Windows or other MS products, you can use alternative software any time you like.

... unless said alternatives don't exist. C.f. translation memory applications that can accurately and adequately handle Japanese text. The only one I'm aware of that runs on Linux, for example, is OmegaT, which still doesn't quite cover my needs.

And I'm far from alone, given what I've read here on /. and elsewhere about specific-needs software what can only be found on the Windows platform. Not all of us can get by with just basic office document processing + web browsing.

Cheers,

Drawing the line

[gmuslera]

Security
---------------------
Microsoft

Was that so hard?

Re:Drawing the line

[Loibisch]

Nono, this article is about drawing the line between security and usability, which (if you still take Microsoft into the equation) would make the resulting graph look like this.

Security | Usability
====================
Microsoft

There you have it. :P
(Notice the fine line between security and usability and the thick, fat, blocking line between the former two and Microsoft products.)

Re:Drawing the line

[freedom_india]

Dude its not that bad.
Win 2000 was strong on security.
XP can be made strong, but weak on default security.
Vista?? If you can make it run on what hardware you have, let me know

Re:the fine line between linux and rimming

[Anonymous Coward]

I've gotta say, it's comforting to see this again.

And I have to say I'm deeply disappointed in both Shit-eating Troll and Goatse Guy.

They had an opportunity in the Internet Brownout thread to be both apposite and nauseating. Both failed.

Weak, boys. Very weak.

Re:the fine line between linux and rimming

[Anonymous Coward]

You can't be serious, there is no point. This poster is doing nothing but trying take your time and/or offend you. They aren't trying to push anything except shock. It might not even be the same person doing this over and over again.

Trolling rarely has a point, and this is no different.

JET is the DB used for Active Directory

[Money for Nothin']

Microsoft is not interested in fixing a security flaw in the database they use for their Active Directory system? What, do they not care about the security of their authentication and authorization network OS database?

Color me unsurprised, really (I don't know why they don't use SQL Server anyway, but whatever the reason, they don't yet).

Re:JET is the DB used for Active Directory

[Anonymous Coward]

JET that's behind Access and JET that's behind AD/Exchange are two _very_ different beasts. Just thought to i should point that out...

.mdb is already a code-execution file format.

[Anonymous Coward]

Stimpy, sometimes your wealth of ignorance astounds me.

Microsoft won't patch this because the Jet format already allows for column type definitions that execute callbacks to calculate the value.

http://msdn2.microsoft.com/en-us/library/ms684489.aspx

If you can trick someone into opening a malicious .mdb file, you've already won, there is no need to do any stack overflow bulls*it. It's an *executable* file format, you idiots.

an mdb file is already an executable

[Xoc-S]

Of course modifying an mdb file causes a vulnerability. It would be stupid for it not to. As an analogy...he's saying that he can modify an executable file to execute arbitrary code. Well, duh! Since an mdb file can already have executable code in it, in the form of macros, references to ActiveX controls, and vba code, to treat it as anything but an executable is stupid. Microsoft Outlook and other email programs already treat mdb files as suspect. There are plenty of legitimate security holes around, but this isn't one of them.

As a hacker...

[Lord_Sintra]

I'd just like to say thank you for making my job easier.

are you that stupid?

[Anonymous Coward]

"Keeping all student records in one table, in perpetuity, so the engine has to slog through records from 10 years ago to find today's current students."

Please tell me this is a mistake, that you really don't believe I can't efficiently find current students in this table? Have you ever heard of indexes?

Access/JET/.mdb are enabling software

[blueridge]

I think the comments here regarding access as being tinker toy software are off the mark. Access has enabled scores of people to solve problems and manage data themselves.

Sure, you can sit in your geek tower and laugh at the dolts that use Access every day to solve thousands of data management issues. A secretary can be trained to use Access to manage moderately complex data (the numbers on all the new telephones, people interviewed for specific positions and letters sent relative to those positions, products bid out and vendor responses and on and on and on).

Do you really propose that she/he write a web application for this? Or just hack up some Perl with mySQL to manage these things? Or whip out a bit of .NET code? Or would you rather they ask IT to develop and application to do these trivial things?

Access has solved real world problems for real people for a long long time and will continue to do so regardless of how data and/or system design snobs feel about it. It is an empowering piece of software. I think some of the attitudes here are IT centric and not in keeping with the real business end of most companies.

Do you really disagree?

[Futurepower(R)]

I'm hoping Europeans will help me with the moderation of the parent post. I doubt those who moderated it down really disagree. It's just that many U.S. citizens have difficulty accepting that their government has become somewhat corrupt.

Correct.

[rice_burners_suck]

Microsoft is not inclined to fix a critical arbitrary code execution vulnerability with a data technology that is at the heart of a large number of essential business and hobby applications.

Correct. It's more important to code up stupid gadgets that serve no purpose other than to slow down your computer.

In other news ...

[olddotter]

In a recent case independent security researcher cocoruder found a critical bug with the JET engine, via the .mdb (Access) file format, he reported it to Microsoft, but Microsoft's response came as a surprise to him

This morning a independent security researcher was suprised that once again the sun rose into the sky this morning. "I was really shocked that the Earth is still spinning, even though it has been for billions of years."

Comment removed

[account_deleted]

Comment removed based on user account deletion

Vista explained.

[Anonymous Coward]

Explain Vista then.

XP was China White. Vista is "cheese" .

This is your brain on Windows. Any questions?

Enabling the ignorant

[Tony]

Access *has* solved real-world problems.

It has also caused real-world problems.

I have seen *way* more improperly-coded applications in Access and Excel than in any other language or programming system. Why is that? Because people are designing "databases" with no fundamental understanding of data management. People code spreadsheets with no real idea of how to identify and correct bugs. They *only* advantage the user has it knowledge of the data. (Which *is* a good thing, granted.)

Further, an access database represents an island of information. They are difficult to connect to the rest of the business knowledge base. They are usable only to one or a few people. This feeds into recreational empire-building.

And the worst part: businesses make actual *business decisions* based on these flawed islands of data.

But, it's up to management to figure out which data is "business-critical," and try to ensure that data is managed by data management professionals. Sure, not all data needs that kind of care. But I'd wager most *interesting* data does.

Re:Enabling the ignorant

[blueridge]

I agree that the Access/Excel applications that I have seen have not been normalized and at times have produced wrong data due to the operator not knowing database design, but if you think of the vast numbers of access databases out there, you have to ask the question: Would we be better off with them or without them?

On the whole, I come down on the side that Access has been a net gain. Most of the smart businesses I have interacted with new when they had outgrown it.

What are the alternatives other than not having such a tool (this is not a rhetorical question)? Training perhaps? All the alternatives that surfaced during my tenure in IT could not be implemented by the user. If you are going to take away something, you have to have something to hand them in its place.

makes a strong case in favor of open source

[Coop]

Oh gee, these critical binaries have big problems and the vendor is walking away.

How come I didn't think that might happen in 1995 when I bought the binaries? Looks like "free as in freedom" matters sometimes.

MOD PARENT UP

[Anonymous Coward]

(Ó_ò)

There's 2 aspects to this...profit=common sense

[Bearhouse]

1. If you're in business to make a profit, you realise that long-term profitability depends on goodwill, reputation, brand image and promise..or simply put, not fucking over your customers. Microsoft scores poorly on this one - like many monopolies. But things are changing, as the marketplace slowly starts to punish them. Lack of competition and some real innovation, (getting things to work *enough* - I don't mean pseudo innovation like IBM's OS/2 - a much better product, but only if you had IBM PS/2s) got them where they are - now they are losing it. Studies have shown that customers will put up with substandard quality for the 'latest' stuff, especially if it realy does deliver genuine value, (when it works). Urm - what's compelling about Vista? Office?

2. Making profit also means you're clear about what support costs, and for how long you are offering it. Options exist to get rid of Jet, (which, if my memory serves me correctly, has always been a pile of buggy inscure crap, and the subject of many Office-related security patches), so - just say either stop supporting it, (watch the market scream), or *gasp* make people pay for updates...

The problem is, M$ has always turned into a hybrid of 'product' comany and 'software & services' company. Watch while they kill support for XP in the same way, to try and push 'product' sales of Vista. I'm sure - when faced with massive switching costs - big corp. users would pony up plenty for ongoing XP updates...

This is an auto-reply email!

[Anonymous Coward]

Whoa... hold on a second people! Did ANY of you even bother to read the "response" from Microsoft?

"You appear to be reporting an issue with a file type Microsoft considers to be unsafe. Many programs, such as Internet Explorer and Outlook, automatically block these files. For more information, please visit http://support.microsoft.com/kb/925330"

THIS IS AN AUTO-REPLY MESSAGE!!!!!!!!!!! C'mon people? You have NEVER seen this before? This simply means that when he "notified" Microsoft, he didn't bother to zip the .mdb file. Since they can be dangerous, the mailer rejected the email.

Maybe he should try zipping the mdb file, then try resending!

Sad.

if they don't want to fix it

[mAriuZ]

There are other alternatives and you can vote with your pocket
and use them

you can migrate mdb to firebird or sqlite or postgres and then send them the feedback
http://www.google.co.uk/search?q=openoffice%20firebird&
http://www.firebirdsql.org/manual/migration-mssql.html
http://kexi-project.org/about.html

opensource projects accept the security patches that are created

You're forgetting something..

[cheros]

Access (and Excel, for that matter) have also enabled people to hack up 'business solutions' without the required baseline skills to evaluate if their 'solution' is actually technically, economically or logically correct.

in an age where transparency in the decision process is ever more important I keep coming across these 'solutions' where the original architect has long vanished, the decision model is at best unclear and is NEVER properly documented and sometimes whole departments depend on the result of such a black box.

The problems that causes are immense. Apart from the failure risk (those things are rarely backed up in a way that agrees with their importance), there's also the problem that such a model bears no scrutiny and is almost impossible to adapt to changing business situations, nor is it obviously under a decent change control mechanism.

Having said that, Access did at least enable people to discover what IT can do for them, as long as they don't think that hacking something together in Access makes them IT specialists. Access has sometimes allowed clients to model a Proof Of Concept quickly, although some of them seem to be switching to OpenOffice's Base (no specific reason, I just started to come across it). I must have a look at that..

That's what I observed above - it's a HUGE risk

[cheros]

The problem with those toys is that they have become business critical without having the capability to be in that position. I worked in the Global IT Risk Management section of a large bank for a while (non-UK), and -irony of ironies- their core risk management DB was in Access, and their way of speeding up this dog was to ship it to a fat terminal server in India and use Terminal Services.

The contractor in charge of this thing has a job for life, so he's not going to change it, inefficient as it is with muliple users accessing it (and license limits) and the company is too resource starved to do anything about it, so at the core of these guy's risk management processes sits .. a huge risk. The irony is IMHO breathtaking, especially since what it does is so basic it would take even an average college graduate with web and MySQL or PSQL skills two weeks to replicate the functionality, but documented (and a heck of a lot faster). I think it would have the shortest ROI time ever. It gets worse: the sole contractor who knows this thing .. is leaving.

And that's not where it stops. Once something like that works, everyone else piles on top of it with custom reports, other datafeeds, and before you know it you have the complex web of interdependencies Microsoft likes to keep itself in business, all built on the loose sand called Access. When that falls over, a large part of the business will fall on its nose, and I've had friends spend months unravelling stuff like that whilst keeping the show going at the same time.

Non-IT people should stay away from toys. Use it for Proof of Concept, thanks, but then let's use something sensible as core platform.

Sensible Access