Slashdot Mirror
Microsoft a Weak Link In Possible Cyber War
climenole writes 'Microsoft has vast resources, literally billions of dollars in cash, or liquid assets reserves. Microsoft is an incredibly successful empire built on the premise of market dominance with low-quality goods,' says former White House advisor Richard Clarke in a recent book. Microsoft makes the list of risks because so many people have installed its software for critical systems.
Microsoft is an incredibly successful empire built on the premise of market dominance with low-quality goods.
If he really said that I bet Microsoft execs are spewing their cornflakes as we speak!
Film at 11.
I mean, seriously, it's the most widely used OS on the planet. It's also the most likely target.
Lost at C:>. Found at C.
One of my computer science professors once stated, quite succinctly, that Microsoft was not in business to make a quality operating system (or quality product). They are in business to make money.
On a related note, if they were in business to make a quality operating system, they would have a tough time selling "upgrades."
If you look at any ecosystem, you'll find that there are pests trying to gain a foothold into that system by exploiting a weakness. If there is only one type of organism, the pests will adapt and exploit the weakness of that organism. This is why you need ever more powerful pesticides when cultivatign monoculture crops such as corn, wheat or even soybeans.
Same goes for ecosystems of comptuers. Given 90% are running Wintendo, you find that the pests (virus and other exploit authors) take adavantage of that monoculture. The weaknesses are then exploited and have to be "patched" in order to ensure survival of data and/or systems.
Given an ecosystem with multiple operating systems - Windows, Linux, Unix/OSX, zOS - you'll find a greater ability to defend against continual threats.
The Kai's Semi-Updated Website Thingy
For once, I RTFA. The summary seemed interesting. However, the FA was even more interesting, although it had little to do with all the money that Microsoft had in its back pocket, and how it's market dominance was based on low cost products.
The main thrust of the FA, for those of you who don't want to click the link, is that because the Windows OS is so prevalent in civilian and corporate usage, a Cyberattack could devastate the economy (and western civilization).
âoeAny society that would give up a little liberty to gain a little security will deserve neither and lose both.
I am not a Microsoft fan, but I believe the weak link has much more to do with the meat sitting in front of the computer than the software on the computer.
"I'm just here to regulate funkiness."
Remember, he was the guy who warned Rice and President Cheney about an imminent Al Qaeda attack. Or depending how you view it, failed to convince them of it. Still, as ass covering goes, his was iron clad.
If you were blocking sigs, you wouldn't have to read this.
But then, to a large extent they helped popularize the PC which became ubiquitous and hence became worthy of attack. The PC also became a reasonably standard platform upon which Linux etc. could be developed and cheap enough that we can all afford to own one and join in the fun. It is by no means certain that this would have happened otherwise because I don't believe security is the enemy of profit, in fact I think we'll see a future where security tightens to the point where hardware will be locked to only run a certain OS - where will Linux be then ?
Nullius in verba
All of the money spent on lobbying the government against using Linux would have been much better spent on developing a reliable, secure operating system. The shortsightedness of large corporation never ceases to amaze me. Since they spent all of this money on lobbying, which ultimately was unsuccessful, they had to spend money on securing Windows anyway. So, Microsoft spent a large sum of money in total, when they could have just made a better product to being with.
Why do you people always say this? Windows is the Single-User system botched into a multi-user environment, not Unix.
I might argue that many operating systems would be wink links in the cyber warfare scheme. The most noteable exception would be OpenBSD. If I were in a decision-making capacity, I would reach out to Theo de Raadt, apologize for the way we previously treated him, and get him started immediately in developing a secure network. He and his team seem to have the understanding of security from the lowest level possible. The current en-vogue trend, end-point security, is useless if your web application leaks memory. Ostensibly, you would need a hole in the end-point to reach the application and that gets exploited opening the network wide open.
There's nothing wrong with the newer rounds of MS software; the problem is the older stuff, which as time goes further back, tends to get less & less secure (all the way to Win98/95 which actually had no security at all).
Even now I occasionally run into boxen running thoroughly rooted Windows.....98. That's your problem.
throw new NoSignatureException();
As such you would expect them to excel at security nowadays since it seems a very big concern amongst most users. Still their security efforts are pretty laid back and half assed. Microsoft dont take security seriously, its a pr problem for them at the most.
As a market leader one would expect Windows spanking Linux, BSD and Apples behinds but in reality Windows security sucks. Not because its more prevalent but because its a sitting duck. At Microsoft, features and ease of development has always stood higher than security on the priority lists. The only thing that can change that is monetary pressure like demand for accountability of their products. Until then, Microsoft security is a game of statistics, lies and damn statistics.
HTTP/1.1 400
[Windows] may be the most widely used desktop OS, but once you include servers and small devices, Linux beats it easily.
Compared to home desktop PCs, servers are more likely to be administered by someone with a clue about locking down and updating the system. Small mobile devices have only a sporadic connection to the Internet, much like home PCs in the dial-up era, and many use an executable whitelist managed by the device maker. So barring a security hole in something like a home router appliance, desktop PCs running Windows are likely the juiciest targets for establishing a botnet.
http://en.wikipedia.org/wiki/Warhol_worm
one of these days, some genius asshole is going to, just for the lulz, shut down the whole goddamn internet in 15 minutes. he or she is going to it with a worm that, of course, will be based on something in the microsoft constellation of oses/ products/ third party software. perhaps from our other security averse friend, adobe
i thought it was going to be code red or sql slammer, but no, these infections were content to zombify, not zombify and enslave the nonzombies (see below):
http://en.wikipedia.org/wiki/Code_Red_(computer_worm)
http://en.wikipedia.org/wiki/SQL_Slammer
enslave the nonzombies: of course there are other oses out there, but they are in the minority. so listen up genius asshole: whoever writes this worm will cleverly make sure that all compromised systems DDOS non-microsoft os ip addresses on purpose. sql slammer and code red just blindly reached out to all ips and latched on to any promiscuous microsoft bitches that proved to be receptive to getting fucked. but you, oh genius asshole, will take note of those ips which defy you and share this list dynamically and automatically in real time between your other pwn3d machines
if a machine does not respond to your rude advances to be fucked, or can otherwise be quickly and reliably sniffed out as a non-microsoft os ip, punish the defiant, hard and cruel
you leveraging your growing zombie horde of microsoft os monoculturalism to mount a directed attack on nonmicrosoft machines. DDOS the responsible and the vigilant. leverage the power of the insecure to take down the secure. if the bitch won't fuck you, slap that bitch. if they will not be defeated, then they will be enslaved in a deluge of requests until they succumb. none shall survive, all shall be zombified or enslaved
and therefore completely wipe out the whole goddamn internet. for the lulz, you see
i'm still waiting, and when it happens, even though my means of livelihood is based on the internet, i'll be clapping and eating popcorn, reveling in the sheer armageddon horror of it all. awesome dude!
so where are you, genius asshole? make it happen
please don't let it happen for some insipid mundane making-up-for-my-small-penis-through-nationalism reason like cyberwarfare between usa/ russia/ china/ iran. that would be boring. nationalism is fucking retarded
get it done FOR THE LULZ my genius asshole friend, where ever you are. i'm waiting to be adequately entertained by global internet meltdown. MAKE IT HAPPEN
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Once you get away from using popular applications and O/S's, the price rises incredibly quickly. Instead of spreading (say) a billion dollar development costs across 100 million product sales, you have maybe 10,000 customers who can be persuaded to pay for a product. This immediately means no-one will buy it unless forced to by law, or unless they can in turn, pass on the costs to their customers. The smaller market also means there will be fewer suppliers - probably just one. Which in turn will drive up costs due to lack of competition and decrease any incentives to fix problems or develop new wares in a timely fashion.
We know what a secure operating system for the year 2010 will look like. It will look like VMS from 1995, for all the reasons discussed above. Now, which are we prepared to pay for: Microsoft products on every store shelf, running the country or critical systems with the security, features, lack of connectivity from the mid-90s?
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
That's horseshit. When someone makes a better OS than MS, I'll start believing these stories. ... while windows will run on pretty much any hardware.
Set the koolade down and step back. Microsoft Windows works on a much wider range of hardware than OSX, but it's still quite limited. I will concede that only Microsoft Windows excels at making use of a proprietary piece of crap like a Win-modem or a Win-printer.
Linux may have some technical merit, but is a mess where people without advanced computer skills are left in the dark.
My experience is that the average XP user is more baffled by Windows 7 than by Ubuntu. And don't even think of suggesting that Ubuntu can't be set up by someone knowledgeable.
Sure windows had bugs, but many of those aren't MS's fault, but rather vendors that write crap drivers.
Microsoft provides an ever-changing foundation of thick muck. And like you, they are quick to blame others for any problems.
My other car is a 1984 Nark Avenger.
Only government agencies can afford to spend a year designing a bullet-proof system, then another year writing the software and a year or two more making sure that no-one can ever break in to it. Are yo prepared to slow down software development by a factor of 8, from 6-monthly release cycles to a new version every 4 years? It would be commercial suicide and far too expensive.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Linux 2.6x KERNEL SECURITY VULNERABILITIES
It doesn't make sense to compare a line of kernels dating back to 2003 to an operating system that came out last year. The 7 kernel is just a derivative of the Vista kernel, for example. And in '03, XP was still going strong. Furthermore, 2.6 or whatever is just a name. I am running 2.6.32. How does the NT 6.1 you are presumably running compare to that?
The soylentnews experiment has been a dismal failure.
And Apache is the most widely used Web Server but its security record is far better than IIS. So what does that say. Also Unix/Linux far outnumber Windows Server in terms of presence on the Internet; however, they are more on the yet their track record is far better than Windows server.
I often see this wives tale but have yet to see any supporting data.
Right. Let's feed the troll, and spin it another way:
Look at the severity of the advisories (They are rated from 1-5). Neither windows nor Linux has any unpatched vulnerability rated higher than "less critical" (i.e., neither has anything unpatched that is 3 or higher). So for vulnerabilities >2/5, they both have a 100% patch rate. The difference is in "less critical" advisories, (1 or 2).
Window's 7, in its short life, has had 8 advisories rated "less critical" or lower. Of these 2 are unpatched. That means the patch rate for less pressing vulnerabilities is 75% (a full 25% are unpatched).
Linux (if I counted right) has had 191 advisories that were rated 1 or 2, since 2003, of these 11 remain unpatched, or ~5.8%.
The difference in the overall patch rate is due to the fact that far more of Window's vulnerabilities have been critical, >3/5, (specifically 12 of the 20) than linux's (26 of 217).
Also note that linux has never had a vulnerability rated 4 or 5, it's highest vulnerability has been a 3. But eight of Window's 20 advisories have been 4's and one was a 5.
Mod points: Guaranteed to remove your sense of humor.
Side effects may include gullibility and temporary retardation
Not sure I agree their attempts via lobbying were unsuccessful. Linux is used in a significant way in government/DoD systems, as noted in the article, Mr. Clarke surprised many by insisting on an evaluation of Linux in 2004 - and I remember how that study and its results ran into resistance across the boards, before the electronic ink was dry. Without lobbying efforts having tipped the playing field, Linux could very well have significantly more penetration in government infrastructure than it does today.
... the irrational resistance in federal circles to Linux desktops that prevails to this day is amazing.
And note that on the desktop front, Microsoft's strategy arguably has worked bizarrely well
"Ahh! I see you're in that indeterminate Schrodinger state where - oh, uh
It's a frequently used troll post. It has been completely debunked in the past several times. All of the critical bugs listed for the Linux kernel, for example, were local exploits only -- NONE were remote. In contrast, Microsoft's exploitable bugs are famously remote exploits meaning they can be done over a network connection. Mac OS X is another bag of worms... but thankfully, Apple controls and limits its users such that it will never be big or ubiquitous enough for large scale general use like Windows and will never likely get used in critical government or business operations.
I was comparing the "latest/greatest" from Apple, Microsoft, & the LINUX camp
If you're including linux from 2003, you have an odd and erroneous definition of "latest/greatest". Not only that, Windows 7 is an OS, Linux is not. And, furthermore, if you are comparing kernels, you have to include the Vista kernel to the 7 kernel which you did not.
I'm not going to bother refuting the rest of your drivel since it all rests on this one blatant fabrication. If you want to attack Linux's security record, at least do it in good faith then people might be willing to listen to your arguments. Your original post is little more than noise and it just sets you up for ad hominems and derision as no one can really take you seriously.
The soylentnews experiment has been a dismal failure.
That's not a troll post.
Even if his post is false,
It's a troll for one very simple reason. He's including 2.6 kernels from 2003 and comparing them to Windows 7 which uses the NT 6.1 kernel which is a derivative of the NT 6 kernel used in Vista. Intentionally distorting facts to support your argument is trolling. Furthermore, he's bringing up secunia stats as if that is the whole story without mentioning the relative severities. Of course, it's a red herring anyway as I've already pointed out.
The soylentnews experiment has been a dismal failure.
if you defeat me, you get a live-action cutscene of me doing your mom
unless you won teh internets by traversing the far more difficult /b/tard PvP realm in the Retards and Trolls Comment Board (tm) expansion pack (beta)
in which case you get a hentai animated cutscene of rule 34 THAT NEVER ENDS AN ETERNAL HELL OF FURRIES GROUP SEX OH MY GOD MY EYES
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I have checked various registries of accreditation and do not find Anonymous Coward in any of them. Perhaps you should start by revealing your identity and proving your assertions of credentials. Next, don't assume I have less experience and no accreditation. I have a degree. I have certifications and I have been in the industry since I was 16... I am 42 now. I have experience with everything from mainframes to the most obscure PCs and just about everything in between. I know the lay of the land. I know it too well. I was there for the birth of Unix (sort of... it coincides with my own birthday) and have followed the tech since then. It has been my life and obsession. Do not begin to believe that degrees and certifications even BEGIN to make someone qualified to understand what is really going on.
What you have is "product training" and little more.