If I recall the story correctly, the big dish Satellite system was "cracked" by some guy with a Commodore 64, a BASIC program, and an eprom burner.
Very similar to the whole DeCSS situation where a weak system was undermined by some teenager in Norway with a Pentium II and gcc. They won't be making the same mistakes next time... --
As others have pointed out, DVDs are already obsolete. The HDTV standard which is being implemented right now blows them away in a few short years.
I agree that a boycott will probably not do much good in getting the MPAA to change their policies. Someone should have looked at the DVD spec and the DMCA a few years back when there was only 10,000 players out there and pointed out the problems with it. That didn't happen, and now DVD is established as a must-have techie consumer item.
Still, we see people on Slashdot moaning "I can't legally watch the DVDs I paid for!!" -- and the only real answer for that is to stop buying the movies if it's a moral problem for you. People can get quite preachy about the whole thing, but the bottom line is that they are still giving their hard earned cash to the movie studios. Maybe an organized boycott would be pointless, but some people here should start personal boycotts just to avoid the hypocracy of the situation.
Right now the MPAA views the whole DVD/DMCA thing as a success. We've lost this battle. What people need to do is to get involved with the process and win the next battle. The engineering community needs to make sure that HDTV and HD-DVD formats are open. They need to propose recordable media formats that are open enough for data use, and not driven by the needs of hollywood. The political community needs to make sure the DMCA is not extended and is challenged in court when possible. We can't let the MPAA win the next battle.
I hate to sound like a pessimist, but right now the future looks pretty dark. They've already got encrypted data bouncing around *your* Personal Computer that you can't legally manipulate. The next format will a better scheme than CSS that won't be so easily broken. There are standards on the board for encrypted monitor connections, encrypted sound conections (notice how the iMac is missing a 10 cent headphone jack?), and so on.
Lots of people here promote alternatives like Linux because they want to maintain freedom in their personal computing. However, what Hollywood is trying to do is far worse than anything Microsoft has done with their closed and extended protocols. They want to turn your computer into their payola entertainment delivery device, their sealed, encrypted box. It time that the people of conscience start to realize this, and if they think it matters, at the very least stop supporting this thing with their dollars. --
You bring up an interesting point in the midst of all that -- Very few people bought VHS movies, with the exception of some kids films to keep the youngins docile.
Yet, for some reason, DVD owners feel the need to build "a collection". I know quite a few people that have bought several $20-30 DVDs of movies they had not seen, and in the end, really didn't like that much. Maybe it's just because the media won't degrade right away, but there's some other consumer instinct at work here. I mean, I can understand owning your favorite movies on whatever media, but buying something like "End of Days" just because you missed it in the theater seems kinda like flushing twenties down the toilet for fun.
As for VHS, first you say that you use it to dub DVDs, then you basically declare it an antique. Quite an inconsistancy.
One thing is true -- with the exception of the easily bypassed Macrovision system, VHS is an open format, and because of that will continue to live on. When the MPAA puts out "Recordable DVDs", you may go out and buy it because it's the latest and greatest, but you will probably never be able to rip rental DVDs with it. Back to square one and your antique VHS deck.
(A friend bought a low-end SVHS deck specifically for the purpose of dubbing rental DVDs and LDs. It's nearly the same quality of the original. And "open".) --
Back in the old days, Cadillac shipped cars with 472 and 500 cubic inch engines (about 8 liters in modern terms). These things put out nearly 400 HP and buttloads of torque. With the exception of some muscle cars and the Corvette, Cadillacs were the fastest cars GM built.
But, nowhere in their advertising did they mention the size of the engine or the amount of power or anything about "performance". Back in those days everyone just knew Cadillacs had plenty of power. I suspect it's the same with IBM and their mainframes - just too much reputation to even advertise. --
Actually, the first time I saw a solar powered laptop, it was some guy's PowerBook 160. He also had a secondary battery that was same area as the powerbook and about a 1/2 thick. Apparently he would get enough sun to actually charge the battery somedays. (Of course the total weight of this setup was probably 15#, but he was off the grid.)
That had to be at least 10 years ago. I would have to think that a solar powered G3 PowerBook would be the best way to sit in the park and 'work' all day. --
True, and a homerolled certificate is perfect for intranet stuff.
However for a public Internet site one probably needs to pay the piper and get a cert signed by someone that the browsers recognize. (I don't think you can add certs to the version 3 browsers either, which might be an additional problem with a public site.) --
I hate to say it, but this should be marked up as Insightful, not Funny -- since the PSX2 sounds like the rebirth of the Home Computer (aka Video Game Console + Keyboard).
I wonder if Microsoft is still licencing Basic? --
My experiences with the sound quality of MP3 has been pretty miserable except for the high bandwidth stuff.
At least the 4th Gen cassette dub from your friend degrades into a nice sludge of hiss and noise. MP3 seems to get these digital artifacts which are (to me) much more jaring. Maybe it's just what you are used to, however.
As for your comment about $500 speaker wire, I think what you are trying to say is that "For free, I don't care what it sounds like".
I'm pretty tone deaf, but difference between CDs and MP3s are pretty clear on my stereo system ($100 Sony Discman, $20 1970 Garage Sale Onkyo amplifier, $200 Bose bookshelf speakers). On my computer, its about the same (Integrated Crystal Audio SoundBlaster clone, generic CD-ROM drive, and $20 Sony computer speakers). The question really is how much good sound is worth to you, and how much space you are trying to fill with music. --
Here's hoping this is high enough on the page that people see it. The/. story should probably be updated.
From: Windows NTBugtraq Mailing List [NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM] on behalf of Russ [Russ.Cooper@RC.ON.CA] Sent: Friday, April 14, 2000 12:33 PM To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM Subject: Re: DVWSSR.dll Vulnerability in Microsoft IIS 4.0 Web Servers
Ok, here's a breaking update.
Latest reports say that there is
NO VULNERABILITY IN DVWSSR.DLL
Yup, that's right, different again from what I said earlier, and even more different than what I said yesterday to WSJ.
Please accept that I have followed the story published elsewhere and tried to keep you abreast of everything I knew. Also appreciate that the amount of time given to verify and research the claims made by others has been extremely short. I've had probably 30 interviews today by orgs pressing for information on the story as the feeding frenzy occurs after the first one goes to press (WSJ in this case).
MS have had people working on this thing like madmen, trying to verify the claims and investigate all of the possible pieces of code that may be affected. As that research progressed, different observations were made and so the story came out in various stages (with varying levels of "correctness"). Had they been given a reasonable amount of time to respond, nobody would have been in a tizzy about anything (i.e. the press would not have cared to run this story anywhere).
Decide for yourself whether we were better served by (more) immediate disclosure or not. I've stood where I stand for a reason, despite the loathing of others for my stance...
In the end, it turns out that unless you actually have permissions for the file you are requesting, you'll get an error message when you follow the procedures outlined by RFP in his RFP2K02 advisory.
That said, understand that sites that allow connections by Front Page may very well provide you with source asp if you request it. BUT THAT WILL HAPPEN with or without the.dll. Without proper and full permissions applied across virtual servers on a given box, site leakage or manipulation by others will always be possible in myriad ways.
>From what I've heard/seen/been told, permissions on the test servers must have either been non-existent, incorrectly applied, or permissioned the user across multiple virtual sites (i.e. incorrectly applied).
I had someone claim that they could get into an FP98 site using "Netscapeengineersareweenies!" as a userID and no password...making them think it was a backdoor userID. Fact is they could get into the same sites using "TomDickandHarry" as a userID too. If the permissions aren't set correctly, anything is possible.
This info may change again before its finalized. It may well be that there is some way to use this.dll in a way that's not intended...it just doesn't appear to be this one. On a box where multiple sites have not been individually permissions, or permissions are lax or non-existent...anyone permissioned to execute the.dll in the first place would have the ability to simply open the other sites and manipulate them directly (i.e. no need to do this junk with the dvwssr.dll)
Finally, to my point out the string not being a password. Elias Levy of SecurityFocus.com and Mark Edwards of NTSecurity.net have both correctly pointed out that using the term password to apply to that string is not beyond the realm of understanding. The client component mtd2lv.dll and the server component dvwssr.dll both need to know this value, and use it correctly, for communications to work. If you try and talk directly to dvwssr.dll and don't obfuscate your communication with the correct "key", it won't understand you. Of course if you don't already have permissions, knowing this value gets you nothing...hence my observation that its not a password. Whatever it is, it appears to be meaningless junk text used as data.
Cheers, Russ - NTBugtraq Editor "dot-age" (as in "we're in the dot-age") = senility (source Webster's)
Back before the internet, music was a scarce commodity.
When I was in High School way back in the 1980s, quite a few people I knew had hundreds of illegally copied cassette tapes. In those days, a decent 90 min cassette ran about $1 (which meant about 45 hours of recording for the cost of a cable modem connection.)
Yeah, but car doors are "Security through assuming your neighbors are honest." Nobody really believes that they prevent somebody from smashing their window.
"And why not let user set his own password for backdoor.dll?" -- As others have said, an unused root login or a known support login is really a front door, not a back door.
"Neither did the moderators, I guess" -- Yup, it's a strange slashdot where someone pronouncing back doors to be a good thing can get moderated up.
Right -- now that they are the big dog, they are not absolutely the cheapest anymore.
But timetravel back a few years ago and compare the cost of NT versus Novell versus OS/2 versus any PC Unix. NT was usually half the price of the alternatives, and is still cheaper than Novell or OS/2.
Even today MS Office is about the same price as Corel or Lotus. (They are really out of Claris' league, so lets forget them.) However a few years back you could get the entire GUI MS Office package for the cost of the DOS version of WordPerfect *or* Lotus 1-2-3 alone.
Even today -- compare the cost of MS SQL versus Oracle. Compare the cost of Exchange versus Lotus Domino or Netscape's mail server. And so on...
Compared to Linux, those Microsoft CALs start to look very expensive. But that doesn't change the fact that they have traditionally been one of the least expensive vendors. --
I've heard a couple reasons for Microsoft's fallout with IBM:
1) Serious culture clash. IBMers didn't like the hairy barefoot Microsoft guys. IBM was doing things like giving MS programers "demerits" for doing things like not cleaning up their desk before they went home or playing Frisbee on the lawn.
2) IBM was never seriously behind OS/2 as an application server. They were afraid that it might cut into their midrange business. Instead, IBM's vision of OS/2 was pretty much limited to a client for IBM mainframe applications. This made it difficult for Microsoft to sell products like SQL Server. Considering Microsoft's success with NT as an application server, MS was right on this one -- OS/2 just missed that entire market. --
Linux users already have the Gnome and KDE object environments -- I don't think there's much room or demand for another one. Only old OS/2 users would be interested.
What IBM could do would be to release some of the SOM infrastructure. Or, perhaps just give the Gnome team a walkthrough of WPS's feature set. With a little time and effort the WPS can probably be cloned, and it can probably be done in a way that fits in with the existing infrastructures and in a sufficently Unixy way. --
A few years ago we were getting some telephone equipment installed. The technician attached a small VGA monitor to the voice mail system and booted it up. Lo and Behold "Microsoft OS/2 1.3" was coming up.
Since that product was supposedly long dead, I asked him about it. He said that although it doesn't appear on any offical price list, you can still call up someone at Microsoft and get a new copy of OS/2 1.3 on CD-ROM for about $300 a pop. It works, it's very stable. (Although, I don't know how they handled the Y2K certification...)
Whenever I hear about "Embedded NT", I always wonder if Microsoft is still selling a few more copies of OS/2 1.3 than they'd like to admit for embedded applications. When you read the stories here, it's pretty clear that OS/2 is pretty established in that market. --
Right on. Unfortunately for IBM, they delivered the perfect solution for DOS power users just at the time when DOS was being killed off.
A long time ago, I worked at a place that had a DOS-based database server (some sort of XBase, I forget). Running on a 16MB OS/2 machine, we tricked the program into thinking it had 32MB of extended memory and ran with 15 concurrant users when the thing was only supported with 3 or 4. --
I know a little about OS/2, having managed 20-odd servers running 2.11 and 3.0 some years back.
Our main problem wasn't missing drivers, it's that the drivers that were there were pretty poorly written. Driver for common network cards (Intel and 3Com) would crash under load. Installation was a bitch -- in one case you had to boot DOS, run a config program which gave you some magic number, and then add that magic number to your OS/2 CONFIG.SYS before it the hardware would work correctly. And that was easy compared to the voodoo I had to go through to get a SCSI adapter working.
The networking in OS/2 was seriously lame-brained. Configuration was a nightmare of ugly control panels full of big blue jargon and TLAs. And that is if you could get networking -- it wasn't included in the base product until Warp Client v3 shipped in about 1994. When we were running 2.1, it was a maze of twisty P/Ns, all seemingly alike. Even basic TCP/IP support was an expensive add-on. IPX support was only available through a orphened Novell cleint that used *different* network drivers than the native OS, and which in turned required a troublesome ODI/NDIS shim driver.
Furthermore, the dreaded "single input queue" problem bit my ass so many times I just have to tell you about it. Server was up, working fine, the GUI was locked hard. Nothing to do but to wait until 6PM and push the powerswitch and then pray to the CHKDSK gods.
The bundled toolset was pretty poor. As "powerful" as the WPS was, the tools were buried in a confusing 6-layer deep folder hierarchy. That is, if you could find an icon at all -- it was usually easier to launch the GUI stuff from a command prompt. The best GUI file browser bundled with the system was the Win 3.1 File Manager, which should tell you how bad the PM Drives Object was. We even had to get shareware to even do basic system monitoring like 'top' or the NT task manager/performance monitor.
I want to say that OS/2 was OK for what we were asking it to do. But, for a combination of technical and marketing reasons, it was really a big pain in the ass to manage. I'd never felt like a bigger reboot monkey. Eventually we switched the servers to WinNT 3.51, and our uptimes increased exponentially. Given the average slashdotter's opinon of WinNT, that really doesn't say much for OS/2. --
DOS 6 included most of the reference manual content in the HELP command. You probably know this, and are just kvetching.
With NT, it's always been a problem however. The real documentation and some damn essential software is only included in the Re$$ource Kit. Why they couldn't bundle very important tools like REBOOT.EXE (grin) and Event Log numbers in the base product is bewildering. --
I don't really have a problem with that, but as far as I'm concerned, Open Smopen.
Let's say I work in the IT department at a company with 50 Microsoft Exchange servers installed. Now I'm faced with 3 different versions of Exchange, and about 1000 patches from various sites. What am I going to do about the situation?
Answer: Nothing! I am going to continue to use Microsoft Exchange (or whoever the leading vendor is) and let them worry about integrating the patches and matching feature sets. Exchange is enough of a bitch as is, why do I want to make my life more complicated.
And before you assume this is some blind Windoze attitude - it isn't, Open Source works in the exact same way. There is absolutely no motivation for people to fork complex projects like Sendmail, Mozilla, Samba, or Gnome. To attempt to do so would require an insane amount of resources. So most people trust the maintainers and use the standard distribution of the software package. When the maintainer is essentially "Microsoft", it's the same difference.
Whenever I read "Microsoft should open their APIs and formats" on Slashdot, I read between the lines and think that the person is really saying "I want to run Linux at work and still read my Exchange Calendar and my boss' Word documents". But, looking at their source code is only one (long painful) way to get there.
A 'structural remedy' which broke Microsoft into 2 or 3 pieces would be an adequate solution. When BackOffice, Inc finds that they don't care about pushing Unix and Mac clients out the door, they will open their protocols on thier own. Better yet, they will move to XML, SOAP, iCal, IMAP, LDAP and other "open" protocols. (Do you really want to reverse engineer the MAPI RPC wire protocol? Ugg.) When big customers ask Office,Inc. for Linux support or a real XML file format, they might be happy to provide. The future of standards support in this industry is bright -- the one problem is Microsoft's need to prop up their client software business. --
Well, I don't think Access "won" the desktop database wars because it cost $99. They won because they were able to push "MS Office Professional" site licences on to business, which included Access. If you were to divide out the cost of Office Professional, business were getting Access for about $60, plus the installation was "free".
Sybase screwed themselves by jumping out of the PC RDBMS market during the dark days of OS/2. Microsoft carried the product as a money loser, and when NT started getting big they had a mature product.
I've never heard the accusation that Microsoft stole Novell source code (I assume this is for IPX/SPX). Anyway, back in the old days, Novell cost about $1000 per seat, making it veerrry easy for Microsoft to undercut them. Even today, a NetWare/NDS seat costs about 2x as much as a Windows 2000 seat costs. Anyway, Novell f-ed up in so many ways (No TCP/IP, no app server, etc, etc.) that it's hard to pin their current state on Microsoft.
Microsoft's marketing practices are nasty and if not blatently illegal, certainly borderline. Their employees will not hesitate to throw the nastiest FUD and lies imaginable, whispered in corporate hallways and freindly technical conferences. They lie like bastards about release dates (ActiveDirectory was first promised for 1997!) The pre-announce things like crazy, often before any design work has even been done.
But there's one thing they've always done well that isn't illegal -- their solution is almost always the cheapest, most easy to use (superficially), and has the longest feature list. They've nevered wavered in investing in *their* platform, and since IBM in the 1990s, have never let themselves be reliant on any other corporation or technology.
In short, they are #1 because they have produced OK, very cheap products. The big problem for them is that you really can't beat the price of free software, so for the first time they are resorting to TCO and other more ephemeral arguments. --
Well, I don't think Access "won" the desktop database wars because it cost $99. They won because they were able to push "MS Office Professional" site licences on to business, which included Access. If you were to divide out the cost of Office Professional, business were getting Access for about $60, plus the installation was "free".
Sybase screwed themselves by jumping out of the PC RDBMS market during the dark days of OS/2. Microsoft carried the product as a money loser, and when NT started getting big they had a mature product.
I've never heard the accusation that Microsoft stole Novell source code (I assume this is for IPX/SPX). Anyway, back in the old days, Novell cost about $1000 per seat, making it veerrry easy for Microsoft to undercut them. Even today, a NetWare/NDS seat costs about 2x as much as a Windows 2000 seat costs. Anyway, Novell f-ed up in so many ways (No TCP/IP, no app server, etc, etc.) that it's hard to pin their current state on Microsoft.
Microsoft's marketing practices are nasty and if not blatently illegal, certainly borderline. Their employees will not hesitate to throw the nastiest FUD and lies imaginable, whispered in corporate hallways and freindly technical conferences. They lie like bastards about release dates (ActiveDirectory was first promised for 1997!) The pre-announce things like crazy, often before any design work has even been done.
But there's one thing they've always done well that isn't illegal -- their solution is almost always the cheapest, most easy to use (superficially), and --
Slashdot Mirror
If I recall the story correctly, the big dish Satellite system was "cracked" by some guy with a Commodore 64, a BASIC program, and an eprom burner.
Very similar to the whole DeCSS situation where a weak system was undermined by some teenager in Norway with a Pentium II and gcc. They won't be making the same mistakes next time...
--
As others have pointed out, DVDs are already obsolete. The HDTV standard which is being implemented right now blows them away in a few short years.
I agree that a boycott will probably not do much good in getting the MPAA to change their policies. Someone should have looked at the DVD spec and the DMCA a few years back when there was only 10,000 players out there and pointed out the problems with it. That didn't happen, and now DVD is established as a must-have techie consumer item.
Still, we see people on Slashdot moaning "I can't legally watch the DVDs I paid for!!" -- and the only real answer for that is to stop buying the movies if it's a moral problem for you. People can get quite preachy about the whole thing, but the bottom line is that they are still giving their hard earned cash to the movie studios. Maybe an organized boycott would be pointless, but some people here should start personal boycotts just to avoid the hypocracy of the situation.
Right now the MPAA views the whole DVD/DMCA thing as a success. We've lost this battle. What people need to do is to get involved with the process and win the next battle. The engineering community needs to make sure that HDTV and HD-DVD formats are open. They need to propose recordable media formats that are open enough for data use, and not driven by the needs of hollywood. The political community needs to make sure the DMCA is not extended and is challenged in court when possible. We can't let the MPAA win the next battle.
I hate to sound like a pessimist, but right now the future looks pretty dark. They've already got encrypted data bouncing around *your* Personal Computer that you can't legally manipulate. The next format will a better scheme than CSS that won't be so easily broken. There are standards on the board for encrypted monitor connections, encrypted sound conections (notice how the iMac is missing a 10 cent headphone jack?), and so on.
Lots of people here promote alternatives like Linux because they want to maintain freedom in their personal computing. However, what Hollywood is trying to do is far worse than anything Microsoft has done with their closed and extended protocols. They want to turn your computer into their payola entertainment delivery device, their sealed, encrypted box. It time that the people of conscience start to realize this, and if they think it matters, at the very least stop supporting this thing with their dollars.
--
You bring up an interesting point in the midst of all that -- Very few people bought VHS movies, with the exception of some kids films to keep the youngins docile.
Yet, for some reason, DVD owners feel the need to build "a collection". I know quite a few people that have bought several $20-30 DVDs of movies they had not seen, and in the end, really didn't like that much. Maybe it's just because the media won't degrade right away, but there's some other consumer instinct at work here. I mean, I can understand owning your favorite movies on whatever media, but buying something like "End of Days" just because you missed it in the theater seems kinda like flushing twenties down the toilet for fun.
As for VHS, first you say that you use it to dub DVDs, then you basically declare it an antique. Quite an inconsistancy.
One thing is true -- with the exception of the easily bypassed Macrovision system, VHS is an open format, and because of that will continue to live on. When the MPAA puts out "Recordable DVDs", you may go out and buy it because it's the latest and greatest, but you will probably never be able to rip rental DVDs with it. Back to square one and your antique VHS deck.
(A friend bought a low-end SVHS deck specifically for the purpose of dubbing rental DVDs and LDs. It's nearly the same quality of the original. And "open".)
--
Yup, I'm aware that mainframes are relatively slow. They do, however, generally run under a much higher 'load' than a typical midrange system.
--
Back in the old days, Cadillac shipped cars with 472 and 500 cubic inch engines (about 8 liters in modern terms). These things put out nearly 400 HP and buttloads of torque. With the exception of some muscle cars and the Corvette, Cadillacs were the fastest cars GM built.
But, nowhere in their advertising did they mention the size of the engine or the amount of power or anything about "performance". Back in those days everyone just knew Cadillacs had plenty of power. I suspect it's the same with IBM and their mainframes - just too much reputation to even advertise.
--
Actually, the first time I saw a solar powered laptop, it was some guy's PowerBook 160. He also had a secondary battery that was same area as the powerbook and about a 1/2 thick. Apparently he would get enough sun to actually charge the battery somedays. (Of course the total weight of this setup was probably 15#, but he was off the grid.)
That had to be at least 10 years ago. I would have to think that a solar powered G3 PowerBook would be the best way to sit in the park and 'work' all day.
--
True, and a homerolled certificate is perfect for intranet stuff.
However for a public Internet site one probably needs to pay the piper and get a cert signed by someone that the browsers recognize. (I don't think you can add certs to the version 3 browsers either, which might be an additional problem with a public site.)
--
I hate to say it, but this should be marked up as Insightful, not Funny -- since the PSX2 sounds like the rebirth of the Home Computer (aka Video Game Console + Keyboard).
I wonder if Microsoft is still licencing Basic?
--
I intentionally neglected Sun because you currently can run Solaris on Intel for free.
--
My experiences with the sound quality of MP3 has been pretty miserable except for the high bandwidth stuff.
At least the 4th Gen cassette dub from your friend degrades into a nice sludge of hiss and noise. MP3 seems to get these digital artifacts which are (to me) much more jaring. Maybe it's just what you are used to, however.
As for your comment about $500 speaker wire, I think what you are trying to say is that "For free, I don't care what it sounds like".
I'm pretty tone deaf, but difference between CDs and MP3s are pretty clear on my stereo system ($100 Sony Discman, $20 1970 Garage Sale Onkyo amplifier, $200 Bose bookshelf speakers). On my computer, its about the same (Integrated Crystal Audio SoundBlaster clone, generic CD-ROM drive, and $20 Sony computer speakers). The question really is how much good sound is worth to you, and how much space you are trying to fill with music.
--
Here's hoping this is high enough on the page that people see it. The /. story should probably be updated.
.dll. Without proper and full permissions applied
.dll in a way that's not intended...it just doesn't .dll in the first place would have the ability
From: Windows NTBugtraq Mailing List [NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM]
on behalf of Russ [Russ.Cooper@RC.ON.CA]
Sent: Friday, April 14, 2000 12:33 PM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: Re: DVWSSR.dll Vulnerability in Microsoft IIS 4.0 Web Servers
Ok, here's a breaking update.
Latest reports say that there is
NO VULNERABILITY IN DVWSSR.DLL
Yup, that's right, different again from what I said earlier, and even more
different than what I said yesterday to WSJ.
Please accept that I have followed the story published elsewhere and tried
to keep you abreast of everything I knew. Also appreciate that the amount of
time given to verify and research the claims made by others has been
extremely short. I've had probably 30 interviews today by orgs pressing for
information on the story as the feeding frenzy occurs after the first one
goes to press (WSJ in this case).
MS have had people working on this thing like madmen, trying to verify the
claims and investigate all of the possible pieces of code that may be
affected. As that research progressed, different observations were made and
so the story came out in various stages (with varying levels of
"correctness"). Had they been given a reasonable amount of time to respond,
nobody would have been in a tizzy about anything (i.e. the press would not
have cared to run this story anywhere).
Decide for yourself whether we were better served by (more) immediate
disclosure or not. I've stood where I stand for a reason, despite the
loathing of others for my stance...
In the end, it turns out that unless you actually have permissions for the
file you are requesting, you'll get an error message when you follow the
procedures outlined by RFP in his RFP2K02 advisory.
That said, understand that sites that allow connections by Front Page may
very well provide you with source asp if you request it. BUT THAT WILL
HAPPEN with or without the
across virtual servers on a given box, site leakage or manipulation by
others will always be possible in myriad ways.
>From what I've heard/seen/been told, permissions on the test servers must
have either been non-existent, incorrectly applied, or permissioned the user
across multiple virtual sites (i.e. incorrectly applied).
I had someone claim that they could get into an FP98 site using
"Netscapeengineersareweenies!" as a userID and no password...making them
think it was a backdoor userID. Fact is they could get into the same sites
using "TomDickandHarry" as a userID too. If the permissions aren't set
correctly, anything is possible.
This info may change again before its finalized. It may well be that there
is some way to use this
appear to be this one. On a box where multiple sites have not been
individually permissions, or permissions are lax or non-existent...anyone
permissioned to execute the
to simply open the other sites and manipulate them directly (i.e. no need to
do this junk with the dvwssr.dll)
Finally, to my point out the string not being a password. Elias Levy of
SecurityFocus.com and Mark Edwards of NTSecurity.net have both correctly
pointed out that using the term password to apply to that string is not
beyond the realm of understanding. The client component mtd2lv.dll and the
server component dvwssr.dll both need to know this value, and use it
correctly, for communications to work. If you try and talk directly to
dvwssr.dll and don't obfuscate your communication with the correct "key", it
won't understand you. Of course if you don't already have permissions,
knowing this value gets you nothing...hence my observation that its not a
password. Whatever it is, it appears to be meaningless junk text used as
data.
Cheers,
Russ - NTBugtraq Editor
"dot-age" (as in "we're in the dot-age") = senility (source Webster's)
--
Back before the internet, music was a scarce commodity.
When I was in High School way back in the 1980s, quite a few people I knew had hundreds of illegally copied cassette tapes. In those days, a decent 90 min cassette ran about $1 (which meant about 45 hours of recording for the cost of a cable modem connection.)
Not as easy as MP3s, but hardly "scarce".
--
Yeah, but car doors are "Security through assuming your neighbors are honest." Nobody really believes that they prevent somebody from smashing their window.
"And why not let user set his own password for backdoor.dll?" -- As others have said, an unused root login or a known support login is really a front door, not a back door.
"Neither did the moderators, I guess" -- Yup, it's a strange slashdot where someone pronouncing back doors to be a good thing can get moderated up.
--
Now the question is why did they concoct this scheme when they could just have used FTP or SMB management of the FrontPage "web"?
...
It just seems that Microsoft has an instinct to do themselves in sometimes
--
Right -- now that they are the big dog, they are not absolutely the cheapest anymore.
But timetravel back a few years ago and compare the cost of NT versus Novell versus OS/2 versus any PC Unix. NT was usually half the price of the alternatives, and is still cheaper than Novell or OS/2.
Even today MS Office is about the same price as Corel or Lotus. (They are really out of Claris' league, so lets forget them.) However a few years back you could get the entire GUI MS Office package for the cost of the DOS version of WordPerfect *or* Lotus 1-2-3 alone.
Even today -- compare the cost of MS SQL versus Oracle. Compare the cost of Exchange versus Lotus Domino or Netscape's mail server. And so on...
Compared to Linux, those Microsoft CALs start to look very expensive. But that doesn't change the fact that they have traditionally been one of the least expensive vendors.
--
I've heard a couple reasons for Microsoft's fallout with IBM:
1) Serious culture clash. IBMers didn't like the hairy barefoot Microsoft guys. IBM was doing things like giving MS programers "demerits" for doing things like not cleaning up their desk before they went home or playing Frisbee on the lawn.
2) IBM was never seriously behind OS/2 as an application server. They were afraid that it might cut into their midrange business. Instead, IBM's vision of OS/2 was pretty much limited to a client for IBM mainframe applications. This made it difficult for Microsoft to sell products like SQL Server. Considering Microsoft's success with NT as an application server, MS was right on this one -- OS/2 just missed that entire market.
--
Linux users already have the Gnome and KDE object environments -- I don't think there's much room or demand for another one. Only old OS/2 users would be interested.
What IBM could do would be to release some of the SOM infrastructure. Or, perhaps just give the Gnome team a walkthrough of WPS's feature set. With a little time and effort the WPS can probably be cloned, and it can probably be done in a way that fits in with the existing infrastructures and in a sufficently Unixy way.
--
A few years ago we were getting some telephone equipment installed. The technician attached a small VGA monitor to the voice mail system and booted it up. Lo and Behold "Microsoft OS/2 1.3" was coming up.
Since that product was supposedly long dead, I asked him about it. He said that although it doesn't appear on any offical price list, you can still call up someone at Microsoft and get a new copy of OS/2 1.3 on CD-ROM for about $300 a pop. It works, it's very stable. (Although, I don't know how they handled the Y2K certification...)
Whenever I hear about "Embedded NT", I always wonder if Microsoft is still selling a few more copies of OS/2 1.3 than they'd like to admit for embedded applications. When you read the stories here, it's pretty clear that OS/2 is pretty established in that market.
--
Right on. Unfortunately for IBM, they delivered the perfect solution for DOS power users just at the time when DOS was being killed off.
A long time ago, I worked at a place that had a DOS-based database server (some sort of XBase, I forget). Running on a 16MB OS/2 machine, we tricked the program into thinking it had 32MB of extended memory and ran with 15 concurrant users when the thing was only supported with 3 or 4.
--
I know a little about OS/2, having managed 20-odd servers running 2.11 and 3.0 some years back.
Our main problem wasn't missing drivers, it's that the drivers that were there were pretty poorly written. Driver for common network cards (Intel and 3Com) would crash under load. Installation was a bitch -- in one case you had to boot DOS, run a config program which gave you some magic number, and then add that magic number to your OS/2 CONFIG.SYS before it the hardware would work correctly. And that was easy compared to the voodoo I had to go through to get a SCSI adapter working.
The networking in OS/2 was seriously lame-brained. Configuration was a nightmare of ugly control panels full of big blue jargon and TLAs. And that is if you could get networking -- it wasn't included in the base product until Warp Client v3 shipped in about 1994. When we were running 2.1, it was a maze of twisty P/Ns, all seemingly alike. Even basic TCP/IP support was an expensive add-on. IPX support was only available through a orphened Novell cleint that used *different* network drivers than the native OS, and which in turned required a troublesome ODI/NDIS shim driver.
Furthermore, the dreaded "single input queue" problem bit my ass so many times I just have to tell you about it. Server was up, working fine, the GUI was locked hard. Nothing to do but to wait until 6PM and push the powerswitch and then pray to the CHKDSK gods.
The bundled toolset was pretty poor. As "powerful" as the WPS was, the tools were buried in a confusing 6-layer deep folder hierarchy. That is, if you could find an icon at all -- it was usually easier to launch the GUI stuff from a command prompt. The best GUI file browser bundled with the system was the Win 3.1 File Manager, which should tell you how bad the PM Drives Object was. We even had to get shareware to even do basic system monitoring like 'top' or the NT task manager/performance monitor.
I want to say that OS/2 was OK for what we were asking it to do. But, for a combination of technical and marketing reasons, it was really a big pain in the ass to manage. I'd never felt like a bigger reboot monkey. Eventually we switched the servers to WinNT 3.51, and our uptimes increased exponentially. Given the average slashdotter's opinon of WinNT, that really doesn't say much for OS/2.
--
DOS 6 included most of the reference manual content in the HELP command. You probably know this, and are just kvetching.
With NT, it's always been a problem however. The real documentation and some damn essential software is only included in the Re$$ource Kit. Why they couldn't bundle very important tools like REBOOT.EXE (grin) and Event Log numbers in the base product is bewildering.
--
I don't really have a problem with that, but as far as I'm concerned, Open Smopen.
Let's say I work in the IT department at a company with 50 Microsoft Exchange servers installed. Now I'm faced with 3 different versions of Exchange, and about 1000 patches from various sites. What am I going to do about the situation?
Answer: Nothing! I am going to continue to use Microsoft Exchange (or whoever the leading vendor is) and let them worry about integrating the patches and matching feature sets. Exchange is enough of a bitch as is, why do I want to make my life more complicated.
And before you assume this is some blind Windoze attitude - it isn't, Open Source works in the exact same way. There is absolutely no motivation for people to fork complex projects like Sendmail, Mozilla, Samba, or Gnome. To attempt to do so would require an insane amount of resources. So most people trust the maintainers and use the standard distribution of the software package. When the maintainer is essentially "Microsoft", it's the same difference.
Whenever I read "Microsoft should open their APIs and formats" on Slashdot, I read between the lines and think that the person is really saying "I want to run Linux at work and still read my Exchange Calendar and my boss' Word documents". But, looking at their source code is only one (long painful) way to get there.
A 'structural remedy' which broke Microsoft into 2 or 3 pieces would be an adequate solution. When BackOffice, Inc finds that they don't care about pushing Unix and Mac clients out the door, they will open their protocols on thier own. Better yet, they will move to XML, SOAP, iCal, IMAP, LDAP and other "open" protocols. (Do you really want to reverse engineer the MAPI RPC wire protocol? Ugg.) When big customers ask Office,Inc. for Linux support or a real XML file format, they might be happy to provide. The future of standards support in this industry is bright -- the one problem is Microsoft's need to prop up their client software business.
--
(again)
Well, I don't think Access "won" the desktop database wars because it cost $99. They won because they were able to push "MS Office Professional" site licences on to business, which included Access. If you were to divide out the cost of Office Professional, business were getting Access for about $60, plus the installation was "free".
Sybase screwed themselves by jumping out of the PC RDBMS market during the dark days of OS/2. Microsoft carried the product as a money loser, and when NT started getting big they had a mature product.
I've never heard the accusation that Microsoft stole Novell source code (I assume this is for IPX/SPX). Anyway, back in the old days, Novell cost about $1000 per seat, making it veerrry easy for Microsoft to undercut them. Even today, a NetWare/NDS seat costs about 2x as much as a Windows 2000 seat costs. Anyway, Novell f-ed up in so many ways (No TCP/IP, no app server, etc, etc.) that it's hard to pin their current state on Microsoft.
Microsoft's marketing practices are nasty and if not blatently illegal, certainly borderline. Their employees will not hesitate to throw the nastiest FUD and lies imaginable, whispered in corporate hallways and freindly technical conferences. They lie like bastards about release dates (ActiveDirectory was first promised for 1997!) The pre-announce things like crazy, often before any design work has even been done.
But there's one thing they've always done well that isn't illegal -- their solution is almost always the cheapest, most easy to use (superficially), and has the longest feature list. They've nevered wavered in investing in *their* platform, and since IBM in the 1990s, have never let themselves be reliant on any other corporation or technology.
In short, they are #1 because they have produced OK, very cheap products. The big problem for them is that you really can't beat the price of free software, so for the first time they are resorting to TCO and other more ephemeral arguments.
--
Well, I don't think Access "won" the desktop database wars because it cost $99. They won because they were able to push "MS Office Professional" site licences on to business, which included Access. If you were to divide out the cost of Office Professional, business were getting Access for about $60, plus the installation was "free".
Sybase screwed themselves by jumping out of the PC RDBMS market during the dark days of OS/2. Microsoft carried the product as a money loser, and when NT started getting big they had a mature product.
I've never heard the accusation that Microsoft stole Novell source code (I assume this is for IPX/SPX). Anyway, back in the old days, Novell cost about $1000 per seat, making it veerrry easy for Microsoft to undercut them. Even today, a NetWare/NDS seat costs about 2x as much as a Windows 2000 seat costs. Anyway, Novell f-ed up in so many ways (No TCP/IP, no app server, etc, etc.) that it's hard to pin their current state on Microsoft.
Microsoft's marketing practices are nasty and if not blatently illegal, certainly borderline. Their employees will not hesitate to throw the nastiest FUD and lies imaginable, whispered in corporate hallways and freindly technical conferences. They lie like bastards about release dates (ActiveDirectory was first promised for 1997!) The pre-announce things like crazy, often before any design work has even been done.
But there's one thing they've always done well that isn't illegal -- their solution is almost always the cheapest, most easy to use (superficially), and
--
Win32 server virus scanners run a service that scan files as they are written to disk.
I've heard that such products exist for Linux, but I can't name one off the top of my head.
--