Problem is windows hides that extension by default.
Re:Gnutella is closed source, hence not secure
on
Gnutella VBS Worm
·
· Score: 1
The reason it is important to make VB secure is precisely caused by the fact you do not have to double-click on a file to start it. VBScript can be embedded in html email abd other html sources, and Office docs. Corel is going to put it into wordperfect. So you open a file that says "resume.doc" and get infected. Or click on a link, or preview a message in Outlook. And then you are infected.
If VBscript had a sane security model this would not be a problem. Bottom line, nothing that gets run automatically should have file access beyond a specified order.
What culpability? this is a VBS file. It just happens to be distributed on gnutella, but it would only work for Windows, and is only harmful because of Microsoft Closed Source == Closed Mind security, or lack thereof.
This post is extremely relevant and should be moderated up. Just because it is a reply to a first post does not mean the first post or thr reply are irrelevant. For once, a first post actually contained insightful content and it and the reply should have been moderated likewise.
The fact that nothing *nix is affected by this was missed by ZD (of course!) Is it gonna be missed by slashdot too because of bad moderation?
The problem is that most people think everything on the web starts with www and ends with.com. If you want them to see your site, that's where it has to be.
The problem is that large companies violate and take advantage of free software licenses all the time. they take code that is freely available and incorporate it into their proprietary, closed-source projects which they then use to flog open source projects. "Don't use BSD, it is open source and cannot be trusted. Use Windows which steals code from it!"
Possibly. It has certainly been a gripe of developers in the past. I see it as a matter of semantics.
Nevertheless, there is no reason for Microsoft Office to be unable to read a Microsoft Office file. Even if it is Microsoft Office for Mac file. that was one of their big advantages over WordPerfect at the time of Word 6.0 (for win 3.11). At the time they were actually competing with the Mac and OS/2, and in the Office arena Lotus and Corel. Sure there were dirty tricks involved, but this was one thing they actually innovated. (notice the missing quotes.)
Regardless, if Office knows it is looking at a Mac file, it should be able to ignore/process the resource fork properly, period. No excuse.
IIRC, the linux IP stack is different to make it less susceptible to DOS attacks. Differences in its stack include waiting for the ACK before completely dedicating a connection (to prevent SYN floods) and packet defragmentation logic.
You are correct that Linux's stack is different, but so is Microsoft's and Apple's I believe. Even if the stacks are different, there are some things, like DHCP for instance, that are implemented differently on different platforms because of grey areas in the design. the result is a lack of interoperability.
It did not seem to me that linux's "different IP stack" was designed in a way that would prevent interoperability, but then, Microsoft DHCP seemed to be mostly within spec, yet did not give Apple computers and IP address (isn't that nice?) because of the way it interpreted and expected certain signals. Apple ended up changing their design to allow it to work.
So can you point to a situation in which Linux breaks compatability with others? I thought interoperability was something Linux tried harder to have than anyone save BSD and co.
Sounds great. The problem is that when you tell others to "go back to gnu" you are costing gnu (well FSF) money in the terms of bandwidth and infrastructure required to provide source for your commercial product. This is why the GPL specifically prohibits doing that in a commercial product.
If Microsoft had included source on their CD's that would have been fine. Bt they didn't, hence they have to get source to the people who have already bought Interix.
True, the GPL provides for you to charge for that, and even provide it on a second CD. It's usually not done that way for PR purposes, and also because it is easier to distribute source with binaries usually.
However, most of this is moot because Microsoft specifically agrees in the license agreement that they will provide source at two specific URLS. Read the agreements.
Of course The Windows EULA says you can get a refund, and that has not been honoured, either, like most legal agreements Microsoft signs. Microsoft is a pirate in suit's clothing. Always has been, always will be, no matter how big they get.
FWIW, I find c++ easier for userland tasks than c, mainly because of the routines that were added to make C++, and the way classes work (they are easier to deal with and conceptualize than structs...
Accourse I could be wrong. Nevertheless, to each his own, like the guy who finds transmission rebuilding easoer than programming his VCR, or a certain famous scientist that found quantunm physics easier than remembering to comb his hair and remember to take his lunch to work.
The only problem with JAVA is that the poseter is right about the write once, rewrite anywhere. Java under LInux != Java under MacOS != Java under Windows != java under Solaris. In fact on the Mac, Java can take three forms, Apple JVM, Microsoft explorer JVM, or Netscape JVM, and they are not the same.
To say nothing of JVM versions within a given platform...
Sun tried to make a great technology, where you could have true cross-platform compatability, and where it was easy to learn to code for it because of its similarity to other languages (most like C++ IMHO). It is not working for the same reason networking and the www are not working, Vendor-introduced incompatabilities.
The only reason these technologies are thought viable at all is mainly the dominance of certain technologies (eg 90% of pc's are Wintel, so if you write for MSJVM, you have 90% of the audience.)
Well, in the US, government officials are above the law. Not only de facto (because of being so powerful), but they have passed laws exempting them from some criminal prosecution and most civil litigation.
Someone else pointed out that the GPL specifically prohibits linking to someone else and saying you are providing source. The reason is that you are not providing source, they are. the only way microsoft can fix this now is to provide source at their urls. They could have avoided it by putting the source on the cd.
First off, barring a couple exceptions, Microsoft never built anything from scratch. They mostly bought it, including DOS. Not to say all those thousands of programmers are doing nothing. they just put polish on the code MS buys.
NT was pretty much an MS product, but it was actually made by a team of VMS engineers microsoft lured away with cash and autonomy. As such it is the best thing MS ever made besides Office.
As for why people use their software, in my case i use it because my boss says I have to, and I have to have compatability with other people who use it because they don't know better. If I could, I would only use Linux. I think that pretty much sums it up for a lot of people.
People don't necessarily hate microsoft because their products suck. Win2000 and office, for instance have lots of good points. They hate them because they get the product crammed down their throats, where again i point to win2000 and office.
At one place I worked, which must remain anonymous, win2000 and office 2000 were banned because of their "viral" qualities. they tend to take over. For instance simply opening a database with Access2000 renders it incompatable with everything else because access does not have to save. Ditto for the other office apps if you do save. Win2000 clients and servers tend to take over a network if you don't control them properly.
What, the ones that prominently display "Microsoft Telnet copyright Microsoft corp." when run? The point is that if you have to search the file for a string that is not prominently displaying the actual source (as in origin) of the program.
The funny thing is that Microsoft continues to say that free software cannot be trusted, whereas they have had to use it for anything mission-critical, like the TCP stack in general. Also the wonders of Hotmail not working with Exchange, only with qmail, and of course freebsd.
That BSD software gets around, too. It forms the heart of the Sun Solaris networking stack, and I would imagine is used by Netware and MacOS. It is of course used by Mac OS X Server and its open source cousin, Darwin.
Another interesting point... if you try to use Microsoft for your main DNS servers, your isp will laugh at you. Everyone knows some form of *nix or *bsd is required for anything so critical. Besides, they are free.;).
But microsoft's modifications are not provided there. Also Bruce pointed out that according to GPL they are required to distribute source themselves, if anything at least with the binaries (they don't even need an ftp site, they just have to put it on the CD).
Another problem is that microsoft's own agreements agree to place the source at certain urls, at which teh source cannot be found. Breach of contract, mate.
And of course their analogy is flawed for at least two reasons. One is that CSS does not stop you from copying the DVD (stealing what's in the house). Second, as has been pinted out before, with CSS the MPAA is actually putting a lock on your house, not theirs, since they are trying to keep you from watching the movie you paid for.
Absolutely. I mean the mac has been able to see and format dos floppies forever. But windows still acts like they are not formatted, even when there is a wonderful microsoft office file there.
Funny thing there, too. If you format a floppy dos and save office files as Word 6.0/95 format (the first word for windows) you can transfer them easily from one platform to the other. However I have had horrible luck getting Office to translate properly from Mac format on the PC.. usually results in garbage.
Slashdot Mirror
I think here they are aiming for the less intelligent/unwary among users, like usual. It also appears to be working.
Problem is windows hides that extension by default.
The reason it is important to make VB secure is precisely caused by the fact you do not have to double-click on a file to start it. VBScript can be embedded in html email abd other html sources, and Office docs. Corel is going to put it into wordperfect. So you open a file that says "resume.doc" and get infected. Or click on a link, or preview a message in Outlook. And then you are infected.
If VBscript had a sane security model this would not be a problem. Bottom line, nothing that gets run automatically should have file access beyond a specified order.
What culpability? this is a VBS file. It just happens to be distributed on gnutella, but it would only work for Windows, and is only harmful because of Microsoft Closed Source == Closed Mind security, or lack thereof.
Linux is not even involved here.
This post is extremely relevant and should be moderated up. Just because it is a reply to a first post does not mean the first post or thr reply are irrelevant. For once, a first post actually contained insightful content and it and the reply should have been moderated likewise.
The fact that nothing *nix is affected by this was missed by ZD (of course!) Is it gonna be missed by slashdot too because of bad moderation?
Once again we see why scripting languages need to be secured, indeed all web technologies. But why was Gnutella scriptable with VBS?
The problem is that most people think everything on the web starts with www and ends with .com. If you want them to see your site, that's where it has to be.
Especially since the MPAA has said in every press release that there were tons of legal Linux DVD players...
every time they said that I was like "Where?"
The problem is that large companies violate and take advantage of free software licenses all the time. they take code that is freely available and incorporate it into their proprietary, closed-source projects which they then use to flog open source projects. "Don't use BSD, it is open source and cannot be trusted. Use Windows which steals code from it!"
Possibly. It has certainly been a gripe of developers in the past. I see it as a matter of semantics.
Nevertheless, there is no reason for Microsoft Office to be unable to read a Microsoft Office file. Even if it is Microsoft Office for Mac file. that was one of their big advantages over WordPerfect at the time of Word 6.0 (for win 3.11). At the time they were actually competing with the Mac and OS/2, and in the Office arena Lotus and Corel. Sure there were dirty tricks involved, but this was one thing they actually innovated. (notice the missing quotes.)
Regardless, if Office knows it is looking at a Mac file, it should be able to ignore/process the resource fork properly, period. No excuse.
IIRC, the linux IP stack is different to make it less susceptible to DOS attacks. Differences in its stack include waiting for the ACK before completely dedicating a connection (to prevent SYN floods) and packet defragmentation logic.
You are correct that Linux's stack is different, but so is Microsoft's and Apple's I believe. Even if the stacks are different, there are some things, like DHCP for instance, that are implemented differently on different platforms because of grey areas in the design. the result is a lack of interoperability.
It did not seem to me that linux's "different IP stack" was designed in a way that would prevent interoperability, but then, Microsoft DHCP seemed to be mostly within spec, yet did not give Apple computers and IP address (isn't that nice?) because of the way it interpreted and expected certain signals. Apple ended up changing their design to allow it to work.
So can you point to a situation in which Linux breaks compatability with others? I thought interoperability was something Linux tried harder to have than anyone save BSD and co.
Sounds great. The problem is that when you tell others to "go back to gnu" you are costing gnu (well FSF) money in the terms of bandwidth and infrastructure required to provide source for your commercial product. This is why the GPL specifically prohibits doing that in a commercial product.
If Microsoft had included source on their CD's that would have been fine. Bt they didn't, hence they have to get source to the people who have already bought Interix.
True, the GPL provides for you to charge for that, and even provide it on a second CD. It's usually not done that way for PR purposes, and also because it is easier to distribute source with binaries usually.
However, most of this is moot because Microsoft specifically agrees in the license agreement that they will provide source at two specific URLS. Read the agreements.
Of course The Windows EULA says you can get a refund, and that has not been honoured, either, like most legal agreements Microsoft signs. Microsoft is a pirate in suit's clothing. Always has been, always will be, no matter how big they get.
You could always use AppleScript... };)>
erm.. yeah he did...
FWIW, I find c++ easier for userland tasks than c, mainly because of the routines that were added to make C++, and the way classes work (they are easier to deal with and conceptualize than structs...
Accourse I could be wrong. Nevertheless, to each his own, like the guy who finds transmission rebuilding easoer than programming his VCR, or a certain famous scientist that found quantunm physics easier than remembering to comb his hair and remember to take his lunch to work.
The only problem with JAVA is that the poseter is right about the write once, rewrite anywhere. Java under LInux != Java under MacOS != Java under Windows != java under Solaris. In fact on the Mac, Java can take three forms, Apple JVM, Microsoft explorer JVM, or Netscape JVM, and they are not the same.
To say nothing of JVM versions within a given platform...
Sun tried to make a great technology, where you could have true cross-platform compatability, and where it was easy to learn to code for it because of its similarity to other languages (most like C++ IMHO). It is not working for the same reason networking and the www are not working, Vendor-introduced incompatabilities.
The only reason these technologies are thought viable at all is mainly the dominance of certain technologies (eg 90% of pc's are Wintel, so if you write for MSJVM, you have 90% of the audience.)
Well, in the US, government officials are above the law. Not only de facto (because of being so powerful), but they have passed laws exempting them from some criminal prosecution and most civil litigation.
IIRC there is already a dvd player that lets macrovision be turned off and the region code changed. Apex I think...
Some software(windows) players are supposed to also allow similar manipulations.
yes, and they violate the license by not letting me view the content.
Someone else pointed out that the GPL specifically prohibits linking to someone else and saying you are providing source. The reason is that you are not providing source, they are. the only way microsoft can fix this now is to provide source at their urls. They could have avoided it by putting the source on the cd.
First off, barring a couple exceptions, Microsoft never built anything from scratch. They mostly bought it, including DOS. Not to say all those thousands of programmers are doing nothing. they just put polish on the code MS buys.
NT was pretty much an MS product, but it was actually made by a team of VMS engineers microsoft lured away with cash and autonomy. As such it is the best thing MS ever made besides Office.
As for why people use their software, in my case i use it because my boss says I have to, and I have to have compatability with other people who use it because they don't know better. If I could, I would only use Linux. I think that pretty much sums it up for a lot of people.
People don't necessarily hate microsoft because their products suck. Win2000 and office, for instance have lots of good points. They hate them because they get the product crammed down their throats, where again i point to win2000 and office.
At one place I worked, which must remain anonymous, win2000 and office 2000 were banned because of their "viral" qualities. they tend to take over. For instance simply opening a database with Access2000 renders it incompatable with everything else because access does not have to save. Ditto for the other office apps if you do save. Win2000 clients and servers tend to take over a network if you don't control them properly.
What, the ones that prominently display "Microsoft Telnet copyright Microsoft corp." when run? The point is that if you have to search the file for a string that is not prominently displaying the actual source (as in origin) of the program.
The funny thing is that Microsoft continues to say that free software cannot be trusted, whereas they have had to use it for anything mission-critical, like the TCP stack in general. Also the wonders of Hotmail not working with Exchange, only with qmail, and of course freebsd.
That BSD software gets around, too. It forms the heart of the Sun Solaris networking stack, and I would imagine is used by Netware and MacOS. It is of course used by Mac OS X Server and its open source cousin, Darwin.
Another interesting point... if you try to use Microsoft for your main DNS servers, your isp will laugh at you. Everyone knows some form of *nix or *bsd is required for anything so critical. Besides, they are free. ;).
But microsoft's modifications are not provided there. Also Bruce pointed out that according to GPL they are required to distribute source themselves, if anything at least with the binaries (they don't even need an ftp site, they just have to put it on the CD).
Another problem is that microsoft's own agreements agree to place the source at certain urls, at which teh source cannot be found. Breach of contract, mate.
And of course their analogy is flawed for at least two reasons. One is that CSS does not stop you from copying the DVD (stealing what's in the house). Second, as has been pinted out before, with CSS the MPAA is actually putting a lock on your house, not theirs, since they are trying to keep you from watching the movie you paid for.
Absolutely. I mean the mac has been able to see and format dos floppies forever. But windows still acts like they are not formatted, even when there is a wonderful microsoft office file there.
Funny thing there, too. If you format a floppy dos and save office files as Word 6.0/95 format (the first word for windows) you can transfer them easily from one platform to the other. However I have had horrible luck getting Office to translate properly from Mac format on the PC.. usually results in garbage.