This is a bad thing happening in the U.S. culture. People are too serious. I didn't assume Tannaz is a male. It was just a sloppy joke. Anyhow, I don't speak Farsi.
The big issue is that the U.S. senators and representatives have not bought themselves some good programming for communication. Why are things still such a mess?
My middle eastern friends and I joke about the U.S. government's love of bombing:
FOR IMMEDIATE RELEASE
By joking about the U.S. invading the island of Kiribati, the New Zealand publication Spinner has delayed a plan by the U.S.
government to invade every other country. The U.S. military forces plan to
start with the small countries first, then work their way up to the larger
ones.
The U.S. government has invaded 14 countries in the last 33 years, and has
found it so profitable that it decided to invade all the others.
U.S. Army General Mayhem said yesterday that the military would delay the
invasions while they investigate the possibility that Spinner's story was
prompted by a security leak.
General Mayhem said that the U.S. would not actually invade every other
country. There are no plans to invade France. "We wouldn't want to seem
arrogant", he said.
You missed the point of that section of the article. The point is clearly stated at the beginning. MS is moving people to subscription licensing and to greater and greater dependence on Microsoft.
How does a true statement and a joke get modded "Flamebait"?
The problem is a coding error. The page does not work in IE, either. The Slashdot story is wrong.
When a moderator cannot comment on a story and also moderate it, that assures that much moderation is done by bored moderators, who are only looking at a story because they want to get rid of their moderation points.
It isn't that they prefer Microsoft products, they are technically challenged.
"tannaz.haddadi@mail.house.gov"
Who is Tannaz Haddadi? Does he work for al Quaeda or Saddam Hussein, intercepting all the mail?
You send mail saying Saddam is a bad guy, and the message received says good guy?
You would think that mail to Stephanie Tubbs would go to stephanie.tubbs@mail.house.gov, even if that is not the address used for her normal messages.
CP/M was the OS we used before IBM began to make PCs. It was used by many vendors, and was the only OS used by most businesses. For some reason the Apple 1 and Apple II were never very big on the corporate desktop.
I'm not saying that I gave ALL the examples of ridiculous refusal to interoperate.
Those who criticize Microsoft face a lack of sympathy from people who are not
well informed, which is most people. Typically, Microsoft users attack each
other, rather than examine the issues. My research shows that this is a
phenomenon that is common. Human societies do not deal well with an abuser
that tries many, many small abuses, and gives up any one abuse if the
opposition is too strong.
Some history: Microsoft has made huge positive contribution to the
world by creating an operating system that the world could adopt as a standard
for small computers. Earlier there were more than 200 versions of Unix, each
with small incompatibilities with the others. Versions of earlier Unix
operating systems also were too powerful to run on affordable small computers.
The Unix system would boot for the first time and expect that it would be
attached to a network of typically hundreds or thousands of other computers.
The manuals assumed that the reader was a professional Unix administrator.
The alternative to Microsoft operating systems was the OS known as CP/M. Those
who designed CP/M-based personal computers used more than 68 diskette formats,
making it impossible to interchange data between different systems by
diskette, without using a conversion program. Digital Research, the company
that made CP/M, sometimes provided manuals in which the original was printed
using a dot-matrix printer with an old ribbon. To say that DR was
insufficiently attentive to business is an understatement. It was crazy, and Microsoft delivered us from that craziness.
At the same time that Microsoft was making a huge positive contribution, it
was making a negative one, also. The company has a history of the kind of
abuse psychologists call "testing the limits".
I'm trying to improve the article. The reason I need the article is that I don't feel I can go to a customer and say bad things about Microsoft without casting doubt in a non-technical person's mind about my own competence. The article documents problems in a way that, hopefully, can be convincing.
For example, when a non-technical person goes to a U.S. government web site and discovers that the Federal Trade Commission told Microsoft to stop lying about their Passport service, they can become convinced that there may be a problem with abuse by Microsoft. Most people don't know Microsoft is abusive; they are far behind us.
It is a fact that non-technical customers experience crashes in Windows 98 SE that are caused by using more resources than the OS supports. To them, the reason for the crashes is hidden. There is no error message unless the computer is running the resource checker. (I can't remember the name, it's 1:20 AM.)
This is an amazing phenomenon. Someone takes a quick look at a 12,000 word article, finds one thing wrong, and says the whole article is terrible.
The article does seem to need some improvement, but it is mostly correct. I removed the section you complain about above, so that it can be re-written.
The point of the section about local security is to tell executives that they are getting less security than they think.
The free SysInternals.com SID changer works great.
It is interesting what you say. I realize I need to know more about this.
Questions: Is it true, then, that to have security we are trusting
every Windows program that runs with system-level authority to check for
invalid addresses? Since people are migrating from Windows 98, isn't it likely
that many programs are not written with this requirement in mind? Is there any
list of insecure programs? Everyone seems to agree that it is possible to
elevate privileges if McAffee's old virus program is running. What other
programs are commonly used that allow users to elevate from guest to
administrator?
When someone writes an SUID program in Unix, or uses one, they are
particularly aware that there is a problem with privilege. Is it possible that
there is no real comparison with Windows programs?
Sysinternal's free utilities PMon v1.0 and Process Explorer
v5.25 show a lot of system activity. I know that Windows XP opens a huge
number of system-level windows. Is it possible that Microsoft has not checked
all of these, so that there are some Windows XP system processes that do not
check the process ID or address space? Chis Paget says in his letter to me
that is quoted in my article that Microsoft violates its own guidelines. Are
you saying this is not true?
There are two issues, it seems to me. What is the usual security that average
installations of Windows 2000 or Windows XP owners get, considering that few
people understand the vulnernabilities? Second, what is the best possible
security that can be achieved by someone who does understand?
Every Windows 2000 or Windows XP program is connected to every other through a
single main registry file called SOFTWARE. (The name is in all caps and has no
file name extension.) On one machine, for example, this file is 25.69
megabytes; it is a huge file considering that it contains configuration
information. It is possible that the vulnerability mentioned by Chris Paget
could be combined with a registry access vulnerability? Do all programs that
run with administrator-level check their registry entries?
My article, Windows XP
Shows the Direction Microsoft is Going, is particularly useful to an
executive who has authority over tens or hundreds or thousands of systems. The
article warns about technical issues a CEO might not otherwise understand. It
is interesting to know about the problems that are likely given normal
knowledge of system administrators, rather than just those that cannot be
defended against and affect everyone.
I included the privilege escalation issue because Brian Livingston took it
seriously, not because I checked it myself. All or almost all other problems in the article are ones I checked myself.
Chris says that there is no window security. Everyone seems to agree about this. The problem a writer has when writing about Microsoft is that there is so much material it is not possible to check out everything. The lack of local security is the only problem listed in the article that I have not personally verified. Brian Livingston, the famous columnist is linked in the article saying what I've said here, so it is news reporting until I can give it a try myself.
"Play it a bit less dramatic, and you'll find you come off as more credible and thereby get more market penetration.:)"
I am eager to do as you say. Any guidance you have for me is welcome. However, as of 10 minutes ago 17,289 people (mostly Slashdot readers and their friends) have visited the article. Many people have responded to the request for corrections at the beginning of the article. I've made corrections whenever they were suggested and technically correct. (I haven't yet answered the last 5 messages though; I've been busy with other things.) It is a fact that any installation of Windows 98 SE can be crashed by loading too many programs in memory. Windows 98 SE is reliably unreliable. I stand by my statement of that problem.
There is an interesting social phenomenon here. No matter what someone says about Microsoft, there is someone that doesn't know about that particular abuse or problem who says that the writer is being too hard on Microsoft. So, abused users fight amongst themselves rather than recognizing the huge number of problems and abuse.
I ran a voicemail machine using a 386SX-16 and Windows 3.11 for 7 years with no downtime due to OS failure.
I agree that MS Office is extremely buggy and quirky. I rarely use it, but when I do, I often have problems. Recently I told a friend about one problem, and his response was to tell me several much more scary stories of problems he had had.
Remember, although the article is 12,000 words long, it touches on only a very, very few Microsoft abuses.
This seems to be a case of over-reaction. The section, Windows XP provides no local security of the article says, "Windows XP has two fundamental security limitations. One is true of all operating systems. The other is true only of all Microsoft Windows operating systems, and is not a problem with BSD or Linux, for example."
Earlier versions of the article were worded in such a way that they might be mis-interpreted. Is it possible that you did not re-load the article, and you are reading a version in your browser cache? There is a warning about this at the beginning of the article.
The current version was last updated October 28, 2002.
There is controversy about the problem listed. Windows XP, and all versions of Windows, have the vulnerability listed. The Windows OS opens many, many hidden system-level windows. Theoretically, it is possible to exploit any of these to gain full system access. However, Chris Paget has not produced a demonstration of this.
The point of the section is clearly stated, "A lot of managers are being allowed to believe that Windows XP is secure under conditions in which it isn't secure. Since it is necessary to supply a password, the impression is created that there is no other way of gaining access."
The article is one of the best resumes I've ever seen.
Prospective employer: What have you done?
Daniel: I wrote the stateful firewall in OpenBSD. Here's a kerneltrap.org article.
Employer: (Silence while recovering from amazement.) What pay do you expect?
I hit a key accidentally, and Mozilla posted my comment above.
could easily be recognized with a Perl script. There should be an error message, and the system should prevent posting a comment with this kind of link.
Slashdot Mirror
This is a bad thing happening in the U.S. culture. People are too serious. I didn't assume Tannaz is a male. It was just a sloppy joke. Anyhow, I don't speak Farsi.
The big issue is that the U.S. senators and representatives have not bought themselves some good programming for communication. Why are things still such a mess?
My middle eastern friends and I joke about the U.S. government's love of bombing:
FOR IMMEDIATE RELEASE
By joking about the U.S. invading the island of Kiribati, the New Zealand publication Spinner has delayed a plan by the U.S. government to invade every other country. The U.S. military forces plan to start with the small countries first, then work their way up to the larger ones.
The U.S. government has invaded 14 countries in the last 33 years, and has found it so profitable that it decided to invade all the others.
U.S. Army General Mayhem said yesterday that the military would delay the invasions while they investigate the possibility that Spinner's story was prompted by a security leak.
General Mayhem said that the U.S. would not actually invade every other country. There are no plans to invade France. "We wouldn't want to seem arrogant", he said.
Don't be so serious. People joke about the Irish, for example. If we treat middle eastern people differently, we are dicriminating against them.
Unlike most people, I have Saudi and UAE and Iranian friends. They are not fragile.
You missed the point of that section of the article. The point is clearly stated at the beginning. MS is moving people to subscription licensing and to greater and greater dependence on Microsoft.
How does a true statement and a joke get modded "Flamebait"?
The problem is a coding error. The page does not work in IE, either. The Slashdot story is wrong.
When a moderator cannot comment on a story and also moderate it, that assures that much moderation is done by bored moderators, who are only looking at a story because they want to get rid of their moderation points.
It isn't that they prefer Microsoft products, they are technically challenged.
"tannaz.haddadi@mail.house.gov"
Who is Tannaz Haddadi? Does he work for al Quaeda or Saddam Hussein, intercepting all the mail? You send mail saying Saddam is a bad guy, and the message received says good guy?
You would think that mail to Stephanie Tubbs would go to stephanie.tubbs@mail.house.gov, even if that is not the address used for her normal messages.
CP/M was the OS we used before IBM began to make PCs. It was used by many vendors, and was the only OS used by most businesses. For some reason the Apple 1 and Apple II were never very big on the corporate desktop.
I'm not saying that I gave ALL the examples of ridiculous refusal to interoperate.
My experience: On Windows XP, Mozilla 1.1 is the best browser.
Here's a link. On November 6, 2002, there were 31 security vulnerabilities in Microsoft Internet Explorer
The link is taken from: Windows XP Shows the Direction Microsoft is Going.. If Spanish is your native language: Windows XP muestra la dirección que Microsoft está tomando.
It seems reasonable to post links to an article that shows that Microsoft customers could possibly have serious need to criticize the company, even in cases where the software works: Windows XP Shows the Direction Microsoft is Going.. If Spanish is your native language: Windows XP muestra la dirección que Microsoft está tomando.
Those who criticize Microsoft face a lack of sympathy from people who are not well informed, which is most people. Typically, Microsoft users attack each other, rather than examine the issues. My research shows that this is a phenomenon that is common. Human societies do not deal well with an abuser that tries many, many small abuses, and gives up any one abuse if the opposition is too strong.
Some history: Microsoft has made huge positive contribution to the world by creating an operating system that the world could adopt as a standard for small computers. Earlier there were more than 200 versions of Unix, each with small incompatibilities with the others. Versions of earlier Unix operating systems also were too powerful to run on affordable small computers. The Unix system would boot for the first time and expect that it would be attached to a network of typically hundreds or thousands of other computers. The manuals assumed that the reader was a professional Unix administrator.
The alternative to Microsoft operating systems was the OS known as CP/M. Those who designed CP/M-based personal computers used more than 68 diskette formats, making it impossible to interchange data between different systems by diskette, without using a conversion program. Digital Research, the company that made CP/M, sometimes provided manuals in which the original was printed using a dot-matrix printer with an old ribbon. To say that DR was insufficiently attentive to business is an understatement. It was crazy, and Microsoft delivered us from that craziness.
At the same time that Microsoft was making a huge positive contribution, it was making a negative one, also. The company has a history of the kind of abuse psychologists call "testing the limits".
There is a tendency to read the technical issues and not read the accompanying text.
Are you saying the government is wrong when it says it told Microsoft not to lie about the Passport service?
You make a sweeping claim that I am guessing you don't actually believe.
It's funny, moderators. Consider laughing.
Thanks for your comments.
I'm trying to improve the article. The reason I need the article is that I don't feel I can go to a customer and say bad things about Microsoft without casting doubt in a non-technical person's mind about my own competence. The article documents problems in a way that, hopefully, can be convincing.
For example, when a non-technical person goes to a U.S. government web site and discovers that the Federal Trade Commission told Microsoft to stop lying about their Passport service, they can become convinced that there may be a problem with abuse by Microsoft. Most people don't know Microsoft is abusive; they are far behind us.
It is a fact that non-technical customers experience crashes in Windows 98 SE that are caused by using more resources than the OS supports. To them, the reason for the crashes is hidden. There is no error message unless the computer is running the resource checker. (I can't remember the name, it's 1:20 AM.)
You seem not to have read the article carefully.
This is an amazing phenomenon. Someone takes a quick look at a 12,000 word article, finds one thing wrong, and says the whole article is terrible.
The article does seem to need some improvement, but it is mostly correct. I removed the section you complain about above, so that it can be re-written.
The point of the section about local security is to tell executives that they are getting less security than they think.
The free SysInternals.com SID changer works great.
Some facts about Microsoft's OS may be helpful here in making a comparison:
English: Windows XP Shows the Direction Microsoft is Going..
Spanish: Windows XP muestra la dirección que Microsoft está tomando.
I could not find "Fobbit Fone". Could you provide a link?
It's 4:40 AM, and I have not thoroughly read this post. I will read it this evening.
It is interesting what you say. I realize I need to know more about this.
Questions: Is it true, then, that to have security we are trusting every Windows program that runs with system-level authority to check for invalid addresses? Since people are migrating from Windows 98, isn't it likely that many programs are not written with this requirement in mind? Is there any list of insecure programs? Everyone seems to agree that it is possible to elevate privileges if McAffee's old virus program is running. What other programs are commonly used that allow users to elevate from guest to administrator?
When someone writes an SUID program in Unix, or uses one, they are particularly aware that there is a problem with privilege. Is it possible that there is no real comparison with Windows programs?
Sysinternal's free utilities PMon v1.0 and Process Explorer v5.25 show a lot of system activity. I know that Windows XP opens a huge number of system-level windows. Is it possible that Microsoft has not checked all of these, so that there are some Windows XP system processes that do not check the process ID or address space? Chis Paget says in his letter to me that is quoted in my article that Microsoft violates its own guidelines. Are you saying this is not true?
There are two issues, it seems to me. What is the usual security that average installations of Windows 2000 or Windows XP owners get, considering that few people understand the vulnernabilities? Second, what is the best possible security that can be achieved by someone who does understand?
Every Windows 2000 or Windows XP program is connected to every other through a single main registry file called SOFTWARE. (The name is in all caps and has no file name extension.) On one machine, for example, this file is 25.69 megabytes; it is a huge file considering that it contains configuration information. It is possible that the vulnerability mentioned by Chris Paget could be combined with a registry access vulnerability? Do all programs that run with administrator-level check their registry entries?
My article, Windows XP Shows the Direction Microsoft is Going, is particularly useful to an executive who has authority over tens or hundreds or thousands of systems. The article warns about technical issues a CEO might not otherwise understand. It is interesting to know about the problems that are likely given normal knowledge of system administrators, rather than just those that cannot be defended against and affect everyone.
I included the privilege escalation issue because Brian Livingston took it seriously, not because I checked it myself. All or almost all other problems in the article are ones I checked myself.
Chris says that there is no window security. Everyone seems to agree about this. The problem a writer has when writing about Microsoft is that there is so much material it is not possible to check out everything. The lack of local security is the only problem listed in the article that I have not personally verified. Brian Livingston, the famous columnist is linked in the article saying what I've said here, so it is news reporting until I can give it a try myself.
"Play it a bit less dramatic, and you'll find you come off as more credible and thereby get more market penetration.
I am eager to do as you say. Any guidance you have for me is welcome. However, as of 10 minutes ago 17,289 people (mostly Slashdot readers and their friends) have visited the article. Many people have responded to the request for corrections at the beginning of the article. I've made corrections whenever they were suggested and technically correct. (I haven't yet answered the last 5 messages though; I've been busy with other things.) It is a fact that any installation of Windows 98 SE can be crashed by loading too many programs in memory. Windows 98 SE is reliably unreliable. I stand by my statement of that problem.
There is an interesting social phenomenon here. No matter what someone says about Microsoft, there is someone that doesn't know about that particular abuse or problem who says that the writer is being too hard on Microsoft. So, abused users fight amongst themselves rather than recognizing the huge number of problems and abuse.
I ran a voicemail machine using a 386SX-16 and Windows 3.11 for 7 years with no downtime due to OS failure.
I agree that MS Office is extremely buggy and quirky. I rarely use it, but when I do, I often have problems. Recently I told a friend about one problem, and his response was to tell me several much more scary stories of problems he had had.
Remember, although the article is 12,000 words long, it touches on only a very, very few Microsoft abuses.
This seems to be a case of over-reaction. The section, Windows XP provides no local security of the article says, "Windows XP has two fundamental security limitations. One is true of all operating systems. The other is true only of all Microsoft Windows operating systems, and is not a problem with BSD or Linux, for example."
Earlier versions of the article were worded in such a way that they might be mis-interpreted. Is it possible that you did not re-load the article, and you are reading a version in your browser cache? There is a warning about this at the beginning of the article.
The current version was last updated October 28, 2002.
There is controversy about the problem listed. Windows XP, and all versions of Windows, have the vulnerability listed. The Windows OS opens many, many hidden system-level windows. Theoretically, it is possible to exploit any of these to gain full system access. However, Chris Paget has not produced a demonstration of this.
The point of the section is clearly stated, "A lot of managers are being allowed to believe that Windows XP is secure under conditions in which it isn't secure. Since it is necessary to supply a password, the impression is created that there is no other way of gaining access."
More about Microsoft abuses: Windows XP Shows the Direction Microsoft is Going..
The article is one of the best resumes I've ever seen.
Prospective employer: What have you done?
Daniel: I wrote the stateful firewall in OpenBSD. Here's a kerneltrap.org article.
Employer: (Silence while recovering from amazement.) What pay do you expect?
I hit a key accidentally, and Mozilla posted my comment above.
The article is one of the best resumes I've ever seen.
Moderators should try to understand before they mod down.
Someone was posting dishonest comments in this story that seemed like they were from CNN, but were redirects.
This:
http://www-cgi.cnn.com/cgi-bin/redir?URL=http://q
could easily be recognized with a Perl script. There should be an error message, and the system should prevent posting a comment with this kind of link.
Slashcode programmers: Please make it impossible to put a re-direct in a comment.