Office Assistant: Yet Another Security Hole 181
A lot of people have been submitting the news from ZD-Net concerning the security hole found in the Microsoft Office Assistant, Satan the Paper-Clip. Er...rather, "Clippy". Dildog, of @Stake, found the hole, which is quite similar to the recent Outlook security that allows for automatic scripting.
Yes!!!!!! (Score:1)
Sheldon
Who uses them? You have a mom? (Score:1)
Who has to bail her out with an hour of support over the phone when something f*cks up? You and me, baby. Multiply that by how many middle aged mom secretary-types there are in all the offices across this nation...
The Divine Creatrix in a Mortal Shell that stays Crunchy in Milk
Re:From Microsoft (Score:1)
Is this a vulnerability in the Active
technology? No. This vulnerability results
because of a manual error in marking the
particular control at issue.
Manual error? But why then does the "Show Me" function need to be disabled to negate this threat? Or was this entire funcionality the result of a "manual marking error"? Or might it be that ActiveX does not offer fine-grained control over who is allowed to do what to which data? In other words, a "design problem" with ActiveX?
Goobers (Score:1)
Re:Even Better (Score:1)
Re:Darth Paperclip! (Score:1)
tangent - art and creation are a higher purpose
Re:Real physical papr clips are a security threat (Score:1)
Actually, the iMac has a similarly shaped button used for hard resets. When the damn thing locks up again to the point where the soft-power buttons don't work anymore, it's either that or pull the power cable...
Did I mention I hate soft-power buttons? There you go.
It's talking to you (Score:1)
Don't blame us, we're just the postoffice... (Score:1)
I think this is basically a wrong metaphor. A more apt one would be to compare Microsoft to the builder of your house. Not only did he build it on a foundation of quicksand, but he also connected your mailbox directly to your safe. Anybody can get your valuables out, and also anybody can slip anything in.
You open the door of your safe: Suprise!!!
Empty, save for a silly paperclip holding a note: ILOVEYOU
Lyon
A dancing...what? (Score:1)
At first read, I thought Dildog was one of the office assistants!
Re:Even worse than a security hole (Score:1)
Because of this? [yahoo.com]
Keep in mind that until January this year, MSFT was always going in the same direction. Notice also the little arrows that indicate stock splits.
Up until a few months ago, MSFT stock options would look pretty sweet.
What about Vigor? (Score:1)
oink!
Re:Mr Hankey Assistant (Score:1)
;)
So what else is new? (Score:2)
Then there was the copy protect diskwiping trojan horse someone at MS put into ? Excel ? eons ago. Me thinks they drink a bit too much caffeine in Redmond.
Power (Score:1)
#define powerful unemcumbered_by_security_restrictions
p.s. -- Guys, the lameness filter is lame. The above string was too long before. I fixed it, then it told me I had to wait 70 seconds before posting.
Closed Operating Systems (Score:2)
Closed Operating Systems have many of these, hope the public never finds them, security holes.
What I really wonder about is, is using a closed OS like Windows considered reasonable security under the law. If I were to leave the doors unopened to my car the law would car little for my stole property, unless I went to a reasonable effort to secure my car. People who "lock" away data without all the information, or worse yet, without even asking for all the information, are they somewhat to blame. In the USA, it's a buyer be ware market. The buyer has, in this case, purchased a product wich they were less than informed about.
I don't see as Microsoft has to do anything about this. The only reason to issue any patch is to save the customer base. But are they in any way required to release a patch?
Well in any case, you get what you ask for more often then what you pay for it seems. If Microsoft was well aware of these latest security holes (it would seem they would have to be), who is to blame for the damaged product? Microsoft or the consumer who failed to understand just what they were paying for?
-- James Dornan AKA TigerSmile "Long live the PORK!"
HA HA HA HA HA (Score:1)
I can't believe that such a simple little (HA HA, you should see the RAM hit for this guy) window can pose too much of a security risk, unless it is badly coded by M$ of course!
Q: When will M$ stop producing naff code and write something decent? A: The day it joins the OpenSource revolution!
Come on Microsoft, remove that stick from your anus and join the revolution, it can only do you good.
corarc
Last freakin' straw!! (Score:1)
Although I'm keeping my Win98SE installation on my Dell for work-related reasons for the time being, I'm going to run 98Lite to strip out IE from my Windows setup and make a note never to run any Office app while I'm online. These bugs are driving me nuts!!
If BG wants to innovate for the customers' and stockholders' benefit, more power to him. I just wish to h-e-double-toothpicks he and his minions would make all this stuff WORK RIGHT.
Re:A thought. (Score:1)
I don't expect you or anyone else to believe what I have to say. I wouldn't have believed it myself a few years ago. Still, it is a bit disheartening to have one's opinions dismissed without even the courtesy of a good rebuttal.
To each his/her own, I suppose. Still, for your sake, I hope you realize that the world is not a pretty place with rosy tints. Behind the flashy, eye-catching facades lurks a dangerous, manipulative world of faceless entities engaged in complex struggles to no easily-discernible end. All we know is that they want power. Maybe this doesn't bother you. I know it bothers me.
Re:A thought. (Score:1)
o/~ Some of them want to use you...
Some of them want to get used by you...
Some of them want to abuse you...
Some of them want to be abused... o/~
Sorry, this popped into my head as I was reading, and it seemed apropriate
Microsoft got "Free Speech" Award! (Score:1)
"Free Speech" award
goes to.. Microsoft. Yes, we all know that story when the monster
published essential piece of Kerberos interoperability specifications
under trade secret notice in hope to compromise Samba developers with
illegal knowledge and to establish a new legal precedent of "nobody can
implement those specs".
But, one of obvious outcome of the antitrust battle is the required openness of all Microsoft
API's. That's what will be too late to protect in the High Court - once the bird is out of the
cage, you can't put it back. Please, help me to write a list of young fellows waiting to kick the
behemoth's butt: Netscape/Mozilla, Samba, RealNeworks, StarOffice, CorelOffice, etc.
What about the other assistants? (Score:1)
Cat AI? what next, rabbits?
***Please wait whilst Windows procreates rapidly**
doom is coming, mark my words...
The Paperclip....... (Score:2)
who will be turning in his grave and
the unrecognised author of this gem (not me that's for sure)]
Once upon a weeknight dreary,
while I coded, weak and bleary,
Over many a quaint and curious system
of my SeQueL calls,
While I nodded, nearly napping,
suddenly there came a tapping,
As of typing, gentle rapping,
tapping through my cube's grey wall
"Tis some worker still," I muttered
"typing in this office floor --
Only this, and nothing more."
Ah, distinctly I remember
it was in the bright December,
And each product, documented
cast it's shadow on the floor.
Eagerly I wished the morrow;
-- vainly I had sought to borrow
From my work surcease of sorrow
-- sorrow using 'net Explorer --
For the slow and ponderous creature
whom Bill Gates has named Explorer --
In PCs for evermore.
And the dull and muted creaking
of the gentle sounds of typing
Thrilled me -- filled me with fantastic
terrors never felt before;
So that now, to still the ranting
of my mind, I stood still chanting
"'Tis some worker typing emails
on their PC through the wall --
Some late worker coding softly
in their cube just through the wall; --
This it is, and nothing more."
Presently my soul grew stronger;
hesitating then no longer,
"Sir," called I, "or Madam,
truly your forgiveness I implore;
But the fact is I was napping,
and so gently you sat typing,
And so faintly came your tapping,
tapping through my cube's grey wall,
That I scarce was sure I heard you
-- here I stood and looked next door; --
Darkness there and nothing more.
Deep into that darkness peering,
long I stood there wond'ring, fearing,
Doubting, dreaming dreams
no mortal ever dared to dream before;
But the silence was unbroken,
and the darkness gave no token,
And the only word there spoken
was the whispered word, "Explore!"
This I whispered, and an echo
murmured back the word, "Explore!" --
Merely this, and nothing more.
Sinking back in my cube turning,
all my soul within me burning,
Soon I heard again a tapping
somewhat louder than before.
"Surely," said I, "surely that is something
at my neighbour's keyboard;
Let me see, then, what the threat is,
here behind my office wall --
Let my heart be still a moment
and this mystery explore;--
'Tis a person, and nothing more!"
Slowly here I pushed my chair back,
as my hard drive seeked a new track,
Up there popped an MS agent
appearing in an icon form,
Not a cancel button had he;
nor a way to kill or maim he;
But with bubble speech just like a cartoon,
perched above my web explorer;
Perched upon a window showing off a page
of witty speech galore --
Perched, and sat, and nothing more.
Then this paperclip sat beguiling
my sad fancy into smiling,
Fixed it's gaze and stared intently,
through my soul it tried to bore,
"Though thou merely animation,
thou" I said "are a creation,
In PCs across the nation,
upgrade free from Redmond's door --
Tell me what thy process name is,
thou art here, pray tell, wherefore?"
Quoth the speakers "Nevermore."
Much I marvelled this "assistant"
was to closing quite resistant,
Though it's purpose little useful
-- giving hints unask-ed for;
Nothing farther then he uttered
-- not a pixel then he fluttered --
Till I scarcely more than muttered
"Others have yet crashed before --
On the morrow _he_ will leave me,
as the rest have crashed before."
Then the thing said "Nevermore."
Then, methought, the screen grew denser,
blanked out by an unseen censor
Blacking out the non-work emails
sitting in my outbox drawer.
"Gates," I cried, "thy spawn hath lent thee
-- by these programs thou hath sent me
Millions -- upon millions of the dollars
over which we all do fork;
For this vile and odious creature
you have conjured with explorer;
From my speakers "Nevermore."
"Icon!" said I, "thing of evil!
-- process still if code or devil! --
Whether patched remotely
or by other means installed,
Pixelled beast art undaunted
by my clicking -- still you taunt me --
Which foul beast hath built thy sources
-- tell me truly I implore --
Is there -- _is_ there yet a way to kill you?
-- tell me -- TELL ME, I implore!"
Quoth the Icon "Nevermore".
"Icon!" said I, "thing of evil!"
-- process still if code or devil! --
By that network spans between us
-- by the protocols galore --
Tell this soul with caffiened terror
if, without a system error,
there is yet a way to exit
from this process I abhor --
can I kill the evil icon
of this process I abhor?
Quoth the Icon "Nevermore".
"Be that word our sign of parting,
paperclip!" I shrieked, upstarting --
"I shall pull the plug and then
you shall appear no more!
Leave my system yet unbroken
and take thy visage, evil token!
Go with no more words a-spoken
-- thou invoke no evil lore!
Take thy clip from off my screen,
and take thy code from off my core!"
Quoth the Icon "Nevermore".
And the icon, never quitting,
still is sitting, still is sitting
On the glowing screen of phosphor
just above my net Explorer;
And his eyes have all the seeming
of a demon's that is dreaming,
And the cursor o'er him streaming
throws a shadow on Explorer;
And my work into that shadow
that lies over my explorer
Shall be lifted -- nevermore!
Re:A thought. (Score:1)
I don't know, if they wanted to spy on you why put the spy code in something as obvious as Satan's favorite paper clip? Something of the James Bond effect here. That is, a spy who acted like James Bond, seducing women, throwing money around and driving fast cars would draw too much attention to himself and get his cover blown. It's the quiet accountant who lives in a modest house who always turns out the be the one. The analogy to that would be a nice quiet little program that nobody ever saw because it didn't even tell you it was running and the process accounting system had been rigged not to show it. That's the problem with closed source OSs they're like Gump's box of chocolates. You never know what yer gonna git.
Was that enough movie references or what...
What?? A patch?? (Score:1)
Marissa
I'm not really an elf, I just play one in AD&D.
Re:What about Vigor? (Score:1)
what about (Score:1)
Buggy Easter Eggs. (Score:1)
Even a 'feature' that no one wanted has bugs, and worse, security holes.
What's next? Playing the flight-sim Easter Egg in Excel gives you Administrator rights?
Re:I am rather concerned - NOT (Score:4)
Yes, like just two weeks ago when ILOVEYOU was out, right? MS had the patch out "before serious exploits," right?
Let's be real here. Microsoft's concern for security could fit in one thimble along with Dilbert's enthusiasm. If they really cared about it they would have fixed the "every-user-is-root" problem years and years and years ago.
No company that says their latest software release will be bug-free (while having a list of 63,000 bugs they knew about at release time) can be taken seriously when it comes to security. No company that has to be goaded by bad press into fixing Outlook Express can be taken seriously. No company that denies that its customers care about bugs can be taken seriously.
Real physical papr clips are a security threat too (Score:3)
L0pht (Score:3)
hacker known as "Dildog" who works for the security firm @Stake Inc."
Wow...@Stake buys L0pht, and suddenly they are not some seedy "hackers", but "security researchers" who work at a "security firm". Magic.
""You don't mark something safe for scripting unless you are going to let someone activate it
remotely," he said."
Huh? Shouldn't that be: You don't mark something safe for scripting unless you are !NOT! going to let someone activate it remotely?
Re:A risk to national security (Score:1)
Oh great. (Score:3)
Seriously, who really uses them anyways (don't answer that!). Anyone who needs that damned annoyance is already in need of some help. They're the ones that will run trojan horses and other "unknown" files out of ignorance.
kwsNI
Re:A thought. (Score:1)
You're ruining the communal paranoia feelings here.
Anybody know the actual url of the demonstration? (Score:2)
An excellent fix... (Score:2)
repartition the hard driving, giving all your space to linux. The installation will take care of the rest, and all of your Windows woes will be gone for good.
Which is exactly how you will feel, when you're finally rid of the beast.
conspiracies... (Score:2)
you install the paperclip and he can SEE WHAT YOU DO! he is thinking! those eyes? they can see right out of the screen and at you! this information goes straight to microsoft, but not through the internet. that would be too simple. it goes through the satellite uplink to the paperclip mothership in low earth orbit.
the mothership then sends orders back down to earth and scripts are executed on your computer. be afraid. be very afraid.
Re:Er, it's not just Microsoft..... (Score:1)
BTW, Help viewer didn't open. I'm using Netscape so I don't know about IE.
(I love the
Even Better (Score:5)
Re:From Microsoft (Score:2)
Pablo Nevares, "the freshmaker".
Re:Clippy must die! (Score:1)
--Hikari
Geeez, I killed of clippy, and it's still a threat (Score:1)
Damn it, even when I've completely eradicated the blasted thing from showing on my screen ever again; it's still a problem. Hopefully this patch will let me eliminate the last vestiges of clippy's influence on my Win box. It (clippy) was a bad idea that should be forgotten and buried.
Crackdown on security holes (Score:2)
Re:I am rather concerned (Score:2)
The obvious reply is that no one's life depends on whether your letter to grandma gets eaten by the Office Assistant.
Why isn't anyone returning Outlook for a refund, because it's a major security threat on a Network?
Because people in the United States (I do not mean to exclude the rest of the world, but the U.S. is where Microsoft does a lot of its business, legitimate or not) have been carefully trained by fifty years of easy living that whatever doesn't affect them directly is not a problem. System security is seen as a task for system administrators, not users. Nobody realizes that good security begins with the users, in much the same way that U.S. citizens don't or won't believe that good government begins with good citizens.
Nobody is returning Outlook in droves because nobody sees it as a direct threat to them--except those who were bitten by the bug.
clip (Score:1)
Perhaps Microsoft needs to change their Assistant (Score:1)
"Jeeves, how can I create columns in Word?"
"808 The She Creature" Word Find - Mystery Science Theater 3000".
If nothing else, it would make tech support MUCH more interesting
Re:Buggy Easter Eggs. (Score:1)
Re:what about (Score:1)
Now, we come to the ability to use the Office assistant's programming to affect the system. What's the use of this? Would a user, or even sysadmin know this functionality existed? It's an inherent, inexcusable design flaw. Doubly inexcusable when you consider the lack of security on Windows 9x systems.
Re:Even Better - they're fun (Score:1)
Anyway my Office Assistant is the Keiru the dolphin rather than that f***ing Paperclip. All the ladies at work think he's cute but unfortunately this doesn't extend to me.
Re:L0pht (Score:1)
--
Re:Even worse than a security hole (Score:1)
If they've only created one or two programs, they are "functionally stupid": they don't yet know enough to be smart.
And, no offense, if you've been programming any time at all and can't yet give a time estimate within 10% of actual about 80% of the time then you have no business calling yourself a programmer.
--
Have Exchange users? Want to run Linux? Can't afford OpenMail?
Re:Clippy must die! (Score:1)
--Hikari
Thank you... (Score:1)
--cyphergirl (one very busy security engineer these days)
Re:Testing.... When are they going to? (Score:2)
Being fair to MS (Score:1)
--
Being fair to MS (Score:1)
--
Re:Even Better (Score:1)
It's been done to death in all James Bond movies... Might as well bring it to the PC.
You know the scene, it's where the villan in about to kill the hero, and absolutely MUST explain his evil plot about taking over the world.
Maybe make the paper clip look like Dr. Eeeviil, just for effect.
Re:Microsoft is a Threat to National Security (duu (Score:1)
Re:From Microsoft (Score:1)
incorrectly marked as "safe for scripting"
is how it could have been incorectly marked when it had to be marked that way to allow operation of the "Show Me" function.
This is like a boss I used to have who would spew statements all day long that made no sense to anyone but himself. When asked what he meant by that, he always replied "That's not what I said."
Sheesh.
Re:Er, it's not just Microsoft..... (Score:2)
Mac IE5 gave the matter a few seconds of thought, then astonishingly decided NOT to open the help viewer. Mac IE5 has some interesting twists -- it allows you to run executables by clicking on links, but presents you with a confirm box first. However, it allowed a self-mounting disk image to open without confirmation when I made a link to it.
Mac NN 4 has no idea what the help URL style means, and sent me to /. 404 page. Mac NN 4 will not run executables or unrecognized file types at all -- it tries to open their data forks as text files instead.
About the general security issue: MacOS has many features similar to Clippy, most notably AppleScript (which gained remote connectivity in OS 9). I haven't seen any real exploits yet, but that's probably because H4X0Rs disproportionately use Windows. If Steve Jobs were the evil overlord instead of Bill Gates, we'd probably have AppleSkript Kiddies.
Here's another reason (Score:2)
[ps - the above 'toon was pre '29]
Re:Hrrm.. (Score:3)
"YOU THE MAN."
and. Why have a Picture of an ActiveX component.That isn't very discriptive of a Skript Kiddie. But then again.. How would you portray a Pre-Pubescent 15 year old who figured out how to download scripts from rootshell or other various websites and run them. At the same time having the inabiltiy to realize that they have absolutely no life, and need a stronger deodarant.
My next question is... When I speak german... I think german in my head... but like... Do skript kiddes see a w40l3 8uncha 1's and 0's and 3's and 4's and 7's in their h34d'5 w43n t43y R +a1k1n6 ?
Re:What?? A patch?? (Score:2)
Re:conspiracies... (Score:2)
So you're not alone in your paranoid ravings, but I liked your imaginative new theory.
D
----
ye gads (Score:2)
Have you all forgotten the lesson of the early 80's? what, we had 15 platforms to consider, and whoah to those who bought dog systems like the TI/99 4a. Try getting a port of supercalc for that platform. That was one of the few truly useful apps back then, and many could not get ahold of it. All I know is that I want the best features and apps available. Maybe most of you ranters are too young to remember those crusty old days...
Microsoft has the worst job on the planet. They must please everyone, and can barely please anyone. You are not clever for raging about the occasional screw up. Windows happens to support more hardware than linux can claim knowledgable users. and as for software availability and backwards compatability, forget about it. They definatley have thier act together there.
you guys are in the akward position of being high tech savants that cause the most friction and FUD, thus slowing the pace of technological adoption and intimidating normal users like grandma into going without. You seem to suppose you are helping some cause, but all you are really doing is accelerating the entropy of an already flaky system. reminds me of teenagers who pick apart films and TV shows making noises like they are superior to the writers and directors. They are not, they just don't understand what it takes to organize and execute such a large project. To those of you actually doing something to make the world better, as in say contributing to the usability side of Linux, kudos. But the rest of you slackers are starting to piss me off.
Maybe one of you wise guys can explain why it took me 3 hours just to get my wheel mouse (sort of) working under redhat 6.2? or why my stealth II took even longer to setup with xf86config? No, the answer is not that I am an idiot, nor computer illiterate. I did figure it out, but not with any help from ranting zealots. an $80 Linux reference book and much digging through bugzilla eventually got me on my way. But slap this stuff in a windows machine and Blamo! no sweat. This is a respectable accomplishment on MS's part, why no mention of it from the zealots?
anyway, as a game developer that is OS ambivilant in theory, but actually trying to make a living in practice, why oh why should I spend any effort on the irrational foggy headed likes of you guys? can anyone answer me? I am not an M$ apologist, but I am interested in getting work done and advancing the state of the art. Can the ranterzealots claim the same?
-=b
Re:Oh great. (Score:3)
Those Office 97 assistants stunk, but the new ones 2000 are pretty cool. I like how he jumps around on my screen and reacts when i send an e-mail. I use the robot one, but my friends use the earth one, the cat, or the dog.
Of course, I am a trained NT/Unix/Mac admin, who's also a network admin and security consultant. So I don't click on those "unknown" files.
I wish that people would stop making comments like "that's so stupid" or "this is so dumb" I mean, really, leaving the little guy on your desktop is no dumber than using vi or emacs or AmiPro or AbiWord or KWord or anything else. It's just a personal preference, right?
Or don't you use man(1)? Anyone who uses that instead of just reading the source is a retard
Re:They found a hole and patched it... (Score:4)
"But, but, but, someone could write a script for Linux too! Ha, got ya there!"
No, you don't. If a user sets up sh to run scripts automatically in Netscape, or downloads and sets the executable bit, it would still only affect that user's files unless they were dumb enough to run Netscape or the script as root. The user would lose the files they own, but binaries and pretty much anything outside
"But, but, but, there are bugs in Linux! And some can lead to a root compromise!"
No denying that; they still require some level of actual skill, either in programming or ingenuity, to take advantage. Once again; arbitrary code should not be able to affect anything; it should be contained (like the Java sandbox), and never run as an administrator. NT at least takes steps in this direction, though a cursory look through the Attrition page crack archives [attrition.org] should show how much NT is like Swiss cheese.
The point: Windows 9x, and to a lesser extent NT, is inherently insecure, allowing arbitrary code and even scripts to affect important system files and take actions without the user's knowledge. The Morris Worm forced *NIX to shape up; perhaps dragging Windows into the light will force Microsoft to do the right thing for once.
If Clippy is so powerful.... (Score:2)
Re: A thought. (Score:2)
If Microsoft really wanted to "create extensive profiles on users", do you really think they'd have to stick a cartoon character on the desktop to do it?
On a similar vein, why do you suppose Perl uses the $ to mark off variables.... OF COURSE!! There's special hidden code attached to the $ key that emails your bank account numbers, your credit card numbers, your favorite food, what kind of porn you like, and the brand of soap you use to a SeKReT email address on Hotmail.
Oh yeah, Janet Reno's in on it.
Random Office Assistant Quickies (Score:2)
Someone has taken a cue from a certain User Friendly strip [userfriendly.org] and created VIGOR [red-bean.com] the vi[m] editor with an added paperclip assistant!
It features helpful advice, requiring you to click on a dialog box, such as:
"You have not entered insert mode before. While you're in insert mode, remember that you need to return to command mode before entering Vigor commands!"
and:
"Are you sure you want to move left?"
Screenshots [red-bean.com]
2)
I was once shopping on a Waldensoft store and found a boxed piece of software from Microsoft which would let you create your own Office Assistants. But the EULA specifically forbade creating any kind of office assistant that appealed to the prurient interests.
Re:Testing.... When are they going to? (Score:3)
Want to work at Transmeta? MicronPC? Hedgefund.net? AT&T?
A risk to national security (Score:5)
...phil
Re:Is this really news? (Score:2)
Before you go on your rant yelling at the IT managers who
>force Micro$oft products down our throats
You'd better take a look around, and remember it's you who's doing the forcing of MS products.
Devil Ducky
The Paperclip Spy (Score:2)
Binky and the mechanism used to send all your data to Redmond are totally separate pieces of programming. Just because we have Binky doesn't mean your data goes to Redmond; just because we didn't have Binky in Office 95 doesn't mean it didn't send data to Redmond.
The interesting psychology of this is that Binky makes it seem more real that there is something from MS analyzing your data and sending it to Redmond. I thought that myself the first time I saw Binky (see some of my other messages on this topic).
The good news is that if data was actually being sent, some Slashdot reader would have long since seen it - note how quickly the Windows 95 Registration fiasco got out. So we're safe. At least for now.
D
----
It's not a bug. (Score:2)
They thought this was a good idea.
It shows the depths of the contempt in which they hold their customers' security.
Re:what the hell are you talking about (Score:2)
IF Microsoft had an otherwise good (I'm not saying perfect) record about security, and IF they didn't ALREADY have a reputation for lying to their customers ("no bugs" in Windows 2000??? "no significant bugs" in any Microsoft products???), I might be willing to give them the benefit of the doubt.
They're lying so as to minimize the PR damage they are going to suffer for this, coming as it does on the heels of ANOTHER Microsoft design choice that was grossly stupid (I'm speaking, of course, of ILOVEYOU).
Do you believe everything Bill tells you? How much do they pay for that Astroturf campaign?
Millitary Intelligence (laugh dammit) (Score:2)
I know i feel safer seeing as how the millitary computer systems are (approx.) 95% NT systems. The other 5% are 95/98 systems. Mind you i'm not counting the DNS servers or anything of the like, nor special terminals. I'm only counting the standard office computer anyone/everyone uses.
Yet another strike against that great oxymoron
Re:From Microsoft (Score:4)
Re:Is this really news? (Score:2)
It seems like every day I read about another Microsoft security hole. When will it become obvious to the managers who force Micro$oft products down our throats that they are compromising their companies security? If I forced everyone at my office to use software that is full of security holes and we got hit bad by it, I would be fired. When are IT managers going to be forced to face the consequences of their decisions?
I'm currently working for a Fortune 100 (maybe 500) financial company that is about as pro-Microsoft as you can get. They're planning on dumping their Novell servers for Win2k. It's not as if anyone actually believes that Win2k servers will be better, it's just that they already agreed to purchase "NT 5.0" quite a while back. I think there might be a financial interest in continuing to prop Microsoft up. At any rate, the decision to use Microsoft is not being made by IT. As far as I can tell it's some kind of partnership agreement made by non-IT management that dictates the use of Windows. Using Linux on-site (whether connected to the network or not) is a firing offense. Two other Fortune 100/500 financial companies that I've worked for are doing the same thing.
These companies have all bought Microsoft licenses, continually say that they're switching all their non-MS servers to W2k, but still don't because they actually know that it would be a bad idea. My guess these companies are propping up Microsoft for some other reason. They're buying licenses, not using them, and talking about Linux like it's the greatest evil around.
Anyway, all the articles about holes in M$ products get printed out by me and hung up on the board. People stop, look, laugh and shake their heads, and then it's back to business as usual. Oh well.
numb
Er, it's not just Microsoft..... (Score:2)
If you're on a Mac, and you clicked that link, did your Help Viewer open (or move to the front if it already was)? It shouldn't have, but I'm curious.
Anyway, by replacing some of those scripts or web pages, you could conceivably do much damage to a Mac, too. That said, I do use one of the assistants in the Mac version of Office, the Hoverbot, just because I like the sound effects it makes (and it never gets in the way, unlike the stupid Windows paperclip.
Re:Real physical papr clips are a security threat (Score:2)
- Jeff A. Campbell
- VelociNews (http://www.velocinews.com [velocinews.com])
Clippy must die! (Score:2)
A thought. (Score:4)
What Microsoft has done is truly interesting, and maybe a bit frightening: they have made a cute, vaguely helpful (but mostly interfering) figure a commonplace on the desktop. With Office 2000, you don't even have to be using an Office product to have the assistant sit on your desktop.
The Assistant uses up a lot of valuable system resources, and you can bet your bottom dollar that it doesn't just use them to render itself in stunning 3-d realtime graphics. We already know that Microsoft has a policy of blatantly, casually violating its users' privacy. What else is this Assistant doing? Perhaps it's logging keystrokes and sending them to Redmond. Perhaps it's analyzing user traffic and building a profile.
I suspect that MS is using the Assistant and other Office "features" to create extensive profiles on users around the world, for who knows what use in its own nefarious schemes. Perhaps that is why they seem openly contemptuous of the DoJ--they have the goods on Reno and her crowd and will use them when the time seems right.
Will MS do the right things? (Score:2)
Given the extremely well considered approach to fixing the MS Outlook attachment problem (i.e. don't fix the problem, just make sure there is a patch which makes it impossible to get to the problem) will MS now do the right thing? Will they kill, scrag, frag, smash, disembowl and eviscerate Clippy the ultra-annoying? Totally, utterly expunge the cruel, procrastinating, patronising, difficult-to-put-up-with and even-harder-to-disable office assistant from our hard drives :-)
While they are at it, they could solve a few other of the problems in the same way? MS IE 5.5 not standards compliant - fix it so it doesn't run. BSOD - delete that c:\winnt directory. I think we'd all be happier for it. :-)
Cheers,
Toby Haynes
Hrrm.. (Score:5)
[Yes, please help me] or [No thanks] (greyed out)
What next, a picture of a ActiveX scripting component painted on a cat to pop up and go "Script kiddie detected." followed by another message saying "Your security settings have changed, please reboot for these settings to take effect" ?
Re:Hrrm.. (Score:2)
Testing.... When are they going to? (Score:5)
But it appears that MS is relying on the general public to act as its beta testers, to search out and discover these holes. They are complacent, non-proactive, and basically riding on the assumption that people will continue to use their products no matter how low the quality level goes.
This is one area.. where the communities like Open Source can really shine. Because opening your code to peer review keeps you on your toes. It allows different minds to work together cooperatively to create a better software package. And in the end, everyone benefits.
I know this is a bit of a rehash of stuff I have said before, but since we all know that MS is paying very close attention to everything written here on
One can always hope...
Re:Mr Hankey Assistant (Score:2)
Go get your free Palm V (25 referrals needed only!)
Re:Hrrm.. (Score:2)
Unix manpage security hole found! (Score:2)
After decades of development and use, a major security flaw has been discovered in the Unix operating system. "All variants of Unix are affected", according to a mailing list of software security bugs for system administrators. Because this security hole was not discovered until today, it is possible that hackers have been exploiting it for years.
Details of the bug are still limited but early reports hint that a Unix feature called an "Unamed pipe" has a flaw that, when used, opens access to the computer system to any other computers on the network. According to a Microsoft spokesperson, the "[Unamed] pipe is a tool used exclusively by malicious computer hackers." As a leader in network security, Microsoft ensures its customers that it is not affected by the bug. The spokesperson continues, "At Microsoft we recognize the fact that the command prompt is the true reason why such hideous exploits flurish. For that reason, we have taken the innovative step of integrating the graphical user interface directly into the operating system, bypassing any need for a useful command prompt interface."
All users of Unix and Unix-variant operatings sytems are urged to refrain from using unamed pipes until a security patch is made available. Utilities such as "man" should not be used under any circumstances for any purpose. System administrators should take necessary precautions and install security patches as soon as possible. Users should also take precautions and never open unamed pipes, especially unamed pipes you weren't expecting.
EULA (Score:2)
Simplest scenario, bfreeSP provides email services to 1000 companies via POP/IMAP, a security oversight in a M$ product results in bfreeSP receiving a DDOS from all it's own customers and the people who want to mail to the customer. bfreeSP's customers lose their email system for 1 day (thanks to the speed of sendmail fixing the problem) and hence all claim a refund for the lost day (lets forget the compensation side for now). bfreeSP should be able to sue M$ because it has never agreed to the EULA, and the problem has been caused by the software written by M$.
In the above simple case, am I right in assuming the only factor a case would consider is whether the fault lies with M$, the author of the worm/virus/whatever which exploited the hole or each and every individual user who installed and used the M$ software? Anyone who is a lawyer care to suggest how this case might fare?
Talk about a virus... (Score:2)
Re:A thought. (Score:2)
Given that Windows is on a vast majority of the desktops out there, and that packet-watching isn't exactly uncommon, you'd think someone would notice by now.
Plus, what exactly would Microsoft have to gain? Certainly not enough to make up for the potential lawsuits...
- Jeff A. Campbell
- VelociNews (http://www.velocinews.com [velocinews.com])
Is this really news? (Score:4)
It seems like every day I read about another Microsoft security hole. When will it become obvious to the managers who force Micro$oft products down our throats that they are compromising their companies security? If I forced everyone at my office to use software that is full of security holes and we got hit bad by it, I would be fired. When are IT managers going to be forced to face the consequences of their decisions?
#undef RANT
Seriously though, I guess we can't expect the masses of ignorant users to give up their beloved paperclips and fancy email attachments. They want everything and Micro$oft tries to give it to them without regard to the security risks.
From Microsoft (Score:5)
The patch is available at http://download.microsoft.com/download/office2000p ro/Uactlsec/2000/WIN98/EN-US/Ua ctlsec.exe [microsoft.com], with instructions avaiable at http://officeup date.microsoft.com/2000/downloadDetails/Uactlsec.h tm [microsoft.com]
Microsoft states in their FAQ:
Sure. This time it's a simple error in labelling. What will it be next time? How many more simple marking errors lurk in Office or IE?Re:Oh great. (Score:2)
---
Re:Testing.... When are they going to? (Score:2)
Bad Mojo [rps.net]
I am rather concerned (Score:3)
When Boeing was accused of installing low-quality wiring in their jets in 1974, there was a massive public outrage forcing them to stop using that type of wiring. To the software industry, I consider this a simple bug. But a dangerous bug that cost many lives. Obviously, there is a major difference: using Outlook has not cost any lives. But still, why is the public gracefully accepting the fact that M$ software is full of bugs?
Yet a couple of stories ago, everyone and their dog was complaining that Corel's WP Office 2000 was full of bugs and that they returned it to get a refund. Why isn't anyone returning Outlook for a refund, because it's a major security threat on a Network?
Mr Hankey Assistant (Score:4)
Every so often you'd get that slide guitar followed by,"Hidy ho! Hidy Ho guys!"
and a big brown jobbie wearing a hat would appear to guide you through the process.
"Seems to me that you're tryin' to type a letter!"
Re:What?? A patch?? (Score:5)
Binky the Talking Paper Clip is Immortal!
I realized why when I analyzed my own behaviour.
In the good old days, when I asked for assistance on any Microsoft(tm) product, the help system was startlingly inept at providing same. So what would I do? Why, curse Microsoft and try and figure it out on my own, of course.
Now we have a modern, sleek, polished system, complete with a glorious cartoon character who's going to offer friendly assistance and tell us what to do.
A big improvement, of course! So, when I ask for help and get answers that are even worse than under the old system, what do I do?
Why, curse that (bleep) paper clip, of course! Microsoft is an Innocent Creator of Brilliant Software, it's Binky the talking paper clip I blame.
It's a neat emotional transformation, but I'm willing to bet it's worth millions to Microsoft.
Oh, by the way, I'd like to endorse the following link on Binky:
Binky on the Witness Stand [ubersoft.net]
D
----