Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Microsoft Apologizes To Rival

Posted by kdawson on Mon Jan 07, 2008 08:12 PM
from the it's-the-software-stupid dept.
Microsoft Security
Geoffrey.landis writes "Microsoft apologized to rival software vendor Corel Corp. for saying that Corel's file format posed a security risk, and issued a set of tools to unblock file types that had been blocked by default in the December Office 2003 service pack. In his blog on the Microsoft site, David Leblanc says 'We did a poor job of describing the default format changes.' He goes on to explain, 'We stated that it was the file formats that were insecure, but this is actually not correct. A file format isn't insecure — it's the code that reads the format that's more or less secure.' As noted by News.com, 'it is the parsing code that Office 2003 uses to open and save the file types that is less secure.' Larry Seltzer at pcmag.com also blogs the story."
+ -
story

Related Stories

Submission: Microsoft apologizes to rival and to users by Geoffrey.landis (926948)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Microsoft Apologizes To Rival 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Wait.... (Score:5, Funny)

    by nizo (81281) * on Monday January 07 2008, @08:14PM (#21948942) Homepage Journal
    When I took a nap at lunch today, did I wake up in a parallel universe?
  • So boiled down, microsoft is saying that their software is the problem? That Office has "less secure" ways of opening formats than they could have?

    • Re:Boiled down (Score:5, Insightful)

      by davester666 (731373) on Monday January 07 2008, @08:27PM (#21949044) Journal
      Yes. Rather than fixing their implementation, they just made it more difficult for users to use their implementation.

      It just happens to be that some of their faulty implementations are for reading formats for competing products... You are not permitted to draw any inference from this fact.

    • Re:Boiled down (Score:5, Interesting)

      by joe_bruin (266648) on Monday January 07 2008, @08:29PM (#21949056) Homepage Journal
      It boiled down to Microsoft, instead of fixing their bad file parsing code, disabled it so customers couldn't access their older files AND blamed Corel's file format. Notice that they are still not admitting that their code is bad or fixing it, they're just re-enabling their buggy code because customers complained that they couldn't open files.

        • Re: (Score:3, Funny)

          by Trolan (42526)
          If they keep this up, I can see their next OS: Microsoft Windows BoW (Block of Wood) Ultimate Edition!

          But a block of wood isn't complete safe. Someone could get hurt by it. So they'd have to release SP1 which adds padding.

    • Re:Boiled down (Score:4, Insightful)

      by Smidge204 (605297) on Monday January 07 2008, @09:19PM (#21949300)
      Read it carefully for the doublethink!

      "A file format isn't insecure -- it's the code that reads the format that's more or less secure."

      Read it again if you didn't catch it.
      =Smidge=
  • File formats that ARE insecure ... the ones that come to mind are .EXE, .COM, .SCR, .PIF, .CHM, .DLL, .VB* ... the list is long.
    Oh, wait ... with Microsoft's logic these aren't insecure. It's the program (Windows) that uses them. I would agree.
    Fortunately my various flavors of un*x boxes don't understand what to do with these...

    I would love to read the letter Microsoft's legal department got over the December update.

    Too bad that won't be made public.

    • Re: (Score:3, Informative)

      by _merlin (160982)
      Well it's true of the formats - .EXE is no more or less secure than an ELF binary, .COM is no more or less secure than a.out format, .CHM is no more or less secure than a tarball, .DLL is no more or less secure than ELF .so, .VBS is no more or less secure than a Perl script. The issue is whether the environment they run in is secure or not. You could argue that the execution environment that an ELF binary runs in under Solaris is more secure than the environment that a .EXE runs in under Windows, but a ma

    • You missed my personal favorite: Windows Metafile [wikipedia.org]

      Terrible engineering, that.

  • So, what changed hands between Microsoft/Corel? (Score:3, Interesting)

    by defile (1059) on Monday January 07 2008, @08:22PM (#21949006) Homepage Journal

    Why would Microsoft enable a competitor, and, more ludicrously, apologize if there was no reason to? What's in this for Microsoft? Did Corel pay them a fee? Agree to cede a market? Threaten them with some kind of slam-dunk legal action that Microsoft was on the losing side of? We will probably never know.

  • we're sorry... (Score:5, Insightful)

    by nguy (1207026) on Monday January 07 2008, @08:27PM (#21949042)
    That's like saying to a corpse, "Oh, I'm so sorry I killed you; I hope you won't feel too bad about it."
    • Darwin Tremor [imdb.com]: [manipulating Dupree's mouth so Jack seems to be speaking to him] Oh hell yeah, we was just at the wrong place at the wrong time, so don't feel so bad, chief.

  • that's weird (Score:3, Funny)

    by SolusSD (680489) on Monday January 07 2008, @08:33PM (#21949078) Homepage
    Microsoft said something that didn't make me upset. hmm. in fact, it was the right thing to do! (i'm scared)

  • Who neutered Microsoft? (Score:5, Interesting)

    by NullProg (70833) on Monday January 07 2008, @08:54PM (#21949174) Homepage Journal
    'We stated that it was the file formats that were insecure, but this is actually not correct. A file format isn't insecure -- it's the code that reads the format that's more or less secure.'

    Admitting FUD is uncharacteristic of Microsoft. Speaking the plain truth means Hell just froze over.

    I'm at a loss for words....

    Enjoy,
  • Whoa! I'm going to put all my passwords and bank account numbers online in the clear in a single plain ASCII text file from now on. Who needs encryption? Take that crackers! You thought you could steal my stuff, eh? Just you download that file from my blog and weep, bitches!
    • The ASCII file format is not insecure. However, the behavior you suggest is dangerous.

      • The ASCII file format is not insecure. However, the behavior you suggest is dangerous.

        The crucial question you're not asking is what is the intended use of the file format. Every file format is intended to be used for something, and once it is stated what that use is, one can ask if the format is secure for its intended purpose.

        In my example, the intended purpose makes the format insecure. If I had used plain ASCII to list a bunch of recipes I found online, the format wouldn't be insecure if my purp

        • ...that's funny, becuase Microsoft's argument was more along the lines that Office would be more secure if only those files couldn't be opened.

          And yet for some odd reason NeoOffice on my Mac can open them just fine with no adverse reaction.

          /P

        • If we go ahead and assume that "ASCII file format" means a file containing only the printable ASCII characters, then that's pretty open ended. You can store encrypted data in it just fine by encoding that data as "plain text" (e.g. gpg --armor). The same as how binary files can be sent over SMTP, which traditionally only supports 7-bit ASCII. Or you could come up with your own "cypher", known only to you, so an attacker reading the file would see "mybank.com password: foozball" but you'd know that it's a li

    • Re: (Score:3, Insightful)

      by MrNaz (730548)
      Yes, the file format wouldn't be insecure. Your handling of it would be.
      • If the file format is *intended* to keep my information safe from others, then I think if it easily fails that task, it must be called insecure by definition.

        If I specified the format to be freeform text, encrypted with a suitably hidden, suitably complex one time pad, then the resulting file format would have to be called secure, no?

  • They must have meant Mike Rosoff.

  • We don't abuse our monopoly... (Score:5, Funny)

    by Locklin (1074657) on Monday January 07 2008, @09:59PM (#21949540) Homepage
    See! we apologized! Now leave us alone!

  • Amazing. (Score:5, Insightful)

    by Scottoest (1081663) <scott&bampage,com> on Monday January 07 2008, @10:29PM (#21949678) Homepage
    I remember the /. posting about this topic last week, where everyone rightfully corrected them about file formats not inherently being insecure. There was the usually geejawing about "M$" being brutal thugs, and idiots, etc. etc. etc. Y'know, par for the course on this website.

    However, the most entertaining posts on this website, are in cases where Microsoft admits error, or does something "good". We then get to see these same people do logical contortionist routines about how they must have been threatened legally, or baseless conjecturing about what must have been in it for them.

    A lot of people here talk a lot about how Microsoft should listen more to the "geek" community. Places like this remind me of precisely why they don't bother.

    Slashdot is generally pretty great for my daily fill of tech news. But man oh man, when it comes to Microsoft, any front of being unbiased is quickly cast off.

    "kdawson" is probably the worst of the bunch, too.

    - Scott

  • We're apologizing... (Score:5, Informative)

    by Chris Mattern (191822) on Tuesday January 08 2008, @01:07AM (#21950432)
    ...but we're going to continue to block your file formats by default on our systems. Those who want to use your file formats will need to go through the MicroSoft KB and find our designated fix for it, but we'll try to make that easier to use. Have a nice day!

    Chris Mattern

  • Heh (Score:5, Funny)

    by hyfe (641811) on Tuesday January 08 2008, @02:11AM (#21950742)

    A file format isn't insecure it's the code that reads the format that's more or less secure.'
    Secret Passwords.txt

    My father has that in his My Documents-folder. It contains secret passwords.

  • Next up (Score:5, Funny)

    by Plutonite (999141) on Tuesday January 08 2008, @02:35AM (#21950836)
    Chuck Norris gets beaten up by the leave-britney-alone kid, and Bruce Schnier gets r00ted.... by Martha Stewart! Social engineering.

    Because in Soviet Redmond, the chairs fear YOU!

    Seriously, MS has apologized. To a competitor. On a technical subject. Holy friggin WOW. Since god now obviously exists, here's what I'm going to be praying for over the course of the next few years:

    -Physics grant gets awarded to grad student who does not have lips wrapped tightly around String Theory schlong

    -Dell admits that their computer cases are uglier than your face.

    -Apple fanbois shut up. For good. (and I'm typing this on a macbook pro)

    -America elects a Good president.

    -Myspace creators realize the magnitude of their crime against human civilization and turn themselves in to local authorities.

    -I stop wasting my time on slashdot.

  • Notice the wording (Score:5, Insightful)

    by Svenne (117693) on Tuesday January 08 2008, @02:38AM (#21950846) Homepage
    When he's talking about Corel's file format it's ok to say "insecure," but when it comes to MS Office it's suddenly called "less secure." Wouldn't want to give the wrong impression now, would we?

    • Re:Business as usual (Score:5, Informative)

      by mr_mischief (456295) on Monday January 07 2008, @08:29PM (#21949060) Journal
      Nah. Just 4 months.

      The blocking of the file formats was from September's Office 2003 Service Pack 3 update. The KB article was probably issued the same time, but it was edited yesterday (and the MSKB doesn't show the original date, just the last review date and the number of times edited).

      The apology was yesterday.

    • Not many people use WP, but I use both and WP is still better than MS Word.

    • Re: (Score:3, Informative)

      by RuBLed (995686)
      It seems that the extension in question was the .cdr extension used by Corel Draw.

      But it was Corel that publicly squawked when it realized Microsoft had blocked its .cdr file format -- still used by its CorelDraw graphics application -- in last September's Office 2003 Service Pack 3 update.

      If you ask me, Corel Draw is one good drawing tool, a good partner for Adobe Photoshop. (I'm not a pro at these tools, I just stumble upon them when I rarely need it...)

    • Re:Microsoft apologized?! (Score:5, Insightful)

      by corsec67 (627446) on Monday January 07 2008, @09:01PM (#21949214) Homepage Journal
      At this point it doesn't matter if they apologized, the damage is done: opening older Corel documents in Office 2003 is a PITA. Apologizing just gains points with the CTO type people, so there really isn't a downside. Too bad it doesn't dawn on them that before MS was letting them use a "less-secure" method of opening files....
    • I suspect it's simply that Corel's lawyers sent MS a friendly letter threatening a lawsuit for the claim, and MS realized that 1) it's not worth fighting over, and 2) they would look like idiots if they tried to defend their statement, and they don't need that right now. Further, I doubt they framed it as an "apology". That's Slashdot's doing. More likely they just quietly issued a little statement saying they erred in a previous claim.

    • Nothing Worth Selling (Score:5, Insightful)

      by WED Fan (911325) <akahige&trashmail,net> on Monday January 07 2008, @09:22PM (#21949322) Homepage Journal

      Hope you didn't lose any sales.

      Uh, sparky, the assumption that Corel has anything of value to market and sell is a bit of a stretch. They have so mismanaged the brand that it is almost criminal what they did to their office products.

      I was a big time WordPerfect user. I tried to stick around through their sale to Novell and lack of effort from them. Later, sold to Corel, the company sat on it and did nothing allowing Microsoft Word to over take it and take over Office Suite dominance. This is what turned MS into the big monster it is now.

      Corel should be apologizing to the world.

      They took a great product and took a dump on it. This would be like DC turning the Superman franchise over to Alexander Salkind...oh, wait, they did.

      • Re: (Score:3, Interesting)

        by pimpimpim (811140)
        I guess they realized it would be a lost cause fighting against Microsoft Office, throwing away developer time. Then again, if they would have endured and realized back then that the eternal reign of MS Office could be overthrown, they might be growing by now, at a time where switching from office** to office 2007 is just as hard as switching to another suite, and with a current public and political outcry for open document formats.

        The first thing I used after wordperfect 5.1 was Lotus WordPro, since it c

      • Re: (Score:3, Interesting)

        by gaspyy (514539)
        Unfortunately it's not just their office.

        Corel's flagship is CorelDraw, which is a actually a very capable illustration software.
        Corel Draw and Corel Photo-Paint used to be on par and sometimes above competitors' products (Adobe Illustrator, Macromedia Freehand; Photo-Paint was at least as capable as Photoshop in 2000).

        They stopped innovating. The last Corel Draw suite was released in 2005 (they issued 2 service packs). Photo-Paint remained untouched for years, now lagging behind Photoshop in many areas.

        Suc

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.