Microsoft Microsoft Microsoft 723
Your day wouldn't be complete without Microsoft news. Ralph Nader has written an open letter to Judge Kollar-Kotelly. Seems he has a few bones to pick with the settlement. MSNBC is running a WSJ article detailing how Microsoft beat down the DOJ in settlement negotiations. Even Israel knows Microsoft is a monopoly. Microsoft reveals its keep-them-in-the-dark plan for Microsoft security vulnerabilities. Amazingly, some security firms seem to be willing to go along with it. I guess they figure setting up a sort of cartel for security flaws is in their best financial interest. SANS is keeping their list of top security vulnerabilities up to date with the latest IIS exploits. And finally, MS wishes their new disclosure rules were used for yet another huge hole in Windows. Microsoft says it's "irresponsible" to expect them to get a patch out for a critical flaw within "a few days". As usual, switch off active scripting, even though that will make essentially every webpage that's designed for IE not work.
You know what I find funny? (Score:3, Insightful)
webpages designed for IE (Score:2, Insightful)
If MS security bugs encourages web designers to design gracefully degradable web pages, that's fine with me.
Of course there will be more buges reported in MS (Score:3, Insightful)
That said however, I don't care for MS and the majority of their software that I do use is out of necessity.
Keeping bugs a secret.. (Score:5, Insightful)
How are software bugs, especially critical ones, different from design flaws in a tire?
Re:You know what I find funny? (Score:2, Insightful)
Remembering whom you are talking about should explain why they don't send this out. If they really had some competition they'd be letting you know, post haste. Ah, well, another reason why they should have been broken up for the good of the economy which wasn't done for the good of the economy.
Yours.
Theirs.
Re:Fixes for your M$ woes. . . (Score:0, Insightful)
If you have no sensitive data in your cookies (and you shouldnt anyway, come on, common sense), you've got nothing to worry about.
As for the "dont use windows if you dont have to"
Re:that last one is NOT a hole in windows. (Score:5, Insightful)
Unless... *gasp* you're calling Microsoft a liar and telling us that IE and Windows are indeed two separable products?
They could learn from Apple... (Score:5, Insightful)
Pardon my french, but *bullshit*.
Apple released iTunes 2.0 on a Saturday night. When a major bug was found, not only did they pull the installer *immediately*, but they fixed the bug and had a new one up in its place (properly labelled 2.0.1) within 24 hours. Not only that, but they have also said that they will pay for DriveSavers recovery for anyone who lost data to the bug. Can anyone imagine MS responding that quickly? On a *weekend* even! (Or accepting responsibility for its bugs like that?)
Let's not be the pot calling the kettle black (Score:4, Insightful)
It is proper for us to reject Microsoft's attempt to keep its bugs secret. But this means that we must also reject Alan Cox's attempt to protest the DMCA by withholding discussion of security holes in Linux, under his false belief that the DMCA somehow forbids such discussion. We need to openly discuss our bugs. Otherwise we are, in effect, supporting Microsoft in their effort to stifle discussion.
Yes, the DMCA is a bad law, but it's not infinitely bad. It does not forbid discussion of bugs or circulation of patches for bugs; claims otherwise are based on confused readings.
From Ralph Nader's Open Letter (Score:4, Insightful)
MS Rallying end-user support? (Score:4, Insightful)
The person who discovered this vulnerability has chosen to handle it irresponsibly , and has deliberately made this issue public only a few days after reporting it to Microsoft. It is simply not possible to build, test and release a patch within this timeframe and still meet reasonable quality standards.
I was reading through the "Irresponsible" link, as well as the vulnerability report. Information Anarchy is the phrase they have coined to display that information really doesn't want to be free. This, if successful, will cause a very adverse association to open source developers I think. If they "edjucate" their end-users into thinking that information should be tightly controlled by a centralized source, than it's easy to make the connection that the open-source community is villifying the information management structure that Microsoft and friends is working so hard to manage for the best interest of the consumers.
They claim it's not feasible for them to release a patch within 5 days. Why do I have a feeling that this code segment is probably less than 50 lines, hell - you could provide a hack just to filter malicious URLs in less than that and release that patch in well under a day or two without sacrificing what we all know as Microsofts high standards of quality.
Maybe I'm paranoid, but it seems this is a much larger tactic towards a revised SSSCA that will be in Microsofts best interest - much easier to add a clause saying it's illegal to release unauthorized security information about a companies product to an unapproved bill.
Re:You know what I find funny? (Score:5, Insightful)
MS's windows update is a step in the right direction, but it sucks compared to Red Hat's up2date [redhat.com] program. It's a service that is well worth paying for. Even if you just download the Red Hat ISOs, consider subscribing to RHN [redhat.com] - you are supporting future Linux development and are getting a good service at a fair price. [Disclosure: I own RHAT stock]
Re:Of course there will be more buges reported in (Score:5, Insightful)
Re:Nader has credibility (Score:2, Insightful)
It strikes me how much we all seem to be recognizing that the courts now operate based on their political leanings instead of the foundation of law.
Re:It's not a security flaw (Score:2, Insightful)
How about when sircam started e-mailing random documents to anyone in the address book. I got a load of random files for absolutely no reason at all. An inadvertant spam.
Just because you don't use Microsoft products doesn't mean Microsoft products can't be used to attack your machine(s). Indirectly, your still effected somtimes.
Re:As a former "black hat" (Score:1, Insightful)
one of the things that MS doesn't grasp is that a hole exists even when you don't publicize it, and if someone has pointed that hole out to them (presumably a grey-hat), they will share that information with some of their friends. geometric growth of exposure follows. with full disclosure, admins (even those lacking the skills/source to fix the problem) can mitigate it, pull systems down, turn off vulnerable features, or *gasp* consider alternative solutions.
Re:Of course there will be more buges reported in (Score:3, Insightful)
On another note, I'm not sure that Microsoft has any grounds for demanding to be notified about flaws in the final releases of their software. If they want to keep bugs from becoming huge public brouhahas, then they should either fix them in-house while the software is still beta, or open the source up and let other people actually fix it. They're out of line to say that people should find bugs in their ware, tell them, and then sit on their discovery while some cubicle slave works to make a patch, and Microsoft takes the credit for saving the day.
Re:Of course there will be more buges reported in (Score:4, Insightful)
Of course, it's not as simple as saying that MS sucks, but it's a combination of bad design (dont put everything in every program, dont have unlimited interoperation between everything) bad programming(dont use admin privilidges if not absolutely necessary, also a design issue maybe), bad installation policies (dont install everything or even anything but the basics by default), bad admins and bad will.
The combination of these elements end up in software you dont want to be running because it will stink from a security point of view.
So, no, you wouldnt have the same amount of problems on Linux at least. You'd have problems, yes, but not nearly as many. Unless, of course, the general policies among linux distribution vendors change to install everything insecurely by default, but hopefully that wont happen, and in the Linux world you can always change to another vendor if one of them goes seriously astray.
Hard to get a patch in a few days?! (Score:3, Insightful)
Re:Of course there will be more buges reported in (Score:5, Insightful)
Also, MS software is integrated on a large scale without sufficiently restrictive interfaces to cleanly separate it into individual programs. Since the number of potential bugs in a program grow faster than the length, this makes such integrated code more likely to have bugs; and, in fact, many MS bugs are due to interactions between different projects. With the Linux model, code is in relatively small chunks, which communicate over limited interfaces, so there is much less opportunity for cross-project bugs.
So I think that, to a certain extent, the reason that there are so many MS bugs reported is mostly that there are so many opportunities for MS to make mistakes, due to their size and the architecture they have chosen.
Re:Oh really? (Score:3, Insightful)
Yes, you can get a patch to kernel 2.foo very quickly. But it can take weeks/months for RH to get a package out. Perhaps M$ can get the code fixed, but not quickly send out a package (and in some ways they do. They send out hotfixes, and only later service packs).
Why? In both instances, the companies have to make sure that by fixing one problem, they don't create several others.
So yes, you can get quick fixes to Samba, the kernel, etc. But it takes time for commercial vendors to roll out the patches.
(And, having said all that, I used to use Progeny, and am switching to Debian. They get out patched packages really damned fast.)
Re:From Ralph Nader's Open Letter (Score:2, Insightful)
You and all of your fellow Gore voters should have voted for Nadar.
What I just said is along the same lines of what you told us.
Just so you realize, it's not democracy if you say "You can vote for him or him, but not for that guy."
Ass.
Re:You know what I find funny? (Score:5, Insightful)
Just my $0.02
EFGearman
---
Re:You know what I find funny? (Score:5, Insightful)
What is it exactly that you're so baffled by? Just because you've never seen them only shows your ignorance, since they've been sending these out for years now. As far as being in an obscure place, where would you expect to find it? I always use the direct link to the bulletin list (www.microsoft.com/technet/security/current.asp [microsoft.com]), but if I didn't know how to find it, I think I might try www.microsoft.com/security. And whaddaya know, there's a web page there and the second link on the left is for the Security Bulletin service. How obscure. *ahem*
Re:From Ralph Nader's Open Letter (Score:3, Insightful)
And to think that most of the Neanderthals on Slashdot still think it the height of humor to castigate him as a loon. I don't want to be a troll, but I find it the penulimate irony that people who can wax rhapsodiacally over RMS bitch about the one nationally recocognized politician that seems to actually "get it" when it comes to Free Software.
The ulitimate irony is, of course, that anyone actually takes these Neanderthals seriously enough to bitch about it :-(.
I made my mistake in the last election by wasting my vote on Gore. Next time, it's Green all the way, baby...
Poetic Justice: My favorite Nader quote (Score:5, Insightful)
-----------------
The level of fines that would serve as a deterrent for cash rich Microsoft would be difficult to fathom, but one might make these fines deter more by directing the money to be paid into trust funds that would fund the development of free software, an endeavor that Microsoft has indicated it strongly opposes as a threat to its own monopoly. This would give Microsoft a much greater incentive to abide by the agreement.
Fart in a windstorm (Score:2, Insightful)
Welcome to the open market and the information age, crybabies exit at the rear...
If you want to do something about MS (Score:1, Insightful)
Re:Of course there will be more buges reported in (Score:4, Insightful)
The Netcraft survey crawls through all those little Melvin machines which each have an httpd running that nobody ever accesses.
Nobody cares about them. They are irrelevant.
Actually, it tends to go the other way - IIS installs as standard on a heck of a lot of WinNT boxen that do no hosting, and as (much as we hate to admit it here) most small businesses (big enough to have an always-on connection but not big enough for their own IT dept) use Windows. Most Apache installs are meant to be there.
Re:Of course there will be more buges reported in (Score:2, Insightful)
Microsoft's products are buggier because they are more ambitious in terms of functionality and target user base. Designing software that is only used by people with software knowledge is much easier than designing software for the general public. Creating an application that accounts for all the possible mistakes and questions that the average user is going to have is a huge undertaking. Add to that the extra functinality that M$ adds to its products (for better or worse), and it is not mystery why it has more bugs. Sure it crashes more, but is also DOES more.
As such, the idea that more bugs will be found in software if it gets wider distribution puts the cart before the horse. In order to get wider distribution, software must expand ease of use and functinality, and thus expose itself to the introduction of bugs (if it is to be released in a timely manner). However, users, as history has demostrated, care more about features than they care about bugs. Again, as history has demostrated, the most stable OS you can create, even if it is free, can not compete with an OS that includes the functionality that people want and, more importantly, is easy to use.
Re:Nader has credibility (Score:2, Insightful)
Re:Let's not be the pot calling the kettle black (Score:5, Insightful)
It is proper for us to reject Microsoft's attempt to keep its bugs secret. But this means that we must also reject Alan Cox's attempt to protest the DMCA by withholding discussion of security holes in Linux, under his false belief that the DMCA somehow forbids such discussion. We need to openly discuss our bugs. Otherwise we are, in effect, supporting Microsoft in their effort to stifle discussion.
Not at all. The way I see it, there are two things at work here.
- Cover his own ass from possible litigation from the people of the United States, represented by John Ashcroft.
- Drive a message to the people of the United States that the DMCA is a bad law, and they should seek its immediate repeal.
On the other hand, Microsoft, while their intention is also to cover their ass, it's not from litigation and legal hot water, it's from their own bad PR. Microsoft isn't even trying to seek repeal of the DMCA, for obvious reasons. Whereas Cox was making a political statement, Microsoft is just trying to censor bad PR.Therefore, it is right and consistent that we can hate Microsoft for censorship, and applaud Cox for censorship, because there are deeper levels and motives than simply censorship.
up2date is free on a small scale. (Score:2, Insightful)
so when you start up2date on a computer the first time you create a profile of that computer at redhat. you can move this seat between computers so you can still use it for free if you have multiple computers. this is nice because it cuts home users, like myself, some slack.
Great Quote from the WSJ (Score:5, Insightful)
Knowing how a security protocol works should not make it less secure. I can read how SSL works, but that does not make it less secure. Same with Kerberos, DES, RSA, etcetera. A proper security protocol should be secure even if you know how it works. Security through obscurity DOES NOT WORK.
This quote sounds like it came from Microsoft, but get this: he works for the DOJ! This guy James was the one in charge of the negotiations with Microsoft. He is supposed to be on our side.
It seems like he knows very little about computer security. It also seems like he believed whatever the Microsoft lawyers told him. No wonder they arrived a such a one-sided settlement.
Re:Of course there will be more buges reported in (Score:3, Insightful)
Okay.
Dumbest thing said in the antitrust case article. (Score:1, Insightful)
James rejects these criticisms and says the decision to protect Microsoft's security provisions was "one of those 'duh' issues." He continues: "Microsoft has security protocols. Are we going to tell everyone how they work? Do you want people to get access to your credit-card information when you shop on line?"
Umm, damn straight I want to know how they work! How else do I know if they are really secure? Trust MS? I think their track record speaks for itself on that one. Do I trust OpenSSL to keep my credi card secure? Yes, because I know how it works.
When will people learn, security through obscurity is a dead end.
Irresponsible? Conventional wisdom is wrong... (Score:3, Insightful)
Maybe so, but what I don't get is this expectation everyone has that these security holes go through the same steps...
The real danger is when someday someone will discover one of these huge gapping holes, not tell a soul, and then exploit them for profit, terror, extortion, or simple chaos.
We've been lucky so far. For Microsoft to try to divert the entire blame is what is irresponsible. Remember who created the security hole in the first place....
I'm a MS supporter, but this is ridiculous (Score:5, Insightful)
Usually, I think MS has an undeservedly bad reputation. But I can't stomach their assertion that open discussion about their bugs is somehow unethical.
From Microsoft's article [microsoft.com]:
We can and should discuss security vulnerabilities, but we should be smart, prudent, and responsible in the way we do it.
Who chooses what sort of speech is smart, prudent, and responsible? The speaker? Or Microsoft? Since they branded it irresponsible to reveal a security flaw only "days" after telling Microsoft about it, it seems obvious to me that this is a request to let Microsoft control all discussion about their security flaws. This is patently unacceptable.
If we can't eliminate all security vulnerabilities, then it becomes all the more critical that we handle them carefully and responsibly when they're found. Yet much of the security community handles them in a way that fairly guarantees their use, by following a practice that's best described as information anarchy. This is the practice of deliberately publishing explicit, step-by-step instructions for exploiting security vulnerabilities, without regard for how the information may be used.
I don't think it's best described as information anarchy. Anarchy is an emotionally loaded term, like piracy. But anarchy just means "not centrally controlled or regulated". Do we want all discussion of security to be centrally controlled and regulated? If you replace the phrase "information anarchy" with "free speech", the article becomes much more enlightening. The author seems to try to address this by saying:
By analogy, this isn't a call for people for give up freedom of speech; only that they stop yelling "fire" in a crowded movie house.
But the movie house is on fire. The bug exists - your private information is vulverable. The responsible thing for Microsoft to do is admit that they made a mistake, and work to put out the fire. Unfortunately, they've chosen to blame the messenger.
It's natural for a powerful organizion to want to surpress speech that points out its flaws. It's natural - but it should never be tolerable.
Why it takes MS so long.... (Score:2, Insightful)
A previous posted mentioned Apple with the iTunes installer nuking the hdd, and how they got a patch out quickly, implying that if Apple can do it, MS should be able to too... well, things aren't quite so black and white:
The problem in the iTunes installer was a small typo in a bash script. The behaviour of the installer script is so simple that it's fairly obvious what effects the change would make. Easy patch. If only all bugs were so easy to fix.
A relatively short while ago some info regarding few vulnerabilities in Exchange (I think it was Exchange...) were released to the public@large by some third party. MS rushes out patches and lo and behold! A fairly significant proportion of users reported serious issues after installing the patch - it was messing up other parts of the system. MS rushed out a second version of the patch, which again wasn't satisfactory. It took 3 iterations of the patch to get something that seemed to work successfully on almost every machine it was installed on!
What went wrong? The Law of Unintended Consequences reared its ugly head.
If you look at the security holes that poke up in MS stuff, they often look like they result from some complex interaction that Microsoft's developers never expected. These interactions are partially the fault of the way they seem to design their systems and partially due to the vast number of configurations they end up operating in. Unfortunately, when you're fixing a bug that's resulting from some complex and probably subtle interaction between different components of your application (or even worse: another application) then your change could have drastic and far-reaching effects.
To help mitigate this problem they do extremely extensive regression testing. Typically, before a patch gets posted it's run through some of the weirdest and craziest system configurations they can think of to make sure it doesn't break anything, and if it does they figure out why and fix it. This takes time. Lots of time!
Nader? (Score:3, Insightful)
Re:I can't read the details of the security flaw (Score:4, Insightful)
Windows Update either. Very interesting, how ironic that MS stuff is these days.
Re:You know what I find funny? (Score:4, Insightful)
Ha! According to the bulletin, the people that should be reading this are:
Customers using Microsoft® Internet Explorer
That's quite a few people. And consider the link you have to click on. Most users of IE probably don't consider themselves IT Professionals. Heck, some of them are afraid to remove icons from their desktop because it might break Windows.
You expect these people to:
1) Visit www.microsoft.com. That's the boring site. They want www.msn.com or www.hotmail.com (these would be much better places to put bulletins.)
2) Consider themselves IT Professionals. That means they have to be REALLY smart (yeah, sure).
Basically, it IS hidden, especially for people to don't think to look for these security vulnerabilities. Microsoft may consider posting these bulletins in more prominent places. However, as someone above pointed out, there are probably battles between Marketing and the Developers (developers developers developers developers....) about what to make easily available.
Re:Of course there will be more buges reported in (Score:2, Insightful)
Ah, but you see, you're not necessarily comparing apples to apples. The following could be an interesting exercies:
How many vulnerabilities from each company...
I haven't done this exercise, but I strongly suspect that it would show that MS and RH have very different views of what constitutes a "security problem" that needs to be reported & patched. I'm guessing most if not all of the MS bulletins are remotely-exploitable holes, and that most are probably not mere DoS holes. The RH bulletins, on the other hand, will have a lot of temp file vulnerabilities -- which, in the MS world, would not even be considered bugs, much less security holes.
Re:Of course there will be more buges reported in (Score:2, Insightful)
Examples include
VB scripts + extension hiding => viruses (and what-have-you).
macros => viruses.
inter-application communication => security flaw.
autoextract/running of downloaded software => general fscking up of computer.
Now, not all the features require that bad things come from them and there is definite programmer and management error. Although my description of it is perhaps unnecessary: What they need to do is demarcate all functions,methods,variables and objects that are capable of being abused as security flaws, regardless of whether the abuse could only come from within the layer of code above that method or whether it could be used outside. When the final stages of development come there needs to be an inside-out evaluation of all the possible paths that can be taken to reach those methods/functions/variables and which of those pose risks. Those risks need to be evaluated and if they find them to be acceptable risks, they simply need to mark them in their released product documentation. Of course, if they are found to be unacceptable risks then they need to reduce them in whatever manner or else provide warnings during operation that the user may hurt themselves doing whatever it is that opens that hole.
[please note that I'm not in the mood to look up terms such as trojan horse, worm, etc. to figure out where they all go, think of "virus" used above as a generic term.]
Re:MS Rallying end-user support? (Score:3, Insightful)
Uhh, no you didn't.
<I>I read the article. The difference is, I happen to know a tiny bit about programming, and you obviously don't.</I>
Yes, obviously it is so difficult to write a valid URL parser that Apache has a problem with it, and Mozilla, and hell, even Slashdot.
You want a URL parser, pick a language. You said perl here ya go (brackets ommited to appease slashdot's stupid filtering):
sub validateURL
my @ValidInstructions = (
'[^/]\.(htm|html)', ## Allow only top level that end in
);
if (
my ($req, $domain, $path ) = ($1,$2,$3);
## Lets check for user combinations, denoted by :
if ( my $userinfo = split(/@/,$domain) )
my ($user,$pass) = split(/:/, $user);
for( my $i = 0; $i < $#ValidInstructions; $i++ )
return 0
if ( $path !~
else
return 0;
}
I'll leave it as an excercise to figure out where the brackets go
So, all you need to do is add to the valid handler array, and writing reg-ex's for this is not the most efficient method, nor would I recommend it. But, it's also exceptionally easy to verify that the file is there and check the parameters in case of a dynamic page to ensure it's not a malicious intent (go read any howto-secure-a-CGI for more info).
I just spent about 5 minutes writing this out, with cold hands and all my other text. It's not far more complicated than I think it is; I'm just a good programmer. Before accusing people of how hard something is with knowing "a tiny bit about programming" find out that the person you are talking to does network development for a living. Thanks.
I'd like to take the opportunity to try to have you take a deep breath, and realize that you had no idea who I am before you started your assumption that I wasn't a programmer and just some ass-clown. I've written anything from URL validators to email validators, to pthreaded socket connection. You didn't know that though, you just instantly assumed I was talking out my ass saying that this was just such a wonderful easy idea and I just couldn't understand why they couldn't do it. It's called prioritizing of tasks, someone is in charge of this particular affected code. Whether it be in the URL validation or the cookie retrieval code (I'm not sure how IE is structured), this fix is none-the-less simple, and not an amazingly complex feat of engineering talent.
Re:Slashdot editor bias (Score:3, Insightful)
That is a period at the end of that sentence, it means there is nothing further to add. What we're doing now is what should be done.
Re:Why it takes MS so long.... (Score:3, Insightful)
So the problems that Microsoft patches cause are not solely due to 'oh, Microsoft software is so much more sophisticated and advanced!' but due to bad planning and inappropriate bundling combined with lack of disclosure of what's being altered. And it is going to get MUCH worse, not better. To cap it off, if they are able to suppress disclosure of bugs and security holes, they don't need to regression test anywhere near as hard as you seem to think they are doing- because all that will happen is that Windows boxes will mysteriously die and there won't be any publically disclosed link to connect that with Microsoft updates.
Hell, if they can truly cut off all disclosure, they can just STOP any work on security patches entirely. Who'd know?