Microsoft on Security: We'll Break Your Apps 609
jointm1k writes "Wired.com is running a story about how Microsoft is trying to act responsible and all by fixing (or trying to fix?) many (if not all) security holes in Windows. Not only new versions of Windows will be patched or improved, but as I understood they also plan to force security updates for older versions of Windows down peoples throats. Even if that means that some applications will mallfunction.
Nice to see Microsoft taking reponsibility for their mistakes, but they really should have done so when they designed Windows."
Rock and a hard place (Score:5, Insightful)
Whiners (Score:5, Insightful)
Now the submitter claims that "they should have fixed them when they designed Windows." What kind of fucking bullshit logic is this crap? Do we piss and moan that Linus is a stupid mangina because the virtual memory in the early 2.4 kernels was fucking trash?
Get with the fucking program: MS isn't *all* bad, and they are not 'forcing upgrades down people's throats." It's still your option to have a shitty, fucking security hole laden sloth of an OS.
Damage control. (Score:5, Insightful)
What? (Score:5, Insightful)
Say that again... (Score:3, Insightful)
Bugs (*aheam* features) and Security flaws are not intended to be part of the package. They happen because of bad design and bad coding practices and bad decisions. And no matter how hard you try (and try as you may even in the case of Linux) its impossible to do so during the design or coding time.
I would applaud this effort to force it down the throats of customers (atleast it would reduce the number of vulnerable servers sitting out in the open), but it goes only as far as any user would want to.
Silly aside (Score:4, Insightful)
Still won't change virus compatibility (Score:1, Insightful)
The more holes they patch the more holes they open.
This new strategy is to break competing software
.for christsake (Score:4, Insightful)
What os didn't need security fixes after it was released?
There going with the times... (Score:5, Insightful)
I think you have to remember that Microsoft used to put functionality before security. There is a tradeoff between functionality and security. For example, do you allow mailing functionality within the VBS language and the macro language? There is a reason why there are over 20 worms that can spread using MSN messenger, and none that can spread using Yahoo messenger.
However, times change, and people change. Now people put security before functionality. Microsoft is just going with the times...
Security has to be part of the foundation (Score:3, Insightful)
Re:Whiners (Score:2, Insightful)
Re:Microsoft and Linus (Score:5, Insightful)
My take on this "impractical". A new version of OS comes out in every couple of years, and in near future I can expect it to be every year. Now that means shelling out money on new, improved version of apps and systems. Let me tell you there are people still using win95 and very happy with it coz it still works. Tell them to upgrade every year and shell out $500 a year on system. They'll just smile at you and say -"boy are you out of your mind, no way"
Re:Life of Brian jumps to mind... (Score:5, Insightful)
Nice to see Microsoft taking reponsibility for their mistakes, but they really should have done so when they designed Windows."
I mean, come on. When they do something right, you just GOTTA change it around to make it a negative. And you wonder why MS is after Linux, right? Who's being childish now?
I'd really like to know how many lines of code the submitter even wrote if he is naive enough to think that MS architects would design the perfect OS from the start.
Re:Microsoft and Linus (Score:4, Insightful)
But if the apps are purchased, that is a bit much to swallow. Of course, if MS has service packs that fix the broken apps, then I guess it would not be so bad.
the fact of the matter is (Score:2, Insightful)
Re:Rock and a hard place (Score:2, Insightful)
Removal of a Linux adoption barrier (Score:5, Insightful)
If a company is looking at redoing an application for the windows base it may just be easier for them to make it work with WINE than with the new windows code base.
I am sure Microsoft is aware of this. There must be some really big holes they are going to close with action or they would not consider dropping the support for legacy applications.
Look, I don't want to state the obvious, here, but (Score:3, Insightful)
Next you'll be criticizing the quality of the beef at McDonald's.
Most Americans want to surf the web, download MP3s, and spend $2500 to watch the Matrix DVD on a two hour flight, and they'll pay the same amount for Windows whether Microsoft makes it secure, or not.
Bill Gates is a smart business man. Microsoft is a successful business. As such, the $ is the bottom line. Analzying their products from any other perspective is a waste of time.
Enough! (Score:5, Insightful)
Every vendor Microsoft, Apple, Sun, Red Hat, Debian can create an incident where a patch breaks a vendors application.
I've personally seen it happen with 4 out of the 5 vendors already. Deal with it. AFAIK there is still no forced patching. Your OS doesn't just up and DIE if you decide not to patch your OS because you are aware that patching will create problems for you.
On another note - Certainly Slashdot leans a little left politically and leans a lot toward "open solution" computing but everything about this story just reaks. "windows-ain't-done-while-competing-apps-still-ru
Give it a rest. Your just starting to look foolish now.
NNYYYYEEEAAARGHHHH! (Score:2, Insightful)
AAAARRRRRGGGGHHH! You know, people went DOWN in that freaking airplane, went down and smashed into the ground and died and burned up. And I am SICK TO DEATH of now hearing the phrase used to hawk and shuck and promote every kind of consumeristic bullshit and political jingo. Can we pass a consititutional provision to the First Amendment that you aren't allowed to use the phrase "Let's Roll" in public unless you're actually about to confront terrorists on a hijacked plane?
Re:Whiners (Score:5, Insightful)
Oh it's on now
We're bitching because their extremely late fix breaks non-shitty apps that were coded to the best of coders' collective abilities with the docs and design microsoft presented at the time.
"They should have fixed them when they designed Windows" is no bullshit logic. Many of Microsoft's security problems are not simple bugfixes, they are serious design flaws, which are irrepperable without breaking userland in bad ways. Nobody "moans that Linus is a stupid mangina because the virtual memory in the early 2.4 kernels was trash" because it got fixed without changing the interface to userland, so it didn't break anything to fix it. The overall big picture of linux's VM design from the apps' point of view was correct all along, there were just implementation bugs in early 2.4 that got fixed later.
Get with the fucking program: MS IS all that bad, and they *are* forcing upgrades down many user's throats because of the way updates, the EULA, and customer legal obligations interact.
I will agree with you on your last sentence though.
PPRR (Score:4, Insightful)
I'll buy it that they really care about this stuff when they start building software over previous security-related experience, and I'm not talking patches here, I'm talking OS re-writes based on what works and doesn't security wise.
ONce Again (Score:4, Insightful)
No they shouldn't have. Can you imagine the problems with Windows 95, if they would have put tight security on it.
Inexperienced computers users would have throw their hands up in frustration(why can't i install this program!, why won't the printer install! I forgot my password) why do i have to add a new user).
Most people just want to get e-mail, surf the web, run quicken. As users starting demanding more(functionality, security, stability) they will switch to a different OS, or MS will have to improve. Which it seems they are trying.
Windows has plenty of room for improvement, but statement seems a bit of a reach.
lets not be illogical monkeys throwing poop! (Score:1, Insightful)
- make drastic fixes for security that by way of plugging up the gapping design flaws will break many machines that rightly used those flaws (back when they were features)
- leave the flaws in and have a sorta working and insecure machine
It is correct to say that Microsoft should have actually not designed crap. It would also be right to muse that if MS had put more into Engineering solutions instead of what was put into marketing, legal and making things break (remember the mantra from the DOS days, "DOS isn't done till Lotus doesn't run")These things are a definite reflection on the ethics and values of MS, much less their committment to consumers. However, now that is the reality so what are you going to do? Myself, I take this as either an "about time" change in strategy, or could take it that they are only concerned about quality when legal liability is involved. Personally, I just don't trust them based on there track record. However if I had to support (and admittingly I don't) Windows users who wanted security... then I would probably see about testing what breaks and why. Somethings may not be as hard to find work arounds. For example, if some internal pathway or routine is rerouted or castrated causing anything that depends on it to die... then perhaps the shared library that uses that could be rewritten and released (by MS). In cases of hard coded (to which I say, you TOO are learning a hard but necessary lesson about proper software design) pointers to things that will soon push up daisies then I suppose some emulation or redirection layer could be implemented... but still that is an ugly fix.
As someone who often has to work on MS boxes (I am typing this on one at work, sadly) or has to develop things for them (I like to refer developing for MS platforms as a thousand dollar effort for a temporary tatoo on your lungs... it hurts like hell, is very invasive, very expensive, requires a crap load of recovery time where risk of infection is massive yet is not only temporary but NO ONE will ever see it.) Optimizing software for MS platforms is kind of silly considering how the crapware they incorrectly refer to as an OS only cuts the apps throat. I say save money and just hack it together! </sarcasm>
The submitter is coming off as the very thing that no one wants (except for kiddies) and that is a poser zealot who really lashes out at others while looking over his shoulder to make sure it is making him look "cool." I thought we were slowly moving away from that crap! Michael should show a bit more maturity when reviewing then posting submissions.
Wait a minute...? (Score:2, Insightful)
Re:NNYYYYEEEAAARGHHHH! (Score:2, Insightful)
Re:Rock and a hard place (Score:3, Insightful)
Now, the flak from Nimda, melissa, et. al. have begun to impact thier market share (or thier internal analysts believe the market will follow that trend), and they have started to give lip-service to security.
But they still can't alienate that customer base they spent 20 years numbing into ignorance. Will we see real security? Not for long time. Will we see secure "wrappers" around the inherently insecure MS offerings? Yes, but I guarantee there will be ways to disable them immediately if it impacts revenue.
BTW, there's nothing wrong with a company's management considering market growth and revenue when making decisions. Decent people do, and temper it with service to the greater community, morality, and improving the lives of thier employees and customers. MS operates as though all of those issues are served by the marketing department.
Couple of things.... (Score:4, Insightful)
The story never mentions *how* they plan to force users of older systems to patch and upgrade their security. As has been the topic of many a comment, the biggest problem in security is an admin/user who doesn't patch. If they haven't been able to get people to patch in the past, how do they think they can force a win95 user to patch their box now?
The best they can hope to do as far as *forcing* upgrades is making the automatic "microsoft update" manditory and non-removable. Imagine the uproar...
Second, a reality check...you will never squash all bugs. Software is a dynamic beast, especially when it comes to operating environments. As the systems grow and functionality increases, so do the chances for bugs. It's a simple fact that the more lines of code you have, the more bugs you have. Microsoft is as able to squash all bugs in all their software as any *nix system is to fix every single bug in theirs. It just isn't going to happen...no system is perfect.
"Nice to see Microsoft taking reponsibility for their mistakes, but they really should have done so when they designed Windows"
I particularly liked that part...as the current incarnation of the internet did NOT exist when the first versions of DOS came out. Heck, most people didn't know what a dialup was when 3.1 came out. Early MS systems were never designed to be multi-tasking, let alone multi user, and therefore never needed security...it simply wasn't thought necisary. If the computer is going to be used by one person and not connected to the net (such was the case in the early 80's), then why include extra usless security code? The same design base was used and simply extended to maintain backward compatability as time progressed. Thus MS saying that their design is fundamentaly insecure...because it didn't HAVE to be secure in the early days. After all, it's easier to expand than re-write...especially if you do want to backward compatability.
As I see it, the sins of the past are more about business practice (which is abhorent), than it is about software design. After all, they have migrated their new OS's to a fundamentaly NT based system, and have increased security and stability in the process. I'm not saying they don't have a ways to go, I'm just saying that it is better than it was.
In anycase...I'm happy with debian, so I don't care what they do for my sake. I hope that something good comes of this so that my parents can get a more stable and more secure OS...
-Frozen
Re:Life of Brian jumps to mind... (Score:3, Insightful)
Not so. (Score:2, Insightful)
Microsoft's reputation for intentionally breaking competing applications is based on well-documented incidents where Microsoft added code specifically for this purpose.
Most recently (about two years ago) Microsoft added a "Security Update" for Outlook supposedly to protect users against viruses. It also broke a lot of applications that did things like synchronize with a PDA, at a time when Microsoft was focused on competing with Palm. The security update could easily have been designed to prevent this side effect.
Based on its ruthless history, it is entirely reasonable to expect that Microsoft will once again use its control of Windows to sabotage competitors products. It is not Microsoft-bashing to judge a company based on its past behavior. Microsoft has only itself to blame for developers' suspicion and hostility. A company that plays nice 95% of the time and plays dirty tricks 5% of the time is still going to be mistrusted *all* of the time, and rightly so.
Re:Designed (Score:4, Insightful)
What's going on with the editors lately? (Score:3, Insightful)
Okay,let's be serious for a moment, guys. There was this week when you had 10 stories from new planets being discovered that probably would lead everyone to "rethink what they know about the universe". Then you had the week of nonsense "ask slashdot" questions. Now we're getting to a point where Slashdot is ceasing to be "News for nerds" go turn into a MS bashing forum. I mean, from "News for nerds" to Linux advocacy to MS bashing, what is this turning into?
Can't you guys be scientificaly honest? These are complex subjects and it's not a question of "wanting" to design a good OS, it's a question of complexity in designing a good OS. Or are you guys just trying to look cool to your friends with that 'anty-MS' stance? Take a look ate the usage logs on Slashdot visitors' OSes. Then come back to tell me that the vast majority is at work and is forced to use Windows. I'll just laugh
I would gladly pay a disuation fee to discuss on slashdot. Wasn't there an ideia like that sometime?
Re:Microsoft and Linus (Score:5, Insightful)
True. However, if the userland apps are written properly using a sufficiently high-level language, even C, and using standards-based and/or portable APIs, then kernel changes should break only the invervening abstraction layers. Download the updated API or whatever (not much effort), and the huge amount of effort that went in to the userland app is preserved.
This is why I feel so sorry for people who write applications using Windows-only or UNIX-only or whatever-only APIs, when there are portable ways of doing things. Taking standards documents and black-lining the parts that aren't implemented on all the target platforms (thus achieving the lowest-common-denominator) goes a long way towards producing an application that will tolerate volatility at the operating system level. And, really, it isn't much effort for an important piece of software (and a week or two sifting through documentation will only improve the end product, trust me).
And guess what: even the lowest-common-denominator is usually very useful and sufficient to meet the requirements for the software. People who whine otherwise are usually the eye-candy babies who demand using all the nifty Internet Explorer extensions to make dancing mouse trailers and other garbage (for example).
The only excusable applications are those written before truly portable APIs came around. For example, old UNIX apps written with Motif should be forgiven, because Qt, Java Swing, and other fairly recent APIs weren't available. But new applications? No excuse at all.
Re:Life of Brian jumps to mind... (Score:4, Insightful)
In a perfect world, operating systems would be perfectly interoperable. 100% compatible operating systems don't (given less than a minute of thinking, at least) strike me as a very lucrative market. Why buy a particular OS when you can do the same with the others?
And, to continue my downward spiral to flamebaitdom, let's address the "...and deal with product activation and force DRM down your throats." What is the big deal about product activation? You fill in the form, which only asks you what country you're from (the rest is purely optional, at least on my install CD's) and hit the submit button. That'st he end of it. I've installed WinXP on two desktops and one laptop with this CD and haven't had the MS storm troopers come knocking on my door yet. As for the DRM technologies, so far I have felt no impact from them. While it does apparently exist in Media Player, there's a simple solution around that, don't use Media Player to rip your CD's. I use this marvelous little program called CDex [n3.net] that does a one-stop rip from CD to MP3, Ogg, or any number of other formats. All DRM-free, plays on any computer with the proper codecs. Windows is not forced DRM-land yet, and personally, I doubt it ever will be. Right now we're hearing scares from the 'for the people' organizations about how horrible the future will be and that all this is being pushed through the system without opposition. Believe me, the instant the average consumer is impacted negatively by this, the backers of whatever measure that struck a nerve will be forced to back off.
Good day.
Re:Life of Brian jumps to mind... (Score:2, Insightful)
Microsoft needs to earn my trust, I will not just give it to them.
And yes, I most certainly will give them the chance to.
Reminds me of a Chris Rock routine... (Score:4, Insightful)
But this story reminds me of that great Chris Rock routine. (paraphrasing, and substituting the N word)
People always want credit for something they're supposed to do.
I ain't never been to jail. What do you want, a cookie?!
I take care of my kids. You're supposed to you dumb motherfucker!
So yes, while it is good that MS is doing this, I think that it is no big deal - they should do it. I am not going to praise them for it, this is what they should have done long before now. I am not going to rail on them either, because they are making some kind of effort. Assuming that they actually do what they say they are going to do. Sorry, but they have a bad track record, I am not going to believe it until I see it. Why am I skeptical? Among other things, I have seen the Win2kSP2 EULA. I wonder what the EULA on these new security patches will look like...
Re:Microsoft and Linus (Score:5, Insightful)
Microsoft lives on the income from OS/Office upgrades at least as much as from new installs.
Why this is good, why this is bad. (Score:3, Insightful)
The good is that Microsoft is finally going to fix their problems. It's about damn time. The bad is that Microsoft is spinning this thing as if they weren't greatly responsible for the mess they are about to inflict. IMHO, and it is only that, if Microsoft spent more time and resources on testing their crap in the first place instead of pushing it out the door then perhaps so MANY holes wouldn't need to be patched now. There will always be bugs and security flaws but Microsoft as made releasing filth and spinning it as if it were a good thing an art form in itself.
As always, this is just my opinion. Your milage may vary.
Re:At least it appears they are trying (Score:2, Insightful)
As long as it isn't on purpose... (Score:5, Insightful)
A security patch on any OS could potentially cause problems with software that runs on it. However, it wouldn't put it past me for Microsoft to purposefully make sure that competing products are broken.
At best case, MS isn't going to purposefully break anything. This is a legitimate attempt to fix security.
At worst case, this might Microsoft's first step in "testing" the strength of the court to see if they'll notice/tolerate them purposefully breaking applications and then claiming they can't release the fixes to the application maker because it is part of Windows "security."
Its always the same trade off (Score:3, Insightful)
So, <paranoid disclaimer>whatever Microsoft is implying when they say that they will break applications</paraoind disclaimer>, it is always "Give me convenience or give me security" (Kudos to these fine guys [deadkennedys.com]), otherwise we wouldn't use passwords, encrypted authentication and other inconvenient stuff etc. "Why not just skip all these logins? They make my brain hurt from all the stuff I need to remember..."
So again, either you demand more knowledge, responsibility and work from the user, or you leave all the necessary security decisions to the software... There is a lot of reason for criticizing Microsoft in many ways, but I think its quite unrealistic to ask for ultimately convenient, ultimately secure software simultaneously... Consequently, either bash them for being insecure or for giving up convenience, please don't do both at the same time, because that doesn't seem to make much Sense(TM) to me... .)
Comes the Real Wolf (Score:2, Insightful)
All this talk of breaking apps and seemingly shoving things at people is justifiably worrying to many.
And now that the real wolf has come, its hard to decide if Microsoft is really pointing it out or if they're trying to fool us all again. This is what they have sewn and so they reap it now. Many distrust them and will continue to mistrust them until they show that they are trustworthy once more.
This is their chance to show everyone that they can be, if not perfect, a moderately upstanding company rather than a domineering bully. I'll be watching them. And I'm sure many more will be as well to see if they can woo back the skeptical.
Re:Life of Brian jumps to mind... (Score:2, Insightful)
Another point is that the updates aren't fixing bugs, they are creating them, in a way. The security holes that, for the most part, have been plugged by other methods, that are being fixed may end up breaking a number of other programs. That's not a good reason to update your software. You should update software to make it work better with all the other software, not necessarily just to update. If your 0.0.1 kernel works for everything you need to do then you have no reason to upgrade.
I think that its good that MS is fixing the security bugs, but they should not fix them if it breaks other programs. That would force other companies to adapt to rewriting the software (can you say monopoly?). That's akin to changing the roads to rails and expecting the people to get their cars adapted or whatever. It's not the best analogy, but it's close.
Unfortunately, we may have no choice but to accept their updates and patches and hope that they are smart enough to not break too many other programs, or at least provide work arounds.
$0.02
What of End-User Responsibility (Score:3, Insightful)
in the nema of security (Score:2, Insightful)
Example: See latest EULA changes introduced in service pack which is (or was) supposed to plug security holes.
So to add some speculations: This other stuff will be things which will be good for Microsoft, not users (or good also to users, as side-effect). Like DRM, auto-updates, spyware, slow-this-machine-down-on-demand-so-this-luser-buy s-new-machine(TM), etc. :)
As long as there's no DRM packaged with it... (Score:5, Insightful)
Re:What? (Score:3, Insightful)
If they slowed it down to a large degree *now* in order to do this, don't you think Linux and other OSs have a legitimate shot at taking over?
MS will do whatever MS decides will let it maintain its position in the marketplace, and God bless them for it.
Re:Rock and a hard place (Score:3, Insightful)
According to everything I've ever read, and my own personal experience, Windows' security holes have absolutely nothing to do with the creation or popularity of Linux.
I don't use Linux to avoid using Windows. I use it because it's the best thing available.
WERE they happy and willing? (Score:1, Insightful)
oh yeah, here comes the 'battleship macintosh', which can only carry 15% of the island population off at a time.
Microsoft SUCKERS.
let's try to be fair (Score:5, Insightful)
Now if the article was more like "Microsoft breaks apps to implement security, offers expensive upgrades" then we could continue kicking M$'s family jewels guilt-free.
Re:Forced Security update = Forced Application upd (Score:3, Insightful)
Why should they let these vulnerabilities, some of which can be used for massive digital attacks, continue to exist in a product with their name on it? And it's not going to "render everything useless," Mr. Hyperbole.
When you have your computer connected to the internet, it is your responsibility to make sure you don't do any damage with it - intentional or not. Too many people have ignored that moral/social obligation.
Think of it as a Digital Emissions Inspection. If your old car can't pass modern emissions regulations, but you want to still drive it, you'll need to replace some old parts with new parts, and those repairs aren't guaranteed to be cheap.
What if people had a wireless phone that, due to age and poor initial programming, started jamming all other wireless signals within 500 feet. Is it fair to let these phones continue operating, just cause they were able to many years ago? Of course not. The FCC or some agency would recall/outlaw these phones. Well, computers are approaching that level of potential for damage, in that compromised systems can easily be used for massive DoS attacks that can seriously disrupt large networks. Software developers and users have a responsibility to do their best to make sure this does not happen.
Everyone complains about the security problems in Windows, and have derided them for it for years. So when Microsoft trys to own up and fix the problems, 3rd party application developers should do their part and follow suit.
Re:What's going on with the editors lately? (Score:5, Insightful)
One or two Microsoft stories are published everyday, no matter how insignificant the news is. Even if the news is a good thing, typically the submitter of the story puts a negative spin on it (like today's submission). Of course everyone jumps in and bashes away, not only at Microsoft, but at anyone who tries to speak positively about Microsoft. It doesn't do well to encourage intelligent discussion--anyone who is happy using Microsoft products and speaks up about it around here quickly becomes bitter and defensive. Or they leave.
Slashdot nowadays is quite similar to the media in the middle east. My grandfather lived in Dubai for 8 or 9 years, and he was amazed that the newspapers had an article about "The Jews" on the front page, every day. The Dubai media never referred to Israel. "The Jews" were always killing Muslim children, subverting the government, doing-random-very-crappy-thing, etc. The media was breeding hate among the people.
The big difference between Slashdot and Dubai is that the Dubai government was intentionally making people hate to distract them from shady things it was doing, and Slashdot's de-evolution is (probably) not intended. It definitely seems that the editors have got some bug up their ass about Microsoft, but I think they're just publishing what kicks up the most response rather than trying to fan the flames.
I think it's because Slashdot has become the epicenter of a pro-linux geek subculture. In this subculture, it's cool to hate Microsoft. Folks want to fit in somewhere, so they come to Slashdot and bash Microsoft.
Linus said in this interview [bbc.co.uk]:
"I've tried to stay out of the Microsoft debate. If you start doing things because you hate others and want to screw them over the end result is bad."
I don't think he hates Microsoft. He likes Linux.