That's probably due to the fact that Iran has never invaded another country, while it found itself attacked by Iraq without any valid justification. Back then Iraq was supported by pretty much the entire western world. I won't even go into how the CIA overthrew Iran's elected government to replace it with a dictatorship(the Shah)

End result: Iran has every reason to build up its defences. History has shown Iran that the western world's propaganda about justice and fairness only applies to them, not to other countries, that the western world will support unjustified attacks on Iran and thus they need to be able to defend themselves.

The funny thing about this article is that he essentially never mentions (a) design flaws or (b) perverse economic incentives to sell defective software. IMO these are probably the two biggest reason why MS has such a terrible reputation on security.

If you actually knew what you're talking about, you'd know that MS has a VERY GOOD reputation on security. It used to be awful, but they completely cleaned up their act these past few years and now when you talk to security consultants(IO Active, Leviathan, iSec partners, ...) and ask them who's doing a great job, the first name they pronounce is ... Microsoft

In the security world, your reputation is based on real things: the # of issues your code has, how hard you make it for people to exploit your code, whether your system is secure by default, ... not by the number of times you show up in the news, because that last one is purely driven by your market share, not by the quality of your code.

Take a look at SQL Server, compare its security record to any other database with a decent market share on the market.

So you're telling us that the installs you have done were botched and had to be redone. Why would that say anything about the quality of Windows 7 ?

Because let's be frank, if you can't keep a Windows 7 stable, you have no business touching other people's computers.

You sound *EXACTLY* like a Windows fanboy complaining about Linux because he has no clue about how to use it.

Buddy, 44% of this country voted for McCain, after 8 years of Bush, Jr. If you think Iran using a tactical nuke wouldn't push them plus a bunch of middle-of-the-road people over the edge to annihilate Iran, you're crazy. The U.S. doesn't do the "well, maybe it was deserved and we should consider our options" thing very well. We'd destroy first and consider many years afterward.

No they won't, because this would have implications in regard to China and Russia as well as pretty much the entire world, with a backlash against the US that the world has never seen before, and tactical nukes would then lose their entire value as the US could never use them again, as Russia/China would have every reason to treat it the same way the US did : massive nuclear retaliation.

The fact that 44% voted for McCain doesn't change anything, the people in power and at the Pentagon know what's at stake. They're more interested in keeping the US's strategic influence and military advantage than pleasing a bunch of republican retards

You're right. We'd sit off shore and bomb 'em back into the stone age. There wouldn't be an invasion, because there'd be nothing left to invade. If you think for one second that a nuke dropped on a U.S. army force would give the U.S. cause to sit back and rethink the whole thing, you're sadly ignorant of history.

Nope, you wouldn't even start to invade, because you know the US public would absolutely not accept casualties at that level, as no behavior from a country besides setting off a nuke in the US would justify the killing of 10-20'000 US soldiers(and more in the following years from radiation). That's the whole point of having nukes for Iran.

If Iran were to set off a nuke in the U.S. or against U.S. forces, there wouldn't be any invasion. We'd annihilate the entire country. THAT is why a single nuke isn't a deterrent to the U.S. It is a saber to rattle against Israel, but not the U.S.

You're actually quite ignorant about the strategy of your own country.
Setting off a nuke in the US would certainly trigger massive US reprisals.
Launching a nuke on attacking US forces far outside the US would certainly not, the whole point of tactical nuclear weapons during the cold war was to repulse attacking enemy armies without setting off a total nuclear war

Oh really ? Don't you wonder what is the only country besides the US to have F-14s ? Iran...
Besides that they have a number of M-60 tanks and such, far from being a small player.

The Iranian civilian airliner DID take off from a military airport and was flying damn close to a conflict area and no-fly zone.

a) There was no no-fly zone for civilian airliners
b) It was clearly a civilian airliner, an Airbus radar signature is every different from a fighter plane, bomber of even a military transport

Finally, Iran can't possibly develop enough nuclear weapons or launch systems to "defend itself" against the U.S. The idea is ludicrous.

It's far from being ludicrous, Iran has US soldiers sitting in two of its neighbours, the US has repeatedly threatened regime change in Iran, and a nuke well placed on a US army attacking Iran would have a very very profound effect on US strategy and would prevent any invasion of Iran, something that chemical weapons can't do since the US army has gear to protect somewhat effectively against that.

1) So did the US, France, UK, ... They were supposed not to proliferate, yet they gave Israel the bomb
2) Really ? The reality is that Iran never attacked another country. Want the list of countries the US attacked or helped attack ? It's quite long (Panama, Grenada, Iraq, Iran, ...)
3) They never said they would do it, they want to see Israel disappear yes, they never said they would do it themselves
4) The facility is an enrichment facility, nothing in that fact makes it military, it's still under construction and was reported by the iranians themselves to the IAEA, as they were supposed to do, so they respected their part of the contract.

The real trouble is that Iran never attacked another country, while at the same time the US helped overthrow its democratically elected government to put a dictator in the 50s and the US and the west supported Iraq's invasion of Iran in 1980 and put a complete boycott of weapons sales on Iran, not budging when Iraq launched chemical weapons at Iran.
Let's not forget that iranian civilian airliner blown out of the sky by a US Navy ship a few months after the PanAm crash, nobody can mistake the radar signature of an Airbus with a fighter plane and let's not even talk about all these imperialist governments in the US who keep talking about regime change in Iran and other countries they don't like.

So really, Iran has every reason and right to get nuclear weapons to defend itself, because the past has proven that western countries really are just assholes looking only after their own interests that are not interested in justice and peace.

Wow you sound ignorant. For a "security engineer" you need more training, or more exposure to the real world.

HA, HA, HA

HINT: The real world doesn't run Vista or Windows 7 in a business environment. The ones who run Windows tend to run XP, which is a sieve security-wise.

And ? The guy talks about issues that are supposedly unfixable in Win32, Vista and Win7 prove he's wrong. Nobody ever talked about market share.

The latest unpatchable exploits are just another demonstration of the lack of security focus at Microsoft, which if you've been around long at all you must recognize as a pattern.

Latest unpatchable exploits ? Which ones ? Come on, instead of insulting people when they don't spit on MS like you do, why don't you bring FACTS ?!?

Lack of security focus at MS ? Yeah, I suggest you go talk to guys like Dan Kaminsky, Chris Paget and others to see who in their opinion is a leader in developing secure software, you're up for a serious surprise. But then, you wouldn't know, you probably never talked to them since you don't seem to have a clue about what secure software is.

As for the "shill" comment -- considering your comment history, one has to wonder if you are being paid for your comments, as they fly in the face of reality as we know it.

That's right, not spitting on MS all day long like you guys make me a shill.
But then again, facts show that I'm right. Now, does being right make me a shill ? Or is it simply because you dislike reality that you hide behind this "you're a shill" shield ?

Of course the possibility is that you're some Best Buy or Office Depot employee playing "security engineer" on the weekends. In either event, I pity you.

You're right, I *might* be your boss in that department store

You probably also knew about the message queue vulnerability... didn't you? A professional would know.

If you're talking about the one you cited, yes, for years. It's a very moderate vuln actually, even on XP / Windows Server 2003

And I wouldn't be too sure that 32 bit Vista or 7 could effectively patch the problem without changing the Win32 message queue and breaking compatibility. Do you have any references to cite this achievement?

Look at MSDN : http://msdn.microsoft.com/en-us/library/bb625963.aspx

Preferably one that explains why it isn't fixed in WindowsXP.

That is very simple: the changes are extensive, too big to be ported back.

I've read through your comment history a bit. You might as well add a signature that says "I'm a Microsoft shill."

Oh right, since I don't talk shit about MS like you do, I must be a Microsoft shill... Now I could go take a look at your comment history and tell you you're a [some insult], but what good would that be ? That would say more about me than you.

The reality is, I'm right and you're wrong, you had no idea what you were talking about and got caught red handed.
Calling others shills won't change any of that.

Vista and Win7 are protected against that attack(concept of low-medium-high integrity processes and processes can only send messages to same or lower integrity) and they have done so without breaking the apps.

Sorry, doesn't fit what you claimed.

I would love to have you clearly articulate those known exploits that cannot be patched in Win32 And I bet you won't be able to, why ? Because they don't exist.
Hint: I'm a security engineer, watch what you're saying.

Oh yeah, supported by a dying company (Sun) and one that has absolutely no server market share.

Way to go Ruby !