Slashback: Snapshots, Amends, Bazaarity 388
Microsoft is just as secure as the competition, says Microsoft. Jon_E writes: "According to this article Microsoft is responding to the Gartner Report which recommends that enterprises drop IIS by claiming unfair targeting due to their popularity."
Whether because of better-trained or more vigilant administrators, or some other factors, the Apache servers running many web sites certainly haven't seen the devastating outages in the past month (Code Red, Nimda) as certain large IIS installations have.
If animated, this might make a really good Saturday cartoon. cconnell writes "Last September, slashdot published my critique of Eric Raymond's essay The Cathedral and the Bazaar. There was a lively (and sometimes scorching) discussion that followed. Here is Eric's reply to my critique, which Slashdot readers might enjoy. And here is my reply to Eric."
This was not faked in the same studio as the "lunar landings." mrsmalkav writes "Deep Space 1 has passed by Comet Borrelly within 1400 miles and took some very pretty pictures of the comet's core, all while collecting lots of data about said comet. NASA's press release discusses some of the details and findings of the flyby.
This is actually really impressive given that there was very little hope for this mission. From the Mission Logs on DS1's site, '[T]o be honest, DS1's visit with the comet simply is unlikely to work as well as we hope. Many mission logs have described the difficulty of keeping this aged and wounded bird aloft, and the encounter with Borrelly will present Deep Space 1 with the greatest challenge yet in its historic trek through the solar system.'"
Saint Aardvark writes "Space.com has an article about the images taken by DS-1, and they're stunning." And eldurbarn points to the NASA Images of comet Borrelly online at JPL.
How to satisfy customers with license objections, Part II brtb writes: "Soon after Slashdot posted my DiscZerver-GPL writeup last week, xStore added a link in their Download section for information about the use of GPL software in their products. Below is the e-mail I received in response (address changed to protect the spamless). Congratulations to xStore for supporting Free Software and bringing the DiscZervers into compliance with the GPL.
From: "Support" [support@xstoreonline.com]
To: "brtb" [slashdot@brtb.org]
Subject: "RE: GPL SOURCE CODE"xStore is committed to complying to the full letter and spirit of the GPL. We are currently investigating the allegations of non-GPL compliance and communicating with the GNU.ORG and Free Software Foundation on this issue. We will produce a response to your request that is mutually acceptable to the copyright holders of the programs we have used that fall under the GPL and xStore itself. Due to the recent acquisition of this product, we are still in the process of preparing the required source code for distribution. xStore is commited to bring the DiscZerver product into GPL compliance, if it is indeed found to be not in compliance.
In the meantime, please provide xStore with information so that we can send you, the user of this product, the package that you are entitled to. Please provide the serial number of your DiscZerver product and the 'system page' with your response. The 'system page' is located at [http://your_Zerver_name_or_IP_address/admin-cgi/s ystem]. In addition, please send us a self addressed stamped envelope suitable for mailing a CD-ROM along with $14.95 to:
xStore, Inc.
Federal Highway Center
1200 North Federal Highway
Suite 200
Boca Raton, FL 33432After we receive your written request along with the above items, we will process it and promptly send you the disc when it becomes available.
This thanks to the mostly behind-the-scenes work of people at the FSF. Congratulations to xStore for respecting the intent of the programmers whose work they're consolidating and packaging.
what does an ion engine do? (Score:4, Interesting)
: ) - It's true...TIE = Twin Ion Engine
Re:what does an ion engine do? (Score:4, Informative)
Re:what does an ion engine do? (Score:4, Funny)
So you have to get stupider to go faster?
Google (Score:2, Informative)
Re:what does an ion engine do? (Score:5, Informative)
DS1 How the Ion Engine Works [nasa.gov]
Has a great description. It even has pretty pictures.
Re:what does an ion engine do? (Score:2, Informative)
For the best explanation of ion propulsion that's used in the DS1 probe, see the Ion Propulsion FAQ [nasa.gov] at NASA's JPL site.
For more information on the DS1 probe itself (and the technologies that it tested), see the DS1 Home Page [nasa.gov], also on the JPL site.
How the Ion Engine Works (Score:5, Interesting)
First things first, you need a spacecraft as light as possible. Anything not needed goes away. Basically, you're left with the instrumentation, the navigation, the cameras, solar panels, batteries, and a couple of sizeable tanks of xenon.
Yes. Xenon. The heaviest non-radioactive noble gas.
Now, xenon is normally inert like other noble gases. I mean, there are no natural compounds containing any noble gas because they have no natural need to enhance their electron shell configuration.
However, xenon is pretty large (as atoms go) and, given enough juice (courtesy our light and ability to live, the sun, hence the solar panels), you can ionize xenon. You can strip off an electron or two and it's useful (For example, the compound XeF6, xenon hexafloride. What it's good for? Dunno. Still doesn't change the fact it exists.) More importantly, it's charged and can be directed.
Then, it's a simple matter of a small aperture (which can be directed), a positively-charged grid, and the xenon leaves in the direction opposite the spacecraft goes.
Don't expect this to power any spacefighters, however. At full power, the force this produces will barely move a piece of paper in front of it. The beauty of ion engine, though, is that because in space, inertia isn't hampered except by collision or a gravity field, this little bit gets larger as time increases. It's not much force, but given time it gets zooming.
Re:How the Ion Engine Works (Score:5, Funny)
Well, from what google can find, xenon hexafluoride is useful for two things. Serving as something for chemists to talk about, and making quartz detonate [google.com].
Re:How the Ion Engine Works (Score:2)
Re:How the Ion Engine Works (Score:2)
Re:How the Ion Engine Works (Score:2)
With less fuel needed during the ion engine phase, less fuel is needed to get the thing into orbit, which greatly reduces the cost and difficulty of doing so.
answer: an ion engine wooshes in space (Score:5, Funny)
Re:what does an ion engine do? (Score:2)
Oh - and anyone who's ever played TIE Fighter [lucasarts.com] knows that an Imperial fighter has a hell of a lot more get-up-and-go than Deep Space 1. So ion engines with that kind of punch are still a long way off.
Re:what does an ion engine do? (Score:3, Informative)
Ion engines work by accelerating charged particles (ions) electrically rather than accelerating molecules chemically. A conventional rocket motor works by taking a fuel/oxidizer mix that contains stored chemical energy, releasing the chemical energy by burning the fuel/oxidizer, and using the generated heat to accelerate the combustion products out of the rocket. In an ion engine, OTOH, an inert gas (xenon) is ionized and the ions are accelerated by passing them through an electric field (and then throwing them out of the engine).
There are two important criteria to use in judging an engine: thrust and specific impulse. The thrust is how hard the rocket can push (i.e. its force) and is a combination of how rapidly it can push reaction products out and how fast they're going. Specific impulse measures how fuel efficient the rocket is, i.e. how much thrust it can get from a given amount of 'fuel', and basically depends on the velocity of the reaction products leaving the thruster. Chemical rockets can achieve much higher burn rates than ion engines, so they can produce much higher thrust. Ion engines, though, can achieve much higher specific impulse, because they can accelerate ions to much higher velocities by using energy accumulated from solar panels or radiothermal generators.
Overall which one you want to use depends on circumstances. Chemical rockets are necessary for things like getting into orbit in the first place, because you need to have a thrust/weight ratio > 1 to get off the ground, and ion engines can't get there. OTOH, once you're in space you can't easily get more fuel, so the greater efficiency of ion engines means that they make a good propultion system for long, deep space flights.
Zimmermann Article (Score:5, Informative)
http://www.nytimes.com/2001/09/25/technology/25CO
free registration req. (Score:2, Informative)
pw: testtest
'Nuff said.
ObMSBash (Score:5, Funny)
From the IIS article:
I couldn't agree more. Apache just can't compete with the speed of Microsoft's PR department in spinning every horrendous hole as "innovation".
Re:ObMSBash (Score:2, Funny)
> serious vulnerabilities have been found in all > server products and platforms," said Jim
> Desler, a Microsoft official. "IIS is as secure > as our competitors' products, and what
> differentiates Microsoft is our industry-
> leading response process."
And the Linux/Open Source/GNU/Slashdot/Freedom Fighters of the World/Whatever everywhere collectively respond: "Oh, is THAT what you call it?"
Gads.
$14.95 (Score:3, Offtopic)
I could almost understand it on standard retail stuff, but in this case... Does it not seem a little frivolous?
Re:$14.95 (Score:5, Informative)
Re:$14.95 (Score:4, Interesting)
Re:$14.95 (Score:2, Insightful)
Re:$14.95 (Score:2)
If the price however is 4.95, the customer is expecting change, and therefore continues to watch you. Don't you think they would find it odd if the clerk, right beside a cash register, neglects to punch it the purchase into the machine, and produces change from his pocket?
Re:$14.95 (Score:2)
"Common sense is the collection of prejudices acquired by age eighteen."
"Few people are capable of expressing with equanimity opinions which differ from the prejudices of their social environment. Most people are even incapable of forming such opinions."
- Albert Einstein
Not in the old days (Score:2)
Taxes grew grew by 1000-2000% during the 20th censtury. At least that won't happen this century...
Re:$14.95 (Score:3, Insightful)
After all, that's what "freely redistributable" is all about. Only one poor chum has to eat the media costs.
Re:$14.95 (Score:2)
Except for one thing. Study after study has shown that the "vain" hope isn't in vain. Items marked at
You'll find some stores that use
By the way, in the *wholesale* trade, pricing this way is a garunteed way to *lose* business. Business operators want to do business in even amounts.
If the average consumer were as savy as the average business operator we could do away with the whole pennies thingy.
KFG
Re:$14.95 (Score:2)
Take a close look at these ads sometime and ask yourself if the S&H could also cover the cost of manufacturing...
Security through Obscurity (Score:4, Insightful)
One other note: I thought a majority of web servers run a varient of linux. So because they have the market share, wouldn't hackers attack them more? I just think it's harder to attack something that is open source because so many bugs can can be found by the community and fixed by the community, while bugs for IIS can rarely be fixed by the community.
Plus a lot of people just hate microsoft in general.
F-bacher
Re:Security through Obscurity (Score:4, Insightful)
I think that you have hit the nail on the head here. Microsoft is simply a high profile target, but it is also despised for it's arrogant, "our software is superior and everyone else sucks" attitide. Basically, their arrogance inspires people to try to take them down.
Unfortunately, I see more and more people in this forum with a similar attitude about the superiority of Linux and Open Source in general. I see a day very soon when people will get tired of kicking the M$ security dead horse. The real challenge will be in targeting Open Source alternatives. What hacker wouldn't want to be the first to bring Apache?
Then again, maybe Apache really is invulnerable to significant exploits.
Relative abundance of server variants... (Score:5, Insightful)
Here's the key to it. The majority of servers run some variant of Linux. Most buffer overflow bugs require a specific offset and known layouts in memory. If you look at the specific versions out there IIS is probably the most common single version of any product out there (can you get this info from Netcraft?)
On the other hand, it could just be stupid admins - check out http://www.netcraft.com/Survey/vuln.gif. I'm sorry, but those numbers make me puke when I think any of those people seriously call themselves admins...
Re:Relative abundance of server variants... (Score:2, Insightful)
You miss the point that most of these people don't consider themselves admins due to the simple fact that they don't know IIS is running. The majority of people who hit me with Code Red and Nimda attacks had the default "Under Construction" page. Yes, some people are ridiculously stupid, but some others just trusted that Microsoft would set their computer up for the standard user, not for the standard admin.
IIS on NT Workstation (Score:2)
Re:Relative abundance of server variants... (Score:5, Interesting)
Here's my work environment -- the products that I'm supposed to install, after I've chosen the hardware for 700+ desktops, and maintain, after writing policies and ops documentation.
Exchange (10) Servers, IIS (7) Servers, MS-SQL 6.5 and 7 (5) servers, Metaframe/NFuse (4) servers, RAS, VPN, 45 NT servers for general ops of all this stuff, a couple of Debian boxes for internal DNS, FreeBSD running MRTG, Nessus, etc, perform 2nd level support for 8 clueless admins and 6 semi-knowledgable ones. Additionally, let's not forget the "uhh, how do I do a word merge", boss ranting about multicasting (for which I am going to modify configs on 12 cisco Routers and godonlyknows how many switches), write policy and operational documentation for all of this. Manage the "network consultants" than run DNS, e-Trust and FW-1, provide support and knowledgable comment towards a $2mil software app development process in terms of "net and O/S", deploy 2000 server *sigh* next month and ensure that everyone makes a backup occasionally. (play nice with audit, 20 mangers and two other organizations [1 that owns us, 1 that we own]).
If *ANY* of you suckers handle all that daily, and still have time to mess with patches on a regular basis, I'd love to see you in action. This seems to be quite a common scenario for a lot of mid/small size companies, in my experience.
I'd love to live in your dream world. People wonder why I'm an alcoholic.
I did realize about three months before codered that we were a screaming hole for IIS exploits. Do I have time to cull through 30+ patches and tinker with which are appropriate to apply? Nope. Result: Nimda runs rampant still this week because I've been stuck in innane meetings all day.
Now: Suppose your boss is used to having a mini-vax, and asked for CPU usage reports by dep't and individual last week. Do you see the uphill battle? We're young. Management in a small/midsize company isn't likely to even understand what they have running, less what should be paid attention to technically. Politics, Politics, Politics all day long. Yay! Well, I guess of the rest of the world got messed, it's okay that we did too.
Have fun admin'n your two Apache boxes. Good Night.
No troll indended, it's just a rant.
S.
Re:Relative abundance of server variants... (Score:2)
> Result: Nimda runs rampant still this week because I've been stuck in innane meetings all day.
Let me guess: Meetings about how bad Nimda is?
Yeah, been there too. There's a reason that the term PHB caught on.
Re:Relative abundance of server variants... (Score:2, Funny)
Well, I do it with one box. (Score:3, Insightful)
One web server - Unix scales.
One print server - Unix scales.
One file server - Unix scales.
One Oracle database server - Unix scales.
One middleware hub - Unix scales.
Three DNS servers - On different networks.
And one system to manage them all.
I have no second level admins. For a similar number of users - about 800.
It's just me and "It all just works". You feel free to go on running yourself ragged with crap systems. Eventually you'll get fired or burnt out and someone who knows what they're doing will fix it.
Re:Security through Obscurity (Score:2, Informative)
Mac viruses aren't in wide circulation for reasons beyond numbers. Apple, unlike MS, actually secures things so that scripting can't run amok, as with ILOVEYOU and all the others. Fully scriptable OS are trouble waiting to happen and everyone BUT Microsoft knows it.
And yes, Macs get viruses. There are also ways to trash a Mac system with scripting, but most of them aren't even a tenth as evil as this stuff coming to a Windows machine near you. Ironic, the last virus problem that I had to watch for were macro viruses that came through corrupted Word files. If you don't have Office on the machine, you don't have a problem--Appleworks and MacLink get the job done.
That conspiracy theory should really die (Score:4, Informative)
Before you flame: yes, I know that was meant as a joke, and yes, this post is more than slightly off topic (but Slashback threads often are), but this is probably going to be discussed here sooner or later anyhow so I might as well take some preventative measures.
The lunar landings were not fake. The "evidence" is poor at best, and just blatantly stupid otherwise. I won't reiterate all arguments against this silly conspiracy theorys validity, as you can read all about it, for example, here [badastronomy.com] or here [badastronomy.com].
There are lots of nice conspiracy theories that really have some nice arguments that actually speak for them, but this is not one of those. This one should really die. Seriously, I'd go for Illuminati or Elvis any day of the week if this was my only alternative.
Re:That conspiracy theory should really die (Score:3, Funny)
This lame joke is presented to get around the lameness filter:
A duck walks up to a pharmasist and asks for some lipstick, the pharmasist asks "will that be cash" the duck says "Naw, just put it on my bill".
Re:That conspiracy theory should really die (Score:3, Funny)
>>The lunar landings were not fake.
Oh yeah? Explain this [port5.com] then!
IIS Popularity? Exsqueeze me? (Score:4, Insightful)
They're targeted because they're the most vulnerable target. That's all.
Re:IIS Popularity? Exsqueeze me? (Score:2)
Especially in an all-Microsoft shop.
Re:IIS Popularity? Exsqueeze me? (Score:2)
As a side note, Gartner must be moving from IIS, since their web server is down right now.
Cluley clueless (Score:5, Insightful)
The attempt to rank vendors according to their security success rate is a risky business. The aim of most virus writers is usually for their worm to achieve its biggest impact, and so will target platforms that are widely used. "Microsoft is targetted as it is so popular, rather than the system being the least secure," said Cluley.
You have to love how they pull the "everyone is jealous so they pick on us" stuff everytime they screw up. Suprise [netcraft.com], shitstreak, Microsoft does not make the world's most popular Web server. That's Apache. "Hackers", as you call these jerks, do not target Microsoft because they're the most popular. They target Microsoft because Microsoft has made itself an easy target by making it really easy to hack their products. If popularity made you a target, we'd see scores of Apache worms.
Re:Cluley clueless (Score:3, Insightful)
I think you misrepresent the purpose of security. Its role is to
prevent us getting work done. If someone constructs a security
solution that is usable, experts will focus on it like a cat watching
a mouse hole until a fatal flaw is found. This results in three
things: 1) The technology is disabled, making it impossible to work
again. 2) A solution is worked on, distracting people from getting
regular work done. 3) Finally, a new solution is deployed, requiring
people to spend time updating their systems and networks rather than
getting work done. At this point, security has failed because people
are working, so the cat goes back to the hole and in a few days the
mouse emerges and is caught and life returns to normal.
So the rule of security is the following: if you are able to work on
something other than security, your system is insecure.
-rob [Pike]
Re:Cluley clueless (Score:2, Insightful)
I believe Apache runs on the same platform as IIS.
This issue has nothing to do with the platform, it is about the service, ie. web server. IIS and Apache both run on Windows boxes, how many malicious worms have we seen that attack Apache on Windows?
Re:Cluley clueless (Score:2)
Crossing Platforms (Score:3, Insightful)
The windows platform is very popular. Most common desktop by far; sheer numbers makes it a target. Add in that the average user has little IT experience and (either because of design or end user maintenance... or both) that a lot of these machines will be full of holes... great target.
Lets say its not IIS that's under scrutiny but Apache. Very popular. Lots of holes. And a large percentage of the user base tends not to patch holes as they're announced. Great target.
Just because Apache tends to be ran on non-Windows hosts does not mean we can't put them togeather. sadmind [cert.org] did just that. It spread on Solaris systems to attack and deface IIS servers. No reason we can't launch a new Nimda-a-like that propogates amoung windows machines and attackes Apache (on whaterver OS its sitting on) hosts.
But, of course, that's not what is going on. IIS is being attacked because of the virtues of IIS, not because its usually sitting on Windows hosts.
connel vs raymond (Score:3, Interesting)
How many beneficial software projects simply wouldn't exist without this sans-management stucture?
NASA Funding (Score:3, Insightful)
Microsoft's Response (Score:3, Funny)
Re:Microsoft's Response (Score:2, Insightful)
IIS is most popular, by far, with commercial sites. According to NetCraft anyway.
So kiddies, whatcha gonna hack? Commercial site or photos of mangy dogs.
It's a reasonable argument, but not an acceptable excuse by itself.
Re:Microsoft's Response (Score:3, Interesting)
Code Red and Nimda did not attempt to hack commercial sites. They relied on large numbers of (poorly |un-)secured servers managed by sleeping administrators. Judging by a sample of the attacks that came my way, I'd say 80% of the machines were running servers that the admin didn't even know about.
And given the growing number of machines now equipped with an unnecessary webserver, matters are set to get worse.
At least all the admins I was able to contact (with one exception) stated that they were now considering a UNIX-based solution for public webservers!
IIS Rewrite? (Score:4, Interesting)
According to The Register [theregister.co.uk], their reaction also includes the following:
Sneak Peek at the Docs (Score:5, Funny)
Interesting article on ION drive. (Score:5, Informative)
http://www.msnbc.com/news/206711.asp
Face on The Comet (Score:3, Interesting)
This is the biggest image of it:
http://nmp.jpl.nasa.gov/ds1/img/borrelly_1.jpg
My God! (Score:2)
Quick, alert the editors at that fine scientific magazine " Weekly World News."
KFG
Poor Apache users! (Score:4, Redundant)
Then I must conclude that there are twice as many worms developed for Apache, than IIS. I feel sorry for all you poor Apache users. Your worm problems haven't received nearly as much publicity and sympathy. It must be a conspiracy.
Re:Poor Apache users! (Score:2)
Re:whatever (Score:2)
OTOH, virus writers do a great job of refuting people's claims of security, and making those refutations public... Go figure.
IIS! Ha!Worms dont happen to Mac web servers ever! (Score:3, Interesting)
EVER.
Thats why no reports of ANY exploit has ever been published regarding the secure Mac OS. !
consult bugtraq if you doubt this.
This Gartner report is a sham unless it really discusses techical issues regarding the macs securuity as a web server.
C Language alone is not the sole reason but the types of STRINGs used in ANSI C libraries certainly adds risk.
Worms dont happen to Macs because Mac programmers rarely have buffer overrun problems because mac apps typically NEVER use null terminated strings and intead use "pascal" style strings that have a bounds of 255 and a marker in the front.
Additionally mac programmers tend to know that there is no false sense of security because all code is running at supervisor level so programs, like Webstar, are careful not to do foolish things.
Mac programs and executables NEVER can run merely from a data file named with a suffix such as
A further reason macs are more secure than unix (hundreds of documented exploits) and Win NT (almost as many exploits documented over the years), is because the mac does not have a command line shell and has no path to hijack. No command line and a modern type of interprogram communication prevent the silly weaknesses in other OSs.
Yet another reason the Mac is secure is vecause a mac program (either 68k or PowerPC) needs TWO files to execute and not one file. The second file is called the resource fork and it is genreally an invisible file kept tightly associated with a file. classic internet apps do not create or allow creation of these resource forks as side effects of merely storing data files. Macs are very secure from infiltration by dynamic creation of apps by rouge products on a server
Another reason macs have NEVER been broken into running the WebStar server is because the mighty Mac OS Webstar server, (which typically costs over 400 dollars unfortunately), avoids ever executing cgi code files from directories where they ought not to be. A clever set of directory and folder control prevent the webserver from being hijacked unlike earlier versions of apache.
The US army switched to Webstar webservers on macs when MS NT webservers kept getting hacked.
There are thousands of major webstar servers out there. I think many are colocated at reprahduce.com cages.
And mac NEVER get hacked. EVER. and NEVER have, even with public challenges and reward money.
Sure, there may be some defects that might get discoverred one day, and surely any mac not runnning mac os such as ppcLinux, or MAc OS X (freeBSD derivitive) are hackable.
But face it. Macs have NEVER been hacked and that is because of modern and sound design principles.
Myself and other mac programmers I know have NEVER shipped a product containing a single null terminated C string, and do lots of paranoid error checking as well.
Unix is hackable not because of open source, not because of popularity (both of which help) but because of all the things I mentioned here.
But I agree about the other OS's sucking. parts of the older Mac OS itself is written using pascal strings, in fact the original ROMs were written using only pascal compilers and some assembly, and no C. But string overruns alone are not the ONLY reasons mac servers have never been hacked, (command line, dual fork, no extensions, etc etc).
Wake up and quite being bigoted. "Never" is a good enough abosolute ajective for most logical people to draw up reasoned conclusions from.
Mac is superior -- NOT (Score:3, Informative)
The Mac is not invulnerable. Far from it. Webstar hasn't been hacked yet -- congratulations! That's good news and the developers deserve thanks.
Of course if the Mac were in any way a significant platform for web serving it might make more of an impact. Right now it isn't nor does it look like it will be in the near future. As a matter of fact it is an extremely tiny server platform.
The reasons that the Mac is a marginal platform for servers are many but center around a few significant facts. In the past they have not been built as true servers that can compete on a price/performance module -- not the cpu but the entire system. The development platforms for open source (Linux, etc.) and NT (IIS/ASP/etc.) implementations are easy, powerful and productive -- the Mac is not really superior and in some areas doesn't come close to the base functionality of either Linux or NT/2000.
Frankly the Mac is a marginal system. Always has been. May always be. To move away from marginality it needs to present a compelling technical ability (i.e.: price/performance must soundly trounce the competition), an ability to deliver solutions swiftly and/or an ability to deliver web solutions that no other platform can do.
Doesn't look good for the Mac.
Only if they've got a G4 or the new G5... (Score:2)
Re:Mac is superior -- NOT (Score:2)
All it takes is ONE server w/o virus protection... (Score:2)
All it takes is for the virus to inject itself in the CODE fork of one of several files to "properly" infect a machine and then start randomly infecting everything (Remember, some of the magic of MacOS comes from all files potentially having a CODE resource fork and MacOS acting on the same... Simply inserting a floppy into an unprotected machine can infect the machine in many cases...).
Once that's happened on the fileshare machine, all the other machines are only a matter of time before they're infected too.
Sadly, I DO believe him- it's entirely possible. Just not directly from off the Internet like it is with Windows machines.
Some thoughts on IIS exploits (Score:3, Insightful)
MS had its roots in BASIC on small hobby computers. Much of what they have done since is summed up by their home-grown product: GeeWhizz Basic.
The network that they have now is based on IBM OS/2 Lan Server, which they got in code sharing arangements with IBM. I mean, the OS/2 1.3 help file still serves me well under NT4.
Their main contribution has to lay all sorts of flash in fanciful languages, purpose designed to ensure upgrades. Excel, for example, has had three entirely different languages in five years. Most people could not be bothered to learn the new language. A lot less macro writing happens now then in the days of Lotus 123 for DOS. Mind you, it does not stop the script kiddies, who are learning the latest exploits.
Most MS products ship badly configured. Like, who would put a spell checker on a function key (F7), if spell checking is done live anyway. I mean, you either do it live because you have the juice, or you do it from the tools menu because you don't have the resources to run it all the time. Putting it on a function key is silly. Except to bring it up on sales promotions. "Yes, we have spell checker [press F7]".
So their network stuff is full of flashing chrome designed to sell the thing to executives, and the scripts that run this chrome is by this set up, already in a form ready for remote exploits. Yes, you can configure it, if you want to stuff around in the registry and hidden settings. But most people dont have the knowledge or time to do something that should be a default or available choice.
MS is a small system maker that is attempting to do big time: all they do is big time damage.
Spell check on F7 (Score:3, Interesting)
The "live" checking does not autofix it, but if you right click on it, it does give suggestions that will be put in if you select it. That's what makes the F7 key so stupid. Autofix actually is a hazard if you regularly use double caps eg "JSmith said ...". Tab is bound to something that most people find absolutely irritating. I know I have to fix their docs up.
Most of my typing is done straight in markup. That is, when I type this in bold, I go {control-B}this{control-B} or {b}this{/b}. Amipro had a clever idea of putting styles onto the function keys: so if I want a header, I press F7, and if I want a body, this is F2. The table is stored in the template.
With control-c, v, and x, the easy way to remember these is that x is sissors (cut), v is glue pen tip, and c is copy. That might help.
Spell checking a document, like printing it, is a separate activity, and not something you want activated on a wrong key stroke. Going Alt-T-S, especially if you watch the menus as you do it, is not a big ask, especially if the machine does a lot of paging as it does it.
As far as your data files go, I have found a way around this is to store them in one tree, and then create an icon with the command line "explorer.exe /n,/e,/root=d:\path,folder" does wonders for file management. You can change the icon view to "List", and arange by date to get the latest to the end. Whichever way, it's better than "Large icon". Also, the back space backs up the tree. Also counter intuitive, but consistant.
Re:Spell check on F7 (Score:3, Interesting)
I'm not sure what you meant here. Tab isn't bound to anything; it's the tab key, which tabulates a document. It isn't used a lot, but it's sure useful (although I'd be the first to volunteer to design a better tab system for Word if I could). I can certainly understand dumb/ignorant (careful to distinguish, not wanting to sound bigotted against non-computer literate types like my dad, who is hardly dumb) people messing stuff up with it though. Maybe I misunderstood what you meant.
Autofix/correct...yes, a double-edged sword if ever there was one. I personally have become immensely lazy with the advent of this feature, because I find that being able to add autocorrections like "Tn" being corrected to "Tennyson" is very handy indeed. On the other hand, as you say, there are a number of instances where it becomes one hell of a pain, and backspace/ctrl-z is your bestest buddy. To be honest, I find autocorrect a lot more useful than a nuisance; there are a large number of typos that you make when you're doing 120 wpm, and if you can automatically cover them, you don't need to worry about breaking rhythm to fix the problem. As for stopping to address red-underlined words, well...I just ignore them and wait till I'm done, so I guess inline spellchecking becomes kinda pointless; I just like to know what words and phrases are considered bad I guess. I tend to spellcheck every few pages, since I discovered a while back that trying to run a spellcheck on a 130,000 word manuscript (ie, killed Windows, reinstalled, reinstalled Word, didn't save custom.dic) takes...well...erm...
Thanks for the hints about the editing function keys like ctrl-c; I never had a problem remembering them, but I'll pass them on to my mum :)
What you say about being able to right-click a red-underlined word is true, however once again, this is moving from the keyboard to the mouse. I also don't find that F7 is the most remarkably easy key to accidentally hit (actually I wish the function keys didn't have a plastic separater from the number keys, because I'd like to be able to hit them without stretching) but I guess it's more a matter of preference than any seriously debatable topic. I've always been grateful for F7, shift-F7 and F12 (as well as F3, F5 and F8 in Opera), because I am a keyboard freak, and consider the mouse an object of scorn until I load Quake ;)
Yeah, there're a lot of ways to get around that dir tree problem. I'm very fond of subdirs myself, since I am one of those must-categorise-everything-or-die types, but as you say. It all comes down to a shitty interface.
Btw...how long do you think this conversation could go on for before we're killed due to archiving? I seem to recall from some misty recess in my wee brain that articles are archived after a week, but it may have been two...it would probably be pretty sad if we were still debating by then though...
Re:Spell check on F7 (Score:3, Interesting)
The default install is for "Tab" and "Shift Tab" to shift the left indent. Tools|Options|Edit.
>Btw...how long do you think this conversation could go on for before we're killed due to archiving?
Over a week, I should imagine. I have another discussion going on at slashdot as well at this same time.
The trouble about using one word processor or OS is that you never get to see how the other guys do it. I have become a more capable Windows and Word user for having OS/2, AmiPro and Describe. It's not that these people make better products that MS, but they do things differently. Hey, yes this I,can be done. When you use other word processors, you get to see entirely different layouts, some of which are quite good. Here's a sample.
There is a lot of things that MS still sadly lags in. For example, selecting a range is a single action, not a mulitple action. You can't drop an anchor, then go somewhere else, and drop an "end selection range". This allows for the selection of a range over a large area.
You can't easily adjust a selected range by nudging an end. You have to unselect the range, and make a new one. I know, the idea is silly idea, but when you start fiddling around with big areas, you will see its advantages. Can be done as an Edit Menu option. For example the Alt-Edit-Anchor/Select-Drop/Move/Clear woulddo the trick. The selected range is from Anchor to Select. The Drop and Clear sets and clears the end. The nudge moves it with the cursor and enter.
But by the time you want to fiddle the document to that sort of level, it's probably better looking at TeX.
The problem with computers is not that they're not capable of doing it, but communicating this to the user. For example, Describe's style sheet would be much harder to understand were it not shown in a dir style tree.
The problem with Microsoft is that they change the language on every version. You can reconfigure it easily, but there are lots of easy strokes, and it's hard to find the right "easy". This is what the main point of my arguement is.
Re:Spell check on F7 (Score:3, Interesting)
Your point about text selection is well-taken, don't worry. I have, on many occasions, wished for something like what you describe when editing chapters etc, and Word is sadly lacking in this area. It seems that there a huge number of features in Word that no one ever uses, but ones that would really come in handy are lacking. Certainly the average person writing letters to his grandma wouldn't take advantage of the kind of features you and I would like, but hey, you and I would, and I'm willing to bet there're a large number of others out there who would too.
Pity Microsoft isn't in the habit of learning from other people, instead of stealing from them. Amipro and Describe sound neet.
Re:Spell check on F7 (Score:3, Interesting)
But, unfortunately, its desire to run macros on load has been its biggest pain. "Word Macro" viruses are at the moment, a big pain. And unlike the old viruses under DOS, they're so painful to detect. In my sysadmin days, these trashed a lot of useful documents. A lot of hours suffering.
"Sorry, miss. Your document has been trashed. So you worked on it for two weeks. Oh well. Don't call us, because you use it at your own risk. Must be a hardware fault [Printer tables in Word are the biggest document trashers]. Anyway, thanks for the $600."
Amipro and Describe had features that irritate as well. They are less configurable. But the dodgy nature of word processing is making me drift towards QBasic, a home grown markup language and rtf output. Sad, really.
Re:Some thoughts on IIS exploits (Score:3, Interesting)
Yeah, I also learned Win-E from that boss :) Alternatively, you can go into Folder Options and edit the preferences for File/Folder so that "Explore" is set as default, instead of "Open" -- that way, double-clicking defaults to a directory tree.
You hit the nail on the head with file-extensions. That example beats the hell out of my off-the-cuff offerings any day. I can understand it for Win9x, because your average luser is gonna have a cow when he renames a file and it kicks the bucket because he didn't add an extension, but for WinNT/2k, it's an appallingly ill-conceived idea.
No mod_vb? (Score:2)
Just kidding, but tell me one thing. I don't really care WHY the platform has more viruses, if its because its insecure or just more popular. There is clear account of HAVING more viruses and thus BEING more insecure and thus HAVING bigger
TCO. In other words, reasons enough for replacing
this unreliable service.
While We're At It... (Score:5, Interesting)
Could we, in fact, turn a Disney DVD into a terrorist tool? Has it already been done? Should we be encouraging Congress to ban the CSS encryption scheme because it could have been used in such a way? Interesting questions, no?
Sad analogy, but... (Score:3, Insightful)
Some have discounted the more targetted point of view because Apache is reportedly far more popular. Ok, granted. But now for my sad analogy... Single family homes are far more popular in the United States than skyscrapers, but when terrorists want to make a point, what types of buildings do they attack?
People who write viruses may not be "terrorists" as they aren't trying to kill people. Sometimes they don't even have a point to make, but they most certainly want to cause financial damage, so who better to target?
Re:Sad analogy, but... (Score:2)
If MS continues to stealth-install IIS (so that admins don't patch it cause they don't know it's there) and if they continue to leave holes in browsers (like always executing .eml files) then their OS will keep being hijacked.
Canada Post (or USPS if your a yank) vs FTP(!?) (Score:2)
Seems like they want to not make it as easy as possible for people to get the code...
So, brtb, when you receive the disk, could you set up a sourceforge project and upload the files..? so otehrs can have a peak without the $ and snail-mail bother...
Re:Canada Post (or USPS if your a yank) vs FTP(!?) (Score:2)
Why can't I sue someone? (Score:2)
How bout a different approach? (Score:5, Interesting)
I have been thinking about this as well as one of the places I do contract work for is getting pounded daily with Nimda and Code Red I/II attacks as well. Since the box is running Linux, the attacks don't matter but I have been wondering if there is some way that a sysadmin could take advantage of these requests to stop the attacking system.
Various people have mentioned writing a white hat virus that would shut down the attacker and all that - but in reality that just puts you in the same boat as someone attacking their system - and its therefore illegal.But if someone's computer makes an http request for a file from my server, am I responsible if what they get is not what they might expect to get?
What if I was to create a file consisting of nothing but the letter X that was, say, 1Gb in size, and leave it on my linux webserver with a name like "root.exe"? It wouldn't take all that many requests for the attacking system to run out of HD space. Granted service on my server might suck for a bit, but eventually if enough linux admins did this the target systems would simply shutdown for lack of swap space or HD space or whathaveyou.
Or perhaps I tell Apache to treat .exe files as PHP files and process them accordingly. Then I create a PHP script that sends prints nothing but Xs or random numbers in a long string back to the requesting server (with the execution time limit for PHP turned off). It would be like 5 lines of code total.
After all, its my server, so presumeably I put the file there for my own purposes, indicated in robots.txt that I dont want it indexed etc. If some other system makes a request for that file which I have in no way indicated is present on my system, isn't there fault/problem if the file is too big, or causes problems at their end?
I am sure the clever folks at /. could think of other things that could be done in this manner.
Just food for thought, and I would love to see some suggestions...
How does one define popularity? (Score:2)
Do they mean popularity as a target of Internet worm/virus/trojan attacks?
Speaking of viruses... (Score:2, Funny)
...I once received an email that read something to this effect:
Hi! This email virus works on the honor system. Delete some random files and then forward this email to everybody in your address book.
Hmmm... I wonder if sending this email to a bunch of random people constitutes setting off a virus?
Re:Speaking of viruses... (Score:2, Funny)
Fallicy in logic (Score:2)
There are thousands of people running IIS on Win2k server, many of which are 31337 warez puppies on cable modems who installed win2k server because it was the biggest Win2k download and hence had the most stuff. These people are not included in the "market share" of IIS webservers.
The exploits for IIS worked not because of the relatively small number of sysadmins who did not update their IIS servers eventually
No competent sysadmin had their system compromised by Code Red, and if they did, they had it patched quickly. The people who got Code Red 2 were not part of the "market share"
"Please provide the serial number"? NOT! (Score:4, Informative)
Re:"Please provide the serial number"? NOT! (Score:2)
Re:"Please provide the serial number"? NOT! (Score:3, Informative)
This is also true of the GPL:
At some point, of course, it was decided that distributing source in a 650MB CD-ROM image was OK under these terms (!?), but that's another argument for another day. ;)
Graham Clueless strikes back... (Score:5, Informative)
Hmm... where do I remember him from? [techtv.com]
Always nice to have a few staunch supporters ready to jump to your defense
Re:Graham Clueless strikes back... (Score:4, Interesting)
IIS: more popular than web servers (Score:2)
Of course, you can't really blame these people for not keeping the web server they didn't know about (but probably paid for) up to date, and you may wonder why the server has to include features that MS can't make secure the first time when it does not, in fact, have to include any features at all.
IIS seem to have half the marketshare of Apache (Score:2, Informative)
Excerpted from Netcraft's Web Server Survey http://www.netcraft.com/survey/ [netcraft.com]
Take that, marketroid!
Read the Gartner article again... (Score:5, Insightful)
This is the biggest problem with maintaining Microsoft networks. Exploits in IIS or Windows are far too frequent, and almost all patches require reboots. You can imagine the response I get when I call management every other week and say "I need emergency downtime to patch 65 of our servers...".
Microsoft loves to talk about how their software has a lower TCO than other operating systems. Perhaps they don't count the cost of man-hours spent applying patches, or the downtime involved?
VMS Cool and Unhackable At DEFCON (Score:2, Interesting)
Now that Windows XP is here does that make Windows NT and Windows 2000 a legacy product?
Microsoft IIS (Score:3, Insightful)
So, I guess use of Apache must not be too widespread, eh? Now I'm not going to try to make the uneducated claim that Apache is really more secure than IIS, but for some reason there are far fewer security breaches on Apache. Maybe it's because virus writers are more supportive of Apache. Who knows? Unless something has changed in the last year, Apache still has the largest install base out there, and based on Microsoft's reasoning it should have the largest number of exploits.
I read the entire Gartner release, and I thought it was very insightful. They didn't say, "Take down your IIS servers." Instead, they carefully qualified it, suggesting that "...enterprises hit by both Code Red and Nimda immediately investigate alternatives to IIS, including moving Web applications to Web server software from other vendors, such as iPlanet and Apache." Note the key word investigate. Also note that they only suggest this for people hit by both viruses.
Microsoft's rebuttal also fails to properly address a serious issue: "cost of ownership." They make the wonderous claim about how fast they release patches to fix these security holes. What they missed entirely was the fact that a company can't be paying for the resources and downtime to apply a patch WEEKLY, not to mention the need for somebody to constantly watch for a security update so that it can be installed before somebody exploits it.
What Microsoft *should* have done (IMHO) is kept their mouths shut and swing some resources into either rewriting IIS or truly removing security holes, and then have a surprise release to counter Gartner's arguments.
Re:IIS Issues (Score:2, Funny)
Re:Of course Microsoft is better NOT!! (Score:3, Funny)
How many security holes so far discovered in Linux?
0 for XP.
Hundreds for Linux.
Therefore, XP is better. Currently, XP is the more secure OS ever. That record will last about a week, so get it while it's hot.
Target, yes... insecure, definitely! (Score:4, Redundant)
Microsoft products are rarely considered to be secure. Outlook is a laughing stock, and IIS is a running joke in the industry I'm in (managed services). So much so that we've been wondering whether or not to charge customers who insist on using IIS an extra fee for all the time we spend monitoring and patching their boxes. History has shown that if we get a new customer who demands to use IIS, then we can be reasonably assured that we'll have multiple headaches dealing with it so we might as well charge them. We (thankfully) never even considered supporting Exchange. We're going to ban IE from all NOC machines as well. Weaning people off Outlook may be harder, though. (Mirapoints help us mitigate that threat.)
The "competition"? That would be Apache, Opera, Eudora (or Pine for some of us), qmail, etc. The "competition" is not half as secure. It is far more secure, everything else being equal (i.e., everything is installed properly, configured correctly, etc). That's my opinion, to be sure, but a colo full of servers running about everything you can think of formed it for me and I stand by it.
You are the target, and you will be breached...
That statement is specious at best. The only way to be completely secure is to have a standalone box. Which isn't an option, and therefore silly to say.
MS software will never be completely secure. Yes, things like wu-ftp and such can be insecure as well. Anything can be. But at least most free/OS packages try to be secure. MS software isn't even trying to be secure. Hell, they apparently aren't even trying to be half-assed.
When will they get that through their thick skulls???
I'm wondering when people will stop drinking the MS koolaid and realize that there are many better, cheaper, more stable and more secure options available to them.
-B
Re:Not just popularity (Score:3, Informative)
The problems is pretty simple-- IIS trusts itself to police itself, and this trust is misplaced. The default installation of Apache does not do this. That being said, I have serious reservations about many other proprietary and open source web servers including Tux and Websphere for this reason.
Does IIS remind one of Sendmail, anyone?