Gates Says Windows Reliability Is Greater 568
mogrinz writes "According to an interview with the New York Times, Bill Gates is proud of the achievements Microsoft has made in increasing the security of Windows. As for the effects on people being attacked by SoBig.F, etc? Gates says this is "something we feel very bad about". Gates summarizes the Microsoft position very succinctly: "We're doing our very best, and that's all we can do"."
Wow, it's really secure now! (Score:5, Funny)
Welcome to The New York Times on the Web!
For full access to our site, please complete this simple registration form.
As a member, you'll enjoy:
In-depth coverage and analysis of news events from The New York Times FREE
Up-to-the-minute breaking news and developing stories FREE
Exclusive Web-only features, classifieds, tools, multimedia and much, much more FREE
Please enter your Member ID:
Please enter your password:
Remember my Member ID and password on this computer.
Forgot your password?
Re:Wow, it's really secure now! (Score:2)
No? (Score:5, Funny)
A. No. "
He should.
Re:No? (Score:5, Insightful)
Would Linus feel particularly hurt if a worm went around that attacked kernel v0.94 ???
Tom
Re:No? (Score:5, Insightful)
Microsoft has a long way to go. There's no doubt about that. But *some* of the recent news concerning Microsoft has surprised and pleased me.
If users would leave AutoUpdate on, or take the time to check for patches once every week or two themselves.. and MS doesn't bloat 2004 and instead focuses on security/stability... I think things will be just fine.
Re:No? (Score:5, Interesting)
Again, what is needed is more education of computer users in general - Windows Update really needs paper literature devoted to it in the box as it really is that important - from the perspective that the end results can affect others. It's the same issues with anti-virus software updates - a lot of people think installing from the box is all that's necessary.
What amazes me is that some large companies have a 'no executables' download policy on their networks. This umbrella policy also stops Windows Update working correctly, leaving a lot of exposed machines. Microsoft has supplied a way for larger companies to have their own internal Windows Update server running that will get around this problem and allow updates, but in some cases, company policy seems to be more important that IT common-sense.
Patches are important, they're just as important as those product recalls for exploding monitors/laptops and monetarily can probably cause more damaged if not applied.
Re:No? (Score:5, Insightful)
The harm caused by a worm to the user who disables AutoUpdate is his own responsibility. But the warnings should be more clear and in more places, when one considers what you pointed: that the user's choice may very well prove harmful to countless others. It is his machine, it is his choice. But he should be compelled by the software itself to make that choice in a more educated fashion.
Re:No? (Score:5, Interesting)
However, this is where M$ has to step up. They have to realize as the biggest makers of software in the world, their software has to be MORE secure than everyone else's. They have to take bigger, more progressive steps to ensure security and reliability. I think the issue w/ AutoUpdate is a good one. However, what about other new features they have put into Windows? The built in messenger service that allows people top drop spam on your desktop? Universal Plug and Play? The security holes that allowed worms like Blaster etc to propogate? This is where M$ is striking out. These are pretty easy to see as problems or better yet, security issues. Why not leave THIS stuff disabled by default and then allow users to turn it on when they a)need it and b)know what the hell they are doing!
That all being said, M$ is getting better, but they still have a ways to go. What I wish is that Bill Gates would step up and have accountability on these issues and more importantly give better answers. Sure these are ok answers that he gave, but they are really nothing more than company line. When asked:
That isn't the answer I am looking for. I am looking for something more along the lines of: "We understand that as the largest maker of software we are going to be an obvious target for hackers. As such we have to do better in the future to secure our software from such breaches." True Gates did say some of this, but I think he is foolish to say that there is not an actual effort to undermind his company. Slashdot alone is full of people who don't use M$ products out of shear distain for Gates and the flaws of Windows etc.
Still, as I said a few times already, M$ is getting better. But they still have a lot of work to do before the stigma of poor software writing is off them (his claim that "Microsoft's reputation for doing great software research is very strong" was extremely funny and again is that company line that I am not looking for).
An issue of trust. (Score:5, Insightful)
For those who are completely ignorant of computer security and never update their systems, they are akin to someone buying a power tool, not knowing how to use it, then trying to sue when they lop off a body part. You don't blame the manufacturer for those problems, you chalk it up to natural selection.
For those who are a bit more knowledgable, there is the issue of trust. After having used Microsoft's products for roughly 2 decades(since msdos), I feel I can't trust them to do something right anymore.
I know of people who got burned by the auto-update feature and their system was rendered unusable until they either restored or went into safemode to undo whatever "fix" was applied. Granted this is better than the "good old days" when a patch might require a clean re-install. Lots of good weekends gone to waste because of MS's "fixes".
Just this past week, I installed a update and suddenly, I couldn't make backups of my system because Autoupdate dinked with the drive access dll's. Thankfully, this only required the re-installation of the backup software to restore the DLLs to a working condition, but at what cost to the other parts of the system?
I have auto-update's download feature enabled, but I review the updates before installing them. I didn't get hit by the worm since I patched my system almost immediately after the fix came out.
The problem can't be completely attributed to users or to the producer of the software. But when the design of the software is so buggy that after literally tens of thousands of fixes, it is still riddled with security holes, you have to wonder if they are truly serious about security and about delivering a quality product to the end-user or if they are trying to do just enough.
It is understandable that MS is saying that they are doing the best that they can. That is all well and fine. But there is such a thing as their best not being good enough. Especially when there is so much slack to be made up for.
There is also the issue of this "got to be secure" attitude is recent. If it hadn't been for Linux arising quickly in the server and business markets both domestically and globally and if it hadn't been for the recent DOD government contract renewal, do you think MS would be so hot to trot to respond to problems like this?
Having watched and used MS's products for as long as I have, my personal opinion is that they've got a long way to go still and they aren't breaking even.
Re:No? (Score:4, Insightful)
However, I also think that the community as a whole is a bit irresponsible. If you should something long enough, soon people will hear you... and when I find people I know talking about Linux who really don't know anything about computers, I'd say the voice of the community is certainly reaching the average user. The FUD coming from this side of the fence nearly equals that of Microsoft. Despite what everyone thinks, Microsoft isn't necessarily out to get everyone when they change their EULA that allows them to do something they couldn't before... companies have to cover themselves from frivolous lawsuits as well, and I would think that Microsoft is more wary of this due to the hostility and negative image with the courts.
So, after so much screaming and yelling that Microsoft's updates are the devil, is it any surprise that people have learned how to disable it?
Re:No? (Score:3, Insightful)
It's a hassle. (Score:3, Insightful)
Re:It's a hassle. (Score:3, Informative)
Re:No? (Score:3, Insightful)
No, actually many users disable auto update because Microsoft has a history of releasing updates that break other functionality. When your business or work relies on computer uptime, having this broken functionality happen is unacceptable. Therefore many folks 1) test the updates on non-essential systems
Re:No? (Score:5, Insightful)
(as equivalent as the holes that have found to be in all nt based ms os's)
-
Re:No? (Score:3, Informative)
A kernel, by itself, doesn't open any ports on the outside world.
Of course Microsoft is to blame for this. They know
a) users rarely change default settings
b) rpc ports are open by default
If Microsoft took the very tiny but reasonable step of making the RPC port closed until sharing is enabled, then Blaster wouldn't have done much.
Likewise, Microsoft knows that users are horrible at patching systems, and should have a better system in place fo
Re:No? (Score:5, Funny)
If he did, two minutes of reading slashdot would be enough to drive the guy to suicide.
Re:No? (Score:2)
What makes you think that Bill does not read Slashdot? Plenty of Microsoft employees do.
If you want to find out his nym, simply look for the posts that start off 'I don't understand' and then go on to list some issue he has with the way windows or some other computer program works.
Bill is just a geek like you or me with slightly more money.
Re:No? (Score:5, Funny)
His money. If *you* had all those billions in the bank, would you be sitting here reading this drivel?
Re:No? (Score:5, Funny)
Re:No? (Score:3, Funny)
Check out his slashdot page: Bill Gates [slashdot.org]
Obligatory quote from "The Rock" (Score:5, Funny)
Re:Obligatory quote from "The Rock" (Score:2)
Re:Obligatory quote from "The Rock" (Score:3, Funny)
Re:Obligatory quote from "The Rock" (Score:2)
Sean Connery said that. In 'The Rock'. The movie. Like 8 years ago. That movie was badass. Nicholas Cage. Sean Connery. Need I say more?
STFU before you get slapped.
Fear of lawsuits? Bah! (Score:5, Funny)
A SoBig Achievement (Score:3, Insightful)
Re:A SoBig Achievement (Score:2)
Re:A SoBig Achievement (Score:4, Interesting)
Re:A SoBig Achievement (Score:3, Insightful)
I'll rescind a few earlier statements I said right now. There is evidence that SoBig might have been a factor in the power outage a couple of weeks ago. In which case, SoBig's damage probably is over $14 billion.
Re:A SoBig Achievement (Score:5, Interesting)
They'd figure out some way to make it possible to run your Windows XP Pro system with a Limited (i.e. non-root) account without rendering it totally useless.
The few programs I've actually managed to get running on a Limited account still don't seem to have the access they need to SAVE THEIR SETTINGS... So they need to be reconfigured every time they load up.
And the only way I've figured out for dealing with that is to temporarily add the Limited Account to the administrators group, pull the network cable, log in with it like that, make the changes, log back out, remove it from the administrators group, reconnect network cable and run Ad-Aware and pray nothing went horribly wrong.
Which is a bit of a hassle.
Re:A SoBig Achievement (Score:3, Interesting)
Holy jesus you just described an administrative nightmare. Do you really think this is the solution? Here, let me offer you an alternate scenario which would address the problem much more nicely.
Re:A SoBig Achievement (Score:3, Insightful)
Not quite. What they should do every time they make a critical patch is mail a CD to the owners of every single licensed copy of Windows that conains both the patch and an updated full Windows install image.
That way, dial up users won't have to tie up their phone lines for hours to retrieve these updates, and whenever people reinstall Windows from scratch, they aren't forced to put a bug-riddled version of the OS on the Internet to g
Huge loss of money (Score:5, Insightful)
Like you, I find the $14B figure highly suspicious. However, I cannot help but notice how much things add up. My company's cost for the last few virus/worms is tens of millions in helpdesk time (all metered, hence easy to count), plus lost productivity. Take a high-level engineer whose lab time, including salary, equipment, real estate and benefits come to $250/hour. Have him spent the morning fiddle with his Windows machine that has to be brought up to the last service pack, then rebooted 3 times, then he has to download and install three patches from saturated servers... (even if the guy actually never caught a worm and wasn't dumb enough to open an attachment titled "Free XXX Pics!", Networking won't let him reconnect before he patches his machine). And even on machines that said engineer has carefully kept patched, Networking insist that he downloads and runs an update verification program that will certify this machine is indeed patched. Oh, and the verifier is a bit buggy so on some machines, you need to tweak it before it runs correctly.
And soon your cost is a cool grand. Multiply by many, many instances all over the world for every outburst. It adds up quickly.
Meanwhile, of course, the Linux machines in the lab are perfectly happy. It's just that the engineer needs Windows to access his email because of the boneheaded all-Windows desktop strategy that the higher-up morons barfed on unsuspecting cubicle dwellers. But that's a different problem.
Don't tell me that these procedure are wasteful and inflexible. I know it. Unfortunately, that's still better than sending helpdesk technicians to each machine, which is even more costly.
So the total figure can easily come to billions because of the huge mandatory waste of time to update and run the verification program on each machine.
Right now, this weekend, in many colleges and universities, thousands of IT depts and student/faculty helpdesk techs are running around like crazy patching machines of students coming back to school. The cost for our local college alone (5000 students) is estimated at $15-30 per student. Do the math.
Conclusion: The $14B might well be optimistic after all.
Virus Cost Statistics, Microsoft's DOS Attack (Score:5, Informative)
So be surprised.
Here are some virus costs from Wired [wired.com]:
Nimda -- $635 million
Code Red -- $2.62 billion
SirCam -- $1.15 billion
Love Bug -- $8.75 billion
While we're looking at statistics, here's another...
According to CERT [cert.org], the number of reported security incidents grew, starting in 1988, until they hovered at just over two thousand incidents per year from 1994 to 1997.
But then in 1998, the number of incidents started to explode:
1998 -- 3,734
1999 -- 9,859
2000 -- 21,756
2001 -- 52,658
2002 -- 82,094
2003 -- 76,404 (so far)
So what happened in 1998?
Microsoft introduced embedded e-mail scripting in Outlook Express!
Even an idiot could have predicted the consequences.
But why would Microsoft do something that was so clearly incompetent and irresponsible?
The answer can be found in another event that occurred in 1998, namely, the leaked release of the Halloween document [opensource.org]. That internal Microsoft document described a strategy for fighting Open Source, as follows:
> OSS projects have been able to gain a foothold in many server applications because of the wide utility of highly commoditized, simple protocols. By extending these protocols and developing new protocols, we can deny OSS projects entry into the market.
So there you have it. The embedded scripting in Outlook Express is just one part of a general Microsoft strategy to decommoditize (i.e. break) Internet protocols.
In other words, these viruses and worms, which are costing us $billions, are just a side effect of MICROSOFT'S EXTENDED DENIAL OF SERVICE ATTACK ON OPEN SOURCE USERS.
If Jeffrey Parson might be going to jail for his denial of service attack (modifying the DDOS Blaster worm), then why not the president of Microsoft?
Reg Free link (Score:5, Informative)
Link [nytimes.com]
Easy math. (Score:3, Funny)
x+50%(where x = 0)
You can alter the percentage to taste, Bill does.
Google News to the rescue (Score:2, Insightful)
Please. (Score:4, Insightful)
Re:Please. (Score:2)
Billy and his monkey-dancin' posse were constantly rewarded for their Bad Code Production Line {tm}, and it's twice more the pity th
What about licensing? (Score:3, Insightful)
"Sorry, we haven't installed the blaster update because we have not yet cleared the EULA with our lawyers..."
While that update may not have something previously unseen in it, we have all seen this in security updates and in media player u
Nothing wrong with what they could do... (Score:3, Insightful)
Linux/GNU is dependent on developers checking theirt own code and the results will vary, and exerience will not be instituionalized.
Really? In my experience, there are quite a few people that "check out" the code without actually developing it. Not to mention people testing out automatic error detection systems, I know Linux has been getting good help from research in that area.
Can someone please explain why after the
Dear Bill ... (Score:5, Interesting)
Far and away your #1 bug is the infamous "buffer overrun" flaw. These usually mostly manifest themselves in string libraries. I know that you have at least 3 library solutions in-house (Safestr for C, CString in MFC, and basic_string in STL) but your developers don't use them otherwise these problems wouldn't happen.
I'd like to point you out to another alternative:
http://bstring.sf.net/
Which your developers may prefer. But whatever you do, why don't you simply make it a requirement that <string.h> simply be outlawed (you could easily write a tool to enforce that couldn't you?), or take some other drastic action?
Buffer overruns are certainly the most common kind of bug that isn't caught by QA (the right answer is not to try to train QA to find them -- they would require the skill of a hacker.) If you concentrate on this one bug alone, you will probably easily remove 80% of these attacks.
Re:Dear Bill ... (Score:3, Insightful)
- programmer ignorance
- management blindness
- marketing pressure
- auditing failure
Even if only one of the above factors was strongly mitigated you would get a massive reduction in these slipping through.
At the very least, there must be
Windows is more secure than Linux! (Score:5, Funny)
Why should Microsoft fix anything? Window's is the most secure OS according to http://www.wininformant.com/Articles/Index.cfm?Ar
Re:Dear Bill ... (Score:2)
Works for me but I'm an expert user (Score:5, Interesting)
article (Score:2, Informative)
August 31, 2003
Virus Aside, Gates Says Reliability Is Greater
By JOHN MARKOFF
MICROSOFT, the world's biggest software maker, is the biggest target for computer viruses like the SoBig.F worm that wreaked havoc two weeks ago. Bill Gates, Microsoft's chairman and chief software architect, talked last week about what it is doing to keep hackers at bay. Following are excerpts from the conversation.
Q. You wrote a memo last year ca
Oh just steal Linux already! (Score:5, Funny)
Steal the fucking Linux Kernel slap a Windows sticker on it sue the GPL out of business and give us One OS To Bind (not BIND) Them All already.
You ripped everything else off, how about ripping off so fucking security?
Re:Oh just steal Linux already! (Score:3, Funny)
Then SCO will sue them for using their patented business plan without a proper license.
Re:Oh just steal Linux already! (Score:2)
KFG
4 Open Ports (Score:3, Interesting)
Windows is not secure. Instead of fixing little problems like this that are incredibly simple, they decide to invest billions of dollars into programs like Palladium which will, among other less desirable things, make the platform "more secure" both from the outside world and from yourself. Figure your shit out Redmond, please (by Redmond I mean Microsoft, not Nintendo America).
Re:4 Open Ports (Score:3, Informative)
Rubbish. Mandrake, at least, runs a number of daemons by default if you install them (such as sshd), and warns you about this fact at install time. Depending on the exact choices you make while installing it, it's entirely possible to have half a dozen or more ports open.
OpenBSD (Score:5, Informative)
Rus
Re:OpenBSD (Score:3, Informative)
By default (on OpenBSD) sshd uses an unprivileged child process to deal with incoming connections, and the OpenSSH project is maintained by paranoid people that spend more time auditing code than writing code.
Re:4 Open Ports (Score:3, Interesting)
My mothers WinXP (IIRC: Home, Dell installed) computer was also using uPnP to open a ~65000 port wide hole in my router firewall by default. Fortunately uPnP wasn't really necessary and could be disabled.
Gates is on top of it, I'm sure! (Score:2)
**** SPAM **** (Score:2, Funny)
AUTHOR_JOHN_MARKOV (20 points) Article written by John Markov
Get off the Bashing Kick (Score:4, Informative)
Comment removed (Score:4, Interesting)
Re:not without inspecting it! (Score:2)
You know that you don't have access to ANY (original product and patches) MS code, why did you install their product in the first place?
Or are you trying to be cool by repeating stuff you've read here?
Re:Get off the Bashing Kick (Score:3, Insightful)
Great. So my choice is to remain vulnerable to a hole in Windows, or install a patch that brings a draconian EULA that allows MS to do whatever it wants with my machine. Remind me again why Windows is a good choice...
Re:Get off the Bashing Kick (Score:5, Insightful)
Trying harder isn't enough. (Score:3, Insightful)
Microsft software was never designed with security in mind. And it was and is not their primary goal, even now. It is quite different than non-Microsoft software.
If security were *that* important, wouldn't they take some of those many *billions* and actually make that silk purse?
Consider even just today's news post on Slashdot. Each and every one of them is about Microsoft is about money, and *not" about fantastic security advances. And yet the security problems plague us everyday.
Microsoft Introduces IM Licensing [slashdot.org]
Microsoft vs. Burst.com [slashdot.org]
If people would JATDP (Score:3, Informative)
I use both Mac OS X and Windows XP. On both systems, I use the software update mechanisms and religously apply the patches that are made available. On Windows I also have a virus protection utility in place. I have never once been caught with my pants down by a worm, virus, trojan horse, etc. And to answer the question of this out there that are already preparing to ask it, I have also never had my system "broken" by a patch.
So my respone, is that people shouldn "Just Apply The Damn Patches".
Jordan Dea-Mattson
Posting from China, where I am to adopt my daughter! Back to the US in a week!
Re:If people would JATDP (Score:2)
But unlike with OS X, when you faithfully download those Windows patches, you introduce ugly [theregister.co.uk] and scary [sillydog.org] conditions into your computer. Basically, with Windows you just can't win.
Maybe if Bill would just STFM (Score:2)
When Bill Gates spends the fucking money, we wont have to patch the software every second of every day.
Yes every OS needs patches, even Linux and OSX, but on Linux and OSX, most of the bugs are in server software like Apache, not bugs in the Kernel itself!
Maybe if Microsoft released a better OS itself we wouldnt have to worry about our computers being hiijacked via a simple virus, perhaps if the OS didnt run in root all the time, perhaps if they checked for buffer overruns and used their damn money we wo
Re:If people would JATDP (Score:2)
Well that's the whole problem isn't it? "Just apply patches". Unfortunately, even the concept of a "patch" goes way above the heads of most Windows users I know. No one bothers to apply patches until they've been bitten. Now any properly administered box can be secure, even Windows. But administration of a Windows box isn't as easy as using it.
I hear a lot of Microsoft apologists say "oh you Lunix people don't understand normal people
Re:If people would JATDP (Score:3, Interesting)
But yours is only one system. Hardly what one would base statistics on.
OTOH, one of the websites I visited daily was down last week for 5 days. Finally it was only through *expensive* paid help calls to Microsoft that got it fixed. And it was the application of this last round of patches that killed it.
My own experience as a sysadmin and company PC guru is similar. Patches don't cause a problem *most* of the time. But now and then they kill a machine
Linux Consultant's Dream (Score:5, Interesting)
Concerned about the impact of viruses like Blaster and SoBig on your business? Look, here's what Bill Gates has to say on the issue. Even he's saying it's not going to get any better, so you can expect these kinds of incidents to keep recurring.
Now, let's talk about how to fix this...
What planet is this guy living on? (Score:4, Insightful)
The truth is, every other mainstream OS has solved the security problem better than Microsoft. Most other OSes, especially *nix ones, have a philosophy of least privelege. But not Windows - its big "innovation" is to bundle the (insecure) web browser directly into the OS and enabling all sorts of nifty auto-executing controls so that drooling little kiddies all over the world can pass the time by bringing random network-connected Windows machines to their knees.
The usual refrain from Microsoft and its apologists is that its software is attacked so much because it's so popular. No. It's attacked so much because it's so easy to do.
Other than that Mrs. Lincoln.... (Score:2, Funny)
Er (Score:3, Funny)
Time to get the tin foil hats out again. Longhorn is going to affect the part of your brain that writes worms...
Why does a home system need RPCs? (Score:3, Insightful)
Would you please point out one benefit this provides to the average home user?
Gates needs to read /. (Score:5, Funny)
"Q. You have enemies who are in a crusade to undermine Microsoft. How do you cope with that?
A. I'm not aware of any systematic attempt by any group. "
Re:Gates needs to read /. (Score:2, Insightful)
We're doing our very best, and that's all we can. (Score:2)
I cannot believe it: Bill Gates publicly stating that they are unable to fix the problem!
Unfortunately most of their customers will not understand and stay with the company that cannot fix their problems.
MS Best? (Score:2)
anything less is a con game!
Best they can do? (Score:2)
That's sad.
-Pete
Double-speak blame shifting (Score:5, Interesting)
This is double-speak. He is trying to imply that people's failure to auto-update is somehow related to Windows' risk of virus/worm attack. But they are in no way related.
System architecture that fails to maintain security is a design flaw, not a maintenance problem. Gates and Microsoft are attempting to blame shift their responsibilities to their product's users. Pretty much anyone would recognize this in a tort law suit, although I expect very few to make this claim in court simply because of Microsoft's size and reputation.
Best? (Score:3, Insightful)
In the words of George Carlin: "If this is your best, perhaps you should keep it to yourself."
Gates and the Chewbaca defense (Score:5, Insightful)
Before everyone starts chiming in on how real system admins would have been prepared. Remember a few things:
1) After being burned by a few bad patches, some corporations now have a policy that specifically states that patches must be tested first. With the huge amount of patches that is released by MS, this is a full time job.
2) Remote users (laptop users, VPN users, etc.) are like sailors coming back from overseas. Who knows what they were exposed to and what viruses they have. This is outside the control of most admins.
3) Microsoft itself was not prepared for Slammer. SQL servers that were being used in a development environment (read outside of normal sys admin networks) were not patched. With large organizations, sometimes there are unknown, rogue installations.
Bill. stop the lies.. (Score:3, Insightful)
Ahh their position for everything. The RPC 026 vunerability was discovered by a 3rd party.. not Bill's code reviews. The vunerability was in OLD code that existed back on Win 95... carried forward to the current versions. Even for those that deployed the fix, unless you had 100% coverage, you suffered the effects (Blaster.D ping traffic). And of course you lay blame with the very people that support your defective products (it's THEIR fault the fix wasn't applied).
Great question, lame dodge.. and the 'solution' you propose will not fix the problem, but will only satisfy another agenda.
Understand this, Gates: MS products are riddled with vunerabilities by the nature of your very development process. Peer review process is either non existant or done by folks who wouldn't know a Buffer Overflow if it smaked them over the head. Your programmers can get away with writing crap and because of the development model and your tight release schedules are forced to use 'quick and dirty' rather than 'quality' and 'wide peer review'. Code is slapped together and tucked away in a vault never to see the light of day... and forgotten. That is the best you can do with your business model - and it is not good enough and never will be.
Give me open source any day: worldwide peer review.. garbarge code is rejected and sent back, fast. A developer learns very quickly in this development model to use best practices or face rejection. Can't get away with 'quick and dirty'. And the funny thing is this cannot be bought. IBM realizes this.
Lawsuits won't fix this.. Marketing slogans won't, either. Insecure by design.
It's just like Mom and Dad (Score:5, Interesting)
Remember when you wanted to go out somewhere with some friends of yours and your folks didn't? They did that for your own security and wellbeing. In some cases, you probably had a parent that was easier on you. For example, my dad was the "soft" parent for me. If I asked him something, he'd cautiously say that I could do X as long as I was home beore my mom found out. If I asked my Mom, the answer was most positively one of the following:
1. No!
2. Only if you've done everything else you need to do to get some free time.
3. Why would you want to do that? Go do something useful.
So you can guess which parent I asked more often. I asked the parent that gave me what I WANTED, not what I NEEDED.
Microsoft is the "soft" parent. They give the average user what they want without thinking too much about what the implications are. Or they assume that the user will "do the right thing". *NIX/Linux distros are the "hard" parent since they don't (by default) allow the user to do anything they shouldn't be doing. It's a pain in the ass to have to switch over to "root" to take care of some administrative tasks in Linux. Newer distros make it a little easier, but they still throw up the password protection which would annoy an average Windows user to no end. Think of how many times a Windows user complains when they have to remember a password and they can't or they have to write it down somewhere. Windows doesn't do this kind of thing. Instead they thwart security by being the "nice guy" on the surface. I have plenty of friends who got pissed off having to deal with passwords on their boxes and logging out to become administrator. They eventually all asked me to reconfigure them so that they log in as admin by default automatically with no password. I told them what the implications were and they still wanted this. The real problem still comes down to lazy and uneducated users. The PC industry is giving them the keys to Ferarris and nukes even though they aren't qualified to handle them.
I think that eventually it will become necessary to give people what they need with no respect given to what they want. However, it doesn't have to be impossible to deal with from the end user's perspective. I think RedHat's root dialog box when trying to run an administrative command from the GUI is a perect example of how it can be made slightly easier, but still secure.
Until the average user understands why they SHOULDN'T run as root or Administrator, we are giving them loaded weapons pointed at their heads without telling them how to use them.
Why is the stack still executable? (Score:3, Informative)
At least, the problem seems to have been fixed in the x86-64 hardware, but the operating systems need to take advantage of it. See here [x86-64.org].
So when will we see M$ take advantage of good simple security features in the hardware instead of trying to invent new fantastic schemes (Palladium)? Why wasn't buffer overflow attacks fixed 5-10 years ago? I'm not sure if earlier x86 chips allowed non-executable stacks, but if M$ were serious about security, they could certainy have requested that feature from Intel. It's not rocket science.
Good Idea to make MS fix it. (Score:3, Interesting)
Re:Best? (Score:2, Insightful)
A patch for the blaster worm came out before the attacks. People [regardless of the OS] are just too stupid to run the fucking update process.
Even if they ran FreeBSD they'd have to keep ontop of updates. That is unless they want their apache server to get rooted or their ssh daemen pwn3d or their wuftpd completely j4ck3d.
Tom
Re:Best? (Score:2)
Re:I say Debian Gnu/Linux reliabity sucks. (Score:2, Informative)
I have three Debian stable installs here, all using ext3, yes, ext3 filesystems. How did I do it?
Well, I could boast about my l33tness, but I just selected the 2.4kernel install option from the menu, and then when it asked me to choose a filesystem, I had reiserFS and ext3. W00t!
So, it's not really that hard now, is it?
David
Re:I say Debian Gnu/Linux reliabity sucks. (Score:2, Interesting)
Re:Just Great (Score:5, Insightful)
If by reliability, you mean it's ability to function in a proper way without self-destruction, I'd say he is succeeding. Windows XP is indeed better than the previous offerings. Once upon a time, you didn't even have to touch your computer and it would spontaneously have problems. It has gotten much better. Now, it's resilience against the evils of the internet...
That's another story. Indeed, Gates should institue a moratorium on new projects until the old ones can become stable enough to actually properly handle the internet.
Sobig.F is a good example of how fundamental the problems with Microsoft software is. The changes required to secure (pick one: Windows,IE,Outlook,Exchange,IIS) need to happen at the API layer. Unfortunately, this would take industry-wide support, something not even Microsoft can make happen overnight. It would seem with all the money companies already have invested, there is a lot of corporate inertia to overcome.
Re:Just Great (Score:2, Insightful)
Re:Just Great (Score:3, Insightful)
Re:Just Great (Score:3, Interesting)
Nobody seems to be patching their Outlook Expresses.
Re:Just Great (Score:3, Insightful)
Re:Just Great (Score:2, Insightful)
MS give people what they want, not what they need. Combined with their marketing bulldozer, ofcourse they're selling well.
If any other OS should have a chance to compete, it'll need to think about what the end user looks for, not what they should be looking for.
With the resources of the OS community it's not at all impossible to create something secure, but still as userfriendly as Windows.
Bill Gates has bugs in his brains OS. (Score:2)
I mean look at the guy, he has what? 40-50 billion dollars? Then you have Microsoft with maybe 50-100 billion dollars in excess cash just sitting in the bank.
Something is wrong with this guys brain if he cant spend a penny of his money to fix his OS even when little script kiddies are hacking it.
I mean come on, we have governments, (including ours) using this piece of shit OS, we made this piece of shit Bill Gates the richest man in the world, and he cant even spend his money?! Whats his plan? To put all
Re:Bill Gates has bugs in his brains OS. (Score:3, Interesting)
How's that for perspective.
Re:Linux is unstable lol! (Score:3, Redundant)
Think linux is stable? Well your wrong! Copy and paste (thats if X's crappy mechanism lets you) this into your nearest xterm and watch the fun!
man bash
/ulimit
ulimit [-SHacdflmnpstuv [limit]]
Provides control over the resources available to the shell and to processes started by it, on systems that allow such control. The value of limit can be a number in the unit specified for the resource, or the value unlimited. The -H and -S options specify that the hard or soft limit is set for
Re:Linux is unstable lol! (Score:3, Insightful)
bash-2.05b$ echo "main(){for(;;){fork();}} | gcc -o crashlinux && chmod +x crashlinux &&
>
bash-2.05b$
Seriously: 'format c: \q' should do more than that, but you had to create some smart script and hope that we added an extra '"'