Gates on Winsecurity 543
xandroid writes "Just a couple days after talking about free hardware, Bill Gates has sent an email to customers saying that Microsoft will continue to focus on security, titled 'A Microsoft Progress Report: Security' (MSNBC story, PC Magazine story, Google News' related stories). The email mentions that fast-spreading and destructive viruses and worms are 'threatening the potential of technology to advance business productivity, commerce and communication', but says that to counter the threats, Microsoft will make 'major investments in customer education and partnerships that will help make the computing environment safer and more secure'. He also talks about the XP Service Pack 2, and says that Microsoft is 'working with microprocessor companies, including Intel and AMD, to help Windows...support hardware-enforced data execute protection (also known as NX, or no execute)'." Reader Zephyr_in writes "Macworld reports that the beta-release of Longhorn is likely to be postponed to early 2005 because Microsoft is concentrating first on a security-focused update (SP2) to Windows XP. Earlier this week Gates said Longhorn is 'not a date-driven release.' and said the speculation that the operating system will come out in 2006 is 'probably valid.'"
Well.... (Score:2, Insightful)
I don't know about that.......seeing as how I use OS X, I have yet to experience downtime or hassles due to viruses or worms. Of course there are problems with an increased number of emails from Windows machines containing worms and such, but they are simply filtered out via the spam filter. So this statement from Gates only r
Re:Well.... (Score:5, Insightful)
Which is 90% of us, so get over yourself. OS snobbery is obnoxious.
Re:Well.... (Score:3, Insightful)
Its been said over and over: OS's are tools, they all have their strengths and weaknesses, use the right one for the job.
Re:Fine, whtever. (Score:5, Funny)
Do not tempt the gods that way. You're just asking for something.
Re:Fine, whtever. (Score:3, Funny)
Are you sure? SOMETHING'S got your keyboard fucked up.
Re:Fine, whtever. (Score:4, Insightful)
In the words of some of the security professionals out there(from the people at @stake and foundstone):
If you have never been hacked [sic] you are either too small a target to be worthwhile, or, you have been hit, but are not good enough to notice.
Amongst security professionals, you are rated good if when asked how many times have you been hacked in the last 5 years, and your answer is "once or twice". If it is "never" that is almost as bad as "lots".
Re:Well.... (Score:3, Insightful)
So explain all the internet worms that have brought the internet to a crawl and infected from machine to machine with no user intervention.
Windows has a 20% share in this market. Apache is 70%.
*All* of the worms are for Windows and Windows only.
That was the sound of your argument crashing down around you.
Security thr
Re:Well.... (Score:5, Insightful)
How long has linux existed, and how many worms have there been? Or applications: 2 apache worms or so? and apache is by sheer numbers, what? 60% or more of the webservers on the internet. (lets assume there are actually a dozen apache worms since 1992, if there are even that many, that's one a year.) How many IIS worms are there?
How many worms have been able to break into the kernel itself? Oh, given the couple of kernel bugs, it was possible, but they were all local exploits. Which requires the code to be run on the system as opposed to things like the Classic MacOS had some virii for it, but compare the length of time it had been out (and how it was the GUI computer for quite a while) 16 years or so (1984-2000) Over that time, there were probably less virii for it than windows 98 got in the first year. (Probably partly because as an OS it was one of the dumbest in terms of networking, you couldn't do anything with it.)
MacOS X has been out for around for 4, and the number of worms is comparable to those for Linux, as in almost nothing.
I expect when Longhorn comes out, there will again be another torrent of worms. But maybe Microsoft may be getting it together with regards to security. They did a pretty good job of stability with 2000, but backslid on XP.
Even if Linux/KDE became as dominant as dominant as Windows is now, the problem wouldn't be nearly as bad. You see, Linux distributions (almost all? and the people who aren't should know what they are doing) use package management. This means that instead of running an installer for program a, b, c off of cds or the internet, they use packages provided by people who they can check cryptographic signatures of automatically, for example with rpm. Now, that's not perfect, and you don't have to have that, but it gets people into a method of expecting part of it to come from a trusted source (eg gentoo which provides md5sums of all the packages downloaded. or rpm which allows both server and developer signatures last I looked.) The distribution is EXPECTED to provide this, and if they don't either the user doesn't know enough to get it, and askes someone else for help, or knows enough to figure out that www.warez-cracks-hijacking-your-game.com is not a good site to get things from.
Linux most-breached (Score:3, Interesting)
I seriously doubt Windows is inherently more secure--the fact is, that operating is in use by some 90% of computer users, so it's not unreasonable to expect that things are going to get through once in a while. In that regard, Windows has the potential to become more secure than Linux simply because it's so much more field-tested.
You mention that Longhorn will ship with worm vulnerabilities, without r
Re:Linux most-breached (Score:3, Informative)
In Longhorn "most everything" won't be sandboxed at all. Longhorn has to retain backward compatibility with most existing applications out there otherwise people won't upgrade to it. And i
Re:Linux most-breached (Score:5, Insightful)
There's a *BIG* difference between "a hacker 0wn3d my b0x" and "Some VB script 0wn3d half of the windows boxen on the internet, automatically, without any manual interaction from the hacker".
Re: The point everyone misses (Score:5, Interesting)
For the virus to be executed, it would have to be saved to disk and then have the execute bit set. For it to do this automatically, that would involve executing, which it doesn't yet have permission to do.
For a user to execute it, they'd have to save the attachment, switch to their file manager, change the permissions on the file, then run it. That's one more step that is require on Microsoft Windows, and following the data that's more than 2 clicks away is too far away rule, a lot of people won't bother if it takes that much effort.
Most operating systems have this feature built in. If Microsoft were competent enough to have it built into Windows, there would be no need to go chasing the CPU manufacturers.
Re: The point everyone misses (Score:5, Insightful)
Now, for most users, It's not the 2 clicks away is too far rule... it's called you need an administrator password to install anything rule. This is why people tell you to not log in as root. (and why the root account is disabled by default in OS X) Now when you double click that attachment and instead of opening a document, it prompts you with the password dialog box, alarm bells should start ringing.
Oh and most archival programs will save rwx flags. So while it's harder to get a virus, never underestimate how stupid people can be.
Re: The point everyone misses (Score:4, Funny)
Tell someone there are 100 billion suns in the Galaxy, and he'll believe you. Tell him a bench has wet paint on it, and he has to touch it to make sure.
Re: The point everyone misses (Score:3, Insightful)
Saying that forcing users to enable an Execution Flag on files before you can run them, is a 'security feature' is ignorant. There are plenty of plain file formats that can contain executable code in them, and an 'execute flag' doesn't do anything to solve t
Re: The point everyone misses (Score:5, Insightful)
Java VMs (at least the real Sun versions) have a security policy which prevents applets writing data to anything other than the domain from which they came. i.e. if it came from the internet, it cannot read/write to any arbitrary part of the local filesystem unless you change the security policy manually.
"Plain file formats" do not contain executable code. They might contain code that can be interpreted. A perl file downloaded from the Internet for example cannot be run by typing
I'd agree that any point-and-click GUI that lets users run interpreted code from files like that is missing something in the security department.
The execution bit being a security feature is a fact, not a sign of being ignorant.
Re: The point everyone misses (Score:5, Interesting)
So UNIX users are actually three steps removed from dangerous attachments, but seriously will KDE and GNOME eventually bring in traditionally Windows specific security issues inadvertantly by trying to mimic the Windows environment?
Re: The point everyone misses (Score:3, Insightful)
Unix/Linux users are one step ahead of Windows as far as standard viruses go, but they're a long way off as far as worms go. I'm not aware of any mail clients in KDE or Gnome that support scripting, and if one did appear, I don't see why people would switch away from the current range of excellent apps like Evolution and KMail/Kontact.
If one of those did start supporting
Re:Well.... (Score:3, Informative)
Those of you who assume that the rest of slashdot is just like you are truly naive.
Re:Well.... (Score:4, Interesting)
I disagree. The "smacked asses" are starting the problems, but the operating system is turning a very small problem into a very large one.
To use your drunk driver analogy, suppose 90% of the cars on the road, made by "Fireball Motors Corporation", suddenly exploded when even tapped by another vehicle, let alone a full collision. Even worse, after these cars become rolling fireballs, they suddenly accelerate wildly and run into as many other cars as possible, which of course turns them into rolling fireballs. Of course, this isn't much of a problem if everyone drives perfectly and never makes a mistake, but every Friday night, a few drunk drivers accidentally run into other cars, causing the freeways to turn into massive infernos. A few people escape unharmed, because they bought cars from Orange Motor Corp., Banana Motors, or built their own. These other cars just get a little dent when a Fireball car hits them. However, every Saturday after the morgues have processed all the charred bodies, the victims' families cry about the drunk driver that caused the tragedy, but no one ever considers getting rid of their Fireball car. When an Orange driver asks them why, they say they like the knobs on the stereo better, and are willing to risk their life for that. Then the Orange driver throws a rock at their car and laughs as it bursts into flames.
Sorry, but given the risk you run by sticking with Windows, I have no sympathy for you at all, and I'll laugh when a virus or worm wipes out your data. It's just a matter of time.
Me Too... (Score:3, Interesting)
I'm not going to get into an OS war but I also have not had any downtime due to a worm or virus on my Windows XP box. This is because I do not open e-mail attachments, run a hardware firewall, and keep my system up to date with the latest patches and virus definitions.
I also have a G4 running OSX and an older PC running SuSE. My favorite is the G4 not because I am a Apple zealot but because I like the interface. I didn't like Apple b
Re:Well.... (Score:5, Insightful)
Mod me offtopic... Windows and Windows software is insulting. No, it doesn't suck. It's very good, but it's insulting. UNIX is the same way. It used to be I could just pop in my software, install it, and begin operating it. At most I'd have to supply a serial number. Fine.
But now, the act of purchasing, installing, or using Windows software forces me to put up with accusations of fraud and theft. Please comment if the following list of insulting behavior is incomplete:
It's reasonable that software publishers want to curb piracy, and I know that these methods can be effective at preventing regular people like me from stealing. But Windows users have come to accept this presumption that we are criminals trying to take advantage of some poor software publisher; that we are not to be trusted; that we should be prevented from doing anything bad with our computers. Maybe some of us are, but I don't like being put in an adversarial position vis-a-vis my software and my computer. Essentially I have to provide picture ID everytime I want to do something new on my computer - and as a hobbyist, I enjoy doing new things. All I ask for is that Microsoft trust me and show me respect as a registered user who has owned every version of Windows and Windows NT since 1.0. I also ask the same of other other software companies too.
Imagine if restaurants behaved the way software companies did everytime we wanted food.
Here's where I believe the true benefit of Linux and FreeBSD comes into play. Open Source advocates talk proudly about freedom, but I haven't heard anyone address dignity attacks Windows users regularly submit to. When I install Linux, I know that, with a few exceptions, I won't have to deal with the issues I listed above. I know there are no real deep pockets in the Linux business, but someday I would like to see a national advertisement for Linux aimed at desktop users where the central point driven home is that personal computer users can gain back that dignity they lost over the last 15 years. Flame away.
Re:The REAL security problem in '04 (Score:4, Insightful)
You, sir, are an asshat.
A properly designed system is not harmful to other properly designed systems. Windows is not properly designed. OSX (and BSD and arguably Linux) are properly designed.
Re:The REAL security problem in '04 (Score:5, Insightful)
I KNOW how to spend all day trying to configure various things and optimize them for security and use. However, sometimes, I don't feel like reading through piles of security docs just to make sure I can feel safe plugging my computer into a cable line. It's nice to have things just work, and work securely, right out of the box. Apple, however, has provided an operating system whereby I can spend endless hours tinkering with settings, in both a CLI and GUI environment; but by no means do I have to do this in order to get my computer working securely. The best thing you can do for a clueless user who just wants to check e-mail is get them an eMac or iMac. No fancy cables to plug in, no massive suite of security software to install -- just turn on OS X's firewall (built on that rock solid BSD standard ipfw), set up mail.app for their e-mail and get Safari or Mozilla Firebird to start blocking popups. Instantly, they're secured against anything except a direct, targeted attack against their computer. Worms, trojans, spyware... not a problem.
Re:The REAL security problem in '04 (Score:2)
Re:The REAL security problem in '04 (Score:4, Informative)
Re:The REAL security problem in '04 (Score:5, Insightful)
Ah, but they are also used by the most advanced computer users out there. Those that use them for a variety of fields in science from quantum chemistry to astrophysics, medicine and computer science. Pretty impressive that.
This is a dangerous mindset to encourage. Their computers are set up to do everything for you, to treat the user with a kind of benevolent contempt.
What is a dangerous mindset? Allowing people to be connected? Allowing them access to information? What are you going to say next......That people should not be able to vote for whom they want?
As to doing things for you, yeah, when I want to plug in a hard drive, it is automatically mounted and I don't have to type in the CLI two or three lines of commands to get it mounted and shared. There are many other examples of this and why you perceive this as benevolent contempt completely escapes me.
Some recent pricing of upgrades illustrates the kind of attitude Apple has to its customers.
This leap of logic is confusing. And what recent pricing are you referring to? Can they not expect to make a profit on their investment? Be thankful Microsoft has some minor competition, or else you might be paying more than you might think.
Only the ignorant? (Score:3, Insightful)
Trust me, I am not "proudly ignorant". I use Macs because they're better. Period. I am not genetic
Re:The REAL security problem in '04 (Score:5, Insightful)
I think most people will agree most security problems boil down to one simple thing, the stupidity of the user
Your missing the whole point. The users aren't stupid - they don't care. Computers are not an integral part of their life as they are probably are for you. Hence implying they are stupid because they can't spot a virus is just plain rude.
I have to ask if you know exactly what happens and what to do if your car suddenly stops for no reason. Does it make you an idiot if you have to ask for help ? No because for most cars are a tool not a lifestyle - just like computers.
Apple computers are created for, and solely used by people who know, and want to know nothing about computers, the "proudly ignorants".
Now that Apple is *nix based I find this kind of statement quite suprising. What a bunch of proudly ignorant [bioitworldexpo.com] people.
Apple computers yes do have the obscurity security benefit, however they also have intelligent default settings. Windows with XP SP2 will finally set the defaults to what they should have been from the start.
You are the ignorant one not the non-techie users.
Re:The REAL security problem in '04 (Score:2)
I hate Apple with a passion so I'd really like to agree with you ... but Windows claim to fame was it was easy to use compared to DOS. The thought was now that users don't have to manipulate the command line, more people would be able to do more with computers.
Remeber the two things they sold Windows 95 on? It's easy to format a disk, and easy to install programs. They lowered the bar but users as a whole responded by becoming even stupider.
Re:The REAL security problem in '04 (Score:3, Interesting)
Whats the result? Users don't even *crack* manuals open, they expect just to be a genius at anything they try. Then software companies realized "hey, nobodys reading these manuals"
Re:The REAL security problem in '04 (Score:5, Insightful)
I'd like to add to what you've said and point out that there is a difference between stupidity and ignorance. Stupidity is not being able to learn somethiing. Ignorance is not knowing something, but it doesn't exclude the capacity to learn. Most people, when it compes to the intracacies of the PC, are ignorant, rather than stupid. And they want to be.
For example, I don't want to know the specifics of which particular gasket a mechanic's going to tighten (or loosen) when he reapirs my car, I just want to get to work. I could, if I chose, get materials on automotive mechanics, find out this information, and be knowlegable, rather than ignorant, and even possibly do the repairs myself; but I have no need to know this stuff, so I remain ignorant.
IMHO, This has been one of the fundamental failings of understanding of the Open Source movement, as they try and move from the hobbyist to the mainstream. Doctors, lawyers, and other professionals have too much to worry about in their own fields to concern themselves with makefiles, mount points, and other intracacies of Linux. And, quite frankly, a large number of people simply don't care to learn this stuff, any more than I care to know exactly what happens when I turn the ley in my car to get to work. I just want the engine to start, and use my fundamental driving skills to get to work, or home or to the bar, or wherever.
Does this ignorance mean that I can't drive as well as someone who knows the full workings of an automobile? Certainly it does, however, there are indicators and saftey features in the car itself to protect me from my own ignorance.
This is part of what Microsoft has realized. They realize that people want to know nothing about how their machines work, they just want them to work. That's why their now working on protecting the ignorant user, rather bothering with attempting to educate them. For these users, it's better to put the govenor on the engine, the automated seat belt, and the airbags rather than trying to teach them to use a turn signal when they change lanes.
If Linux is going to embace the mainstream, they are going to have to embrace this ignorant user. Linux is going to need to be so simple that people aren't going to fear it anymore as a more complicated (albeit better performing, more stable and more secure) system than Windows. They're just going to put the cd in the computer, and drive away.
Re:The REAL security problem in '04 (Score:3, Insightful)
I'm reminded of that solid metal car that Kinsman (the Grey Lensman, in E.E. "Doc" Smith's series) got into... the one that went 7000 miles per hour, was absolutely completely lightlessly black dark inside, had no seat belts or other cushioning, and was driven by an alien of a species that can "see" through solid matter. The a
Proudly ignorant or TCO-conscious? (Score:5, Insightful)
Every extra hour that I am forced to spend learning how make make a computer do what it should have done in the first place adds $50 to the TCO of that machine. So if I have spend even one hour per week figuring out how to keep my machine safe from exploits, I've added $2500 to for the cost of that machine for that year.
I am not proudly ignorant, I only realize that my time is limited and that spending it patching gaping holes in a badly designed product is not top of my list of either fun or productive things to do. At best, you could call me resentfully ignorant because I resent that ignorance should be a problem.
I'm not even sure how you can blame Apple for much of the Internet's current dismal state of affairs. What percentage of viruses, trojans, spam, etc. are distributed via Apple machines?
But, as long as we are playing the blame game, I might as well burn a few karma points. Lets add some more culprits to the list:
1. All the IT vendors that touted software and internet services.
2. All the businesses and organizations that listened to IT vendor's hype and gave PCs to all their employees.
3. The original internet standards designer who gave us naive, overly-trusting standards that make it too easy for anonymous blackhats and spammers to send out untraceable virus packets and spam
4. CPU makers (and Gordon Moore) for giving us such a rapid pace of performance growth that no platform ever matures before it is replaced by another exploit-ridden next generation OS
I'm sure there are others.
Re:The REAL security problem in '04 (Score:5, Insightful)
Microsoft is constantly lauded by the press and the business world alike for bringing computers to the masses. A chicken in every pot and a Windows license in every home. And while that is a commendable feat, helping to spur the absolutely exponential growth of the internet and computing in general in the last few years, no one stopped to ask if the masses were ready for all this computing at their fingertips. Computers are powerful devices, and are becoming ever moreso with increased use of broadband internet. The potential for a computer to do serious damage is great, when the right person (or perhaps the wrong person, depending on your perspective) is doing it. The problem right now is that the computer companies are doing exactly what every business in our capitalist society *should* be doing with a home appliance: trying to make money. That, above all else, drives their product creation and marketing. The problem with this line of thinking for computers, which are more than just appliances, is there is no responsibility or accountability for consumer ignorance. Yet.
Consider other home appliances: stoves, televisions, water heaters, automatic litter box cleaners. None of these things require a license to operate. Why? Because although they may be dangerous if used improperly, they don't really pose an immediate danger to other people; just the person operating the device. Since we as a nation believe that people should take responsibility for their own uses of these devices, only product warning labels, owner's manuals, and occasionally tech support are offered as education.
Now consider devices that truly do pose an immediate danger to other people: automobiles. Because we are all driving on roads with *other people* and are a potential danger to them, we as a nation decided that drivers needed to be licensed in order to drive, i.e., there is a mandatory level of education needed before people are allowed to use the device.
When personal computers were first introduced, they fell into the first category above. Each unit was separate. If you didn't read the manual and fried your hard disk, that was your problem. However, as we network more and more, and desktop environments such as Windows and Zero Install try to blur the line between working on your own machine and working as part of a network, computers are migrating into the second category. We're all driving on the proverbial internet highway. Now, if you are a clueless user who clicks every attachment in emails and forgets to install security patches, you are endangering the livelyhoods (if not the lives) of other people on the network. Even the responsible people can still be hammered: you can't tell me that mail servers running OS X are not slowed down by the deluge of emails from Windows boxes still running SoBig and MyDoom. No one is immune, and it translates to lost revenues for everybody.
So what do we do to fix it? Do we mandate that computer companies educate their customers? No. That would be like asking car companies to teach their customers how to drive. How about the ISPs? Nope. They're just the toll booth operators. TThe problem is standards: the world of personal computers sprang up absolutely overnight, from a standards compiance point of view. Automobiles have had over 90 years with the same basic premise (gas, brake, clutch, steering wheel, internal combustion engine), and they have been refined to be compatible with each other. Take one driver's education course, and you can drive any car built. They can all run on the same fuel. They all fit on the same roads (current SUV trend notwithstanding). All of them have at least some interchangable parts. Yet there are dozens of car companies, each with its own set of designers and engineers. Computers sprang up so fast, with a new technological revolution every week, that standards compiance hardly had time to ask, "what the hell just happened?" As it is, we have several major operating systems, none of which run the same software (they all req
Thoughts on Gates (Score:5, Insightful)
Excuse me, but Intel's ripped off 64-bit system has no sort of NX bit on it. That is the primary difference between AMD and Intel's 64 bit x86 implementation.
What I'm curious about is if this statement from Gates is a forward statement. Does this mean that Intel will adopt the NX bit within the next year or so? Hopefully this will be the case.
I can imagine with this in place, I imagine a lot more of the script kiddies will be doing "Nuke" style attacks rather than full-on hacks. In this case, say if Apache were to have a buffer overrun exploit, the most that would happen is the service would be shut down. Still a pain in the ass for anyone trying to run a web server, but better than running a service that potentially grants access to your machine.
That and worms will hopefully not be so rampant anymore, provided that people stop opening exe email attachments. Don't we wish.
Gates said Longhorn is 'not a date-driven release.' and said the speculation that the operating system will come out in 2006 is 'probably valid.'"
Well, what exactly is the one "must-have" feature in Longhorn that makes it necessary today? Nothing really. A database-driven file system is not necessary. Internet Explorer 7 is not necessary (at least if you have Firefox it isn't). More DRM? Not necessary. What's necessary today are security fixes. And as long as Microsoft keeps patching WinXP, Longhorn is not needed anytime soon.
What is necessary now is SP2. And the sooner they release that, the better.
Re:Thoughts on Gates (Score:2, Informative)
Re:Thoughts on Gates (Score:5, Insightful)
As soon as Microsoft starts shipping anti virus and firewall software with Windows for free there is a pretty good chance people will stop paying for it. Security companies will then follow Netscape down the road in to oblivion. They might hold on for a while thanks to brand loyalty and if their offerings are superior to Microsoft's early versions, but its probably just a matter of time before Microsoft's free offering gets better technically and free is always better than "costs money" as IE proved over Netscape and Linux is trying to prove over Windows. Its also no secret Microsoft has been on a hiring binge for security talent so they probably have the talent to compete. They certainly have the R&D resources.
In fairness, Microsoft may be doing this partly because it realizes it has to solve its security problem because its pissing people off and its pissing governments off especially as fixated as governments are now about terrorism and cybersecurity.
But Microsoft also realizes there are billions of dollars pouring in to pockets that aren't theirs for security software. As in so many other markets if they bundle the same functionality with Windows for free, they put these other companies out of business. They can then jack up the price of Windows, or use some licensing scheme to redirect these billions in to there pockets because there are billions of dollars in IT budgets no longer going to security companies.
Closing security loopholes != closing security mkt (Score:3, Insightful)
Those loopholes should never have existed in the first place. I think the fundamental unfairness is that we had to be saddled for a couple of decades with a P.O.S. "operating environment" because both MS and its customers were too short-sighted to get it right the first time.
Also, no matter how much good faith effort is exerted to close security holes at the design and implementation levels, ther
Re:Thoughts on Gates (Score:2)
Uh, there are two 64 bit platforms supplorted by Windows XP64: AMD86 and Itanium. What Microsoft wasn't going to tolerate was supporting a third platform.
Re:Thoughts on Gates (Score:3, Insightful)
You mean like how Windows ME is soooo much better than 98? Heh.
Re:Thoughts on Gates (Score:3, Informative)
Can you provide a reference to back this up?
http://www.aceshardware.com/read_news.jsp?id=80000 460 [aceshardware.com]
There's always a chance that this is wrong, but this is just to prove that I didn't pull it out of midair ;)
I don't think that I like the idea of MS... (Score:2, Insightful)
Re:I don't think that I like the idea of MS... (Score:3, Informative)
1) They attempt to write to pages marked as executable instructions (self modifying code, various buffer overruns/heap/stack corruption)
2) They attempt to run code in a page marked as data
Basically, the two patterns listed above are how almost all remote ownage occurs on a box. There are a few legitimate reasons why you'd want to have self modifying code (JIT compilers being the biggest) but they can be worked around. I'd be w
Maybe Theo could help? (Score:5, Insightful)
--------
Create a WAP server [chiralsoftware.net]
Re:Maybe Theo could help? (Score:5, Insightful)
Apparently you've never written an anti-piracy wrapper for a Windows application.
That's how the good ones do it, by decrypting/modifying thier own binary code section in memory.
I guess as a GNU advocate, there is no need for anti-piracy programs,
but some people butter their bread writing software and they can't just give it away.
Re:Maybe Theo could help? (Score:4, Insightful)
Piracy is really and truly overrated. People who do pirate software would not have ever paid for it in any case. Do you really think some farmer in China is willing to pay $50 for software? How about some random high-school student? How about a bureaucracy-constrained lackey, who would spend literally thousands of dollars to push through the hoops to buy that $50 piece of software (instead, they buy $50,000+ of Oracle and WebLogic)?
The existing legal climate works well to inhibit well-intentioned people from prirating. It is important for business people to feel legitimate with respect to their software, because it is an easy and inexpensive way to reduce risk. People who sincerely do not care about risk are in the minority.
Worst case is that pirates are free word of mouth advertising.
Re:Maybe Theo could help? (Score:3, Insightful)
Re:Maybe Theo could help? (Score:3, Informative)
If you set a flag to keep it from doing so, as in setting the code section as read only, then the wrapper would not function.
Of course this means viruses could modify it in memory as well. But that's the price you pay.
Don't Forget About Price (Score:2, Insightful)
Price and security both need to be priorities for Microsoft. Both price and security are BIG TIME negative aspects of owning Windows.
Release Dates? (Score:4, Funny)
Comment removed (Score:5, Insightful)
Protected Stack hardware requirements? (Score:5, Insightful)
Re:Protected Stack hardware requirements? (Score:2, Informative)
All memory protection needs hardware support. Once code is executing, it is only the CPU that can generate trap which causes the operating system code to regain control.
Re:Protected Stack hardware requirements? (Score:5, Informative)
The only way truely eliminate arbitrary code execution is to mark pages with data non-executable and have a processor level exception thrown when you try to execute code from a data page.
I do not believe OpenBSD has a software protected stack. However, given that OpenBSD runs on platforms which have hardware protected stacks, it does have the ability to guard against those kind of overflows. Just not on x86 hardware. Well, except maybe a version that runs on the AMD64 hardware...
Ditching ActiveX, does anyone actually use this for anything other than malware anymore?
Yes. Aside from the windows update site, there are a whole crapload of corp intranets that use ActiveX. To get rid of it would cause a lot of grief for their corporate customers. What they CAN do (and have done for Win2k3, and I suspect they'll be doing for XP SP2) is disable ActiveX components by default for non-trusted sites. You can do this today yourself if you really want, by going to the security tab in the IE->Tools->Internet Options dialog.
2. Disabling the (Outlook) preview pane by default
Why? Fix cause of the problems; don't cripple the software. In this case, images should not be downloaded by default. And hey, guess what
3. Higher SSL Verbosity with IE 4
IE4? You're bitching about IE4?!? Geeze
4. IE URL-bar and statusbar should go into an "extra careful verbose mode" when it encounters hexadecimal encoding ( % ). IMO, these are all obvious things that should have been changed LONG ago, why are they still defaults?
Right, it was so obvious that it took how many years for the problem to be discovered? Everything is obvious in hindsight. Nothing is obvious until it has been done.
Re:Protected Stack hardware requirements? (Score:4, Informative)
From here [openbsd.org]:
(NOTE: i386 and powerpc do not support W^X in 3.3; however, 3.3-current already supports it on i386, and both these processors are expected to support this change in 3.4).
You can use a little-known feature of x86 called "segments" to enforce non-executability of memory areas. It's just different from the regular paging system used to implement virtual memory, and COMPLETELY unique to x86. You can find a discussion about it here [anandtech.com]. The links in the thread have some good info.
Re:Protected Stack hardware requirements? (Score:4, Interesting)
I banned IE and Outlook at work almost 10 years ago when they merged IE and the desktop. THAT was obviously a bad idea from the start, it's still a bad idea, they still refuse to undo it, and THEY WILL HAVE NO SECURITY until it's undone.
Look, I'm not a frigging genius, but I could tell it was a bad enough idea to take that unpopular stand... and then I looked like a hero when Melissa and the rest of the Outlook viruses mowed everyone else down and left our part of the company untouched. What totally stuns me is that not only has it not been undone, even with almost ten years of proof that it's a bad idea there is no groundswell of opposition to that merge. Microsoft has done a sterling job of throwing up one red herring after another to divert attention from the fundamental design flaw.
Re:Protected Stack hardware requirements? (Score:3, Informative)
Second, the problem with the MSHTML control is preciusely that you *do* have 20 pieces of code doing the same thing: you have every single application using it re-imp
also (Score:2, Insightful)
"....and if anyone makes a workaround for the NX feature to install Linux we will be able to use the DMCA to thwart them."
Come on Spinner .. i mean Linux (Score:2, Interesting)
Because the fact remains that many businesses will be reluctant to upgrade their existing systems to Longhorn if there isn't some huge productivity increases. Hence Linux can be promoted as the solution for business's existing systems. Dump Windows. Install Linux.
In order for this to happen there needs to be a lot more education to the pointy-
Re:Come on Spinner .. i mean Linux (Score:4, Insightful)
People were saying this around 2002. Two years later, and KDE and GNOME are still pretty much the same, slowly taking evolutionary baby steps.
Longhorn is going to be entirely
Plus, I think Slashdotters ignore that people have Windows software and won't magically dump it all and switch to Linux simply because the next version of Windows is due out in 2006 instead of 2005. I see no signs whatsoever that signify Linux is going to make some sort of great stride in the next two years. In fact, things look much the same as they did two years ago, except that KDE and GNOME have, like, more buttons and stuff, and now we're supposed to be switching away from DevFS or something in our production kernels...
Personally, I think Apple is making incredible headway lately. They're Doing Everything Right(tm). If anyone's making strides today and in the next couple of years, it's Apple. OS X just gets better and better (and subsequently ripped off...).
It seems (Score:2)
Re:It seems (Score:2)
Never admit ! (Score:5, Insightful)
Seriously, with approximately sixty billion dollars in the bank, exactly what prevents M$ from producing a secure OS ?
Re:Never admit ! (Score:4, Insightful)
The same thing that prevents game programmers from comming up with crack-proof copy protection.
Re:Never admit ! (Score:4, Interesting)
Game developers? Game developers don't care about copy prevention. Publishers don't develop it either. Third parties sell it to publishers under false pretenses and nonsense that breaks down to "every time someone copies your discs, you lose money."
And, as a rule, these third parties are nowhere near the leading edge of computer science. They are always business ventures. They hunt and search for techniques to deliver what the slogan on their incorporation documents says they're going to deliver, and pay a nominal research cost to develop it into something they can sell. They are neither smart nor industrious. They can, however, speak BS and HS to CEOs and CIOs of B2B and B2B "Publishing Industry Leaders" in the expanding software publishing industry. Make Big Money.
Game developers, on the other hand, don't give a rat's ass about these people. They don't want people to mooch off their hard work without paying for it. But, most of the devs I've talked to understand that most copies are not lost purchases. They also realize how much trouble copy prevention mechanisms cause them and their fans/customers. However, the decision to impliment them is not theirs. And they can't bad mouth the decision, or the publisher will have a tantrum and drop them under the "don't slander us" clause of their contract.
However, if you frequent some of the better game company run forums... Ion Storm, and formerly Bioware, etc., you'll find that they have very explicit almost uniform rules about discussing copy prevention. They don't permit software titles to be mentioned, or links, but they will fully permit discussion of the problem and mechanisms and methods to correct the problems. When developers respond, it's sympathetic and hesitant, and usually mentions somehow that it's the publisher's fault and they can't do anything about it. Bioware's forums got strict and silent about the issue all at once, after a large continuous volume of complaints--very uncharacteristic of the company, and indicative of some sort of "shut up and shut them up" order.
Re:Never admit ! (Score:4, Insightful)
Re:Never admit ! (Score:5, Insightful)
OK let me take a crack at this.
Because they are trying to come up with a very usable OS. 'Easy to use' and 'Secure' are to some extent mutually exclusive. Not totally, but it's a balance, and in the same way as airplane mnfrs famously sometimes don't make improvements to the safety of their 'planes until after the crash, MS hasn't made the necessary changes until after worms etc. got really bad in 2003 and they started losing customers. This doesn't mean they won't make the changes and continue to do well (no I'm not a Microsoft fanboy).
Good things to hear since: (Score:2, Informative)
b) If Microsoft security becomes hardware-based, it may even work!
Now, seriously, I'm your average M$-basher and could take this opportunity to make some mocking remarks.
But, you know what?
I find it sad when some software monopoly says things like "our systems are not engineered for security" and "our security will improve because we will resort to hardware" -- while still keeping a 95% desktop share.
*sigh*
NX - Finally (Score:5, Informative)
Re:NX - Finally (Score:2)
IF it does find it's way in a microsoft operating system, I'm pretty sure someone will find a way around it, and eventually control it remotely. If someone remote has the ability to not allow a local user to run programs, then your petty antivirus techniques are useless.
In the meantime (Score:2, Interesting)
Security is nice and all, but Longhorn is starting to remind me of heaven - a long way off with no concensus on what it is really like. A lot of faith that things will get better someday is almost required, just as faith is required for the religious minded.
Re:In the meantime (Score:5, Interesting)
Guess you missed the Longhorn PDC build, the endless Longhorn build leaks that come out every couple of weeks, and the monthly videos MSDN has been putting out that showcase a new Longhorn technology by the devs who wrote it.
I don't get the need for people to imply it's "vaporware"--Longhorn is coming, and we need to be ready. There's a reason we have the Mono project...there are devs who recognize what the future will be.
Here's the "innovation" to fight worms (Score:5, Insightful)
But, here's an idea! What if the email program DIDN'T EXECUTE SCRIPTS WRITTEN IN BASIC!
Hey, Bill, here's some code that will kill worms dead:
How long will it take until Microsoft dips into the Outlook code and stops the running scripts in message attachments?
Maybe never. They'll just build rarely updated "after the fact" virus scanning in the next XP service pack! Yeah, that'll do it.
I won't need it. I use Thunderbird and Mozilla Mail.
Innovative, isn't it ? (Score:5, Funny)
Sure, it was easier to write an assembler program adding it's own code to a software, while keeping the infected program executable, than scripting 15 lines of VB Script.
Oh, those poor and innocent individual users. What a wonderful way to make them think they are only victims, and never responsible of the spread of a virus, even if they don't make any effort to secure their system.
Of course, the idea that a malicious program shouldn't be able to do much damage, because it has very restrictive rights is a strong innovation.
Wonderful ! Microsoft OSs will (at last) have memory protection ! Let me remember, how old is Unix ? Nearly 40, isn't it ?
Could someone explain me how Microsoft can be seen innovative by so many people ? And how they can so proudly try to make us believe they always were (and will be) on the right way ?
-----
GET RID OF THE IE-DESKTOP INTEGRATION (Score:5, Interesting)
BILL: GET RID OF THE MICROSOFT HTML CONTROL.
Getting rid of ActiveX and splitting the MS HTML control into a separate modules so programs can display local HTML without worrying about it kicking off a local exploit or downloading untrusted material from the Internet... not just defining zones, but separating the display code, the internet code, and the active desktop code into separate modules that don't interact with each other except through an application that has to explicitly request dangerous things... that would do more for security than anything else Microsoft could do between now and the end of time.
But to do that would be to back out of the claim that it was essential to merge IE and the desktop back when they violated their agreement with the DoJ back in the '90s, and Microsoft cares way more about losing face than improving security.
Funny... (Score:5, Funny)
Re:Funny... (Score:5, Funny)
I received that email (Score:3, Funny)
It took me quite a while to convince myself that it was not spam and safe to open. This, I think, shows that Microsoft has a long long way to go.
Some of what he says is right. (Score:5, Interesting)
the bits about isolation and resiliency are dead on the money: having the
firewall on by default is a start, but if I understand correctly what he's
saying (which is hard, because the wording is brief and nontechnical; it
was obviously not written for a technically-inclined audience), Microsoft
intends to actually *fix* Outlook. Not "patch" it to stop a particular
exploit, but actually fix the root problem.
He also says some stuff that's good to hear despite not really constituting
security -- e.g., popup blocking, and not loading remote content in email.
He also talks about taking measures at the system level to mitigate the risk
of buffer overruns, but I can't tell from what he says whether what they're
doing there will be helpful or a placebo. This is where the CPU NX stuff
comes in, and I'm a little over my head there; I understand the idea, but
I don't think I grok all of the implications.
This is actually a good article. Not perfect, but good. Go read it, those
of you who haven't yet. I don't think we're going to slashdot Microsoft.
Re:Some of what he says is right. (Score:4, Funny)
This sounds like a challange
Linux Security (Score:5, Insightful)
Here's an interesting though. Is Linux more secure and stable BECAUSE it is more difficult to set up?
Linux makes few assumptions. You have to explicitly install and run things if you want them. There is no marketing pressure to force you to take features you do not want. Heck, you can even build your own kernel to include or exclude features. The "barrier to entry" under Linux is higher. So the majority of Linux installs were installed by somebody who actually knows something about a computer.
Conversly, Windows is easy to install. Furthermore, since it comes pre-installed on most computers, it is REAL easy to install. Windows is not so much of a choice for most users as it is the failure to make a choice. Many of the people "succesfully" running Windows are "twelve o' clock flashers". (You know, those people who's VCR constantly flashes "12:00" because they have no idea how to set it.) Combine this with cheap, always on broadband and you have a recipe for disaster.
You've heard of "Security through obscurity", well Windows suffers from "Insecurity through ubiquity"
Re:Linux Security (Score:4, Interesting)
THE spin doctor (Score:5, Interesting)
Don't you just love how Windows' in-securities are spun as "evil forces"?
And don't you also love how Microsoft's solutions always point the responsibility finger elsewhere. They always try to paint themselves as the good guy, having to clean up after the mayhem someone else initiated. "Here's our progress on taking steps to combat the evil in the world."
One of these days, business is going to wake up to this shell game and start holding the software manufacturer to blame for the general design problems of their products. Then you'll start seeing a general shift to another platform, maybe starting in the back office, file and printer serving, firewalls, etc. The desktop will be last.
Wait a sec, perhaps that explains the new firewall corporate bought for our branch to replace our old Win2K one... Linux.
CPU Architecture issues (Score:3, Informative)
Perhaps it would be prudent to re-visit the past, in order to move into the future.
Not too many current chips do things this way, though the 8051 series comes to mind.
Next Big Thing (Score:5, Insightful)
1. NX bit is not an end all in preventing mal code from running. It does limit some exposure.
2. DRM is not guaranteed security as MS is trying to sell to the public. It does guarantee that fixing a hacked system will be sooooo much more difficult. A successful hack could rended someone's local data inaccessable. And we are sure to see version 1.0 type vunerabilities in bios, os and libraries for a while... eeek.
3. MS providing antivirus, firewall and so on will not work out as competition between vendors has fueled a ton of creativity and generated some pretty amazing products. Let's hope this feature is like the backup software included with Win3.11 and 95 rather than IE.
4. None of this really speaks to MS's most important and weakest security-wise product: MS Office.
The irony of spam (Score:4, Funny)
neither necessary nor sufficient (Score:3, Informative)
Marking pages as being executable or not has been a feature of many processor families for decades. It's generally a useful feature, but it is neither necessary nor sufficient for making opearting systems secure: after all, Linux, BSD, and Solaris manage to be much more secure than Windows running on the same processors.
Re:Cue the Microsoft Bashing (Score:3, Insightful)
I thought this was a site that dealt with computing and technology, what exactly is wrong with this article ?.
I don't know, but... (Score:3, Insightful)
Absolutely nothing new will be offered in the discussions for this article.
Meanwhile, Gentoo, Debian, GNU (twice!), and Gnome have all been hacked in the span of the last six months, and LinuxSecurity [linuxsecurity.com] reports dozens of vulnerabilities for each distro every week alone.
It will always boil down to this--security as a criticism against Windows will always be somethi
Re:I don't know, but... (Score:5, Insightful)
You know, I was thinking you were a troll (or at the very best, a malcontent) up until that last sentence. Then I realised I agreed with you. I also miss the days when Slashdot posted an interview with a kernel programmer or discussed the latest gadgets. It seems these days the articles all have an anti-establishment theme.
Perhaps the Slashdot editors have let success go to their heads. They think that their larger audience means they have a greater responsibility to report on the "important stuff". Unfortunately the Slashdot editors don't limit the "important stuff" into the YRO category, so you can't easily turn it all off.
Re:So, basically... (Score:2, Interesting)
If Microsoft took up another strategy than pure marketing; they could offer alot better of a product, at the same return.
Microsoft basically offers three things:
1.) A decent operating system. Ill get modded down for saying this, but it's an OK system. It isn't wicked l33t for people like us, but it's a decent system for the status quo.
2.) A excellent office suite (sans Outlook). Anyone want to argue that MS office hasn't been top of its class ever
Re:Windows security. (Score:2)
Re:By the time SP2 comes out... (Score:2)
First, you have to fix all the holes in the OS. Then you have to protect the OS from the users. Then you have to make sure that the system is configured as secure out of the box rather than totally open.
We're used to seeing a major push of Windows every year or so. This might signal Microsoft taking the Lin
Re:By the time SP2 comes out... (Score:5, Interesting)
Doubt it. Care to point to any signs that show this magical stride Linux is going to make?
OK, two out of four isn't bad. But Microsoft must be scared of something. Why is one of the wealthiest corporations in the world and its army of developers having so much trouble getting something out the door, and why is Bill going out of his way to appear to tow the line? Kind of spooky.
They're not having any "trouble." They're creating entirely new technologies for this new operating system. MSDN has been putting out "The
Re:By the time SP2 comes out... (Score:3, Insightful)
You know, there's a flipside to that coin: if it ain't broke (which it mostly isn't), don't fix it. Unlike Microsoft, "we" don't have to do buzzword-laden feature releases on a regular basis.
Free software isn't perfect by any means, but it's steadily improving. Besides, nobody really knows where we'll be at in 2006 - not even Microsoft can give you any guarantees on where they'll be then.
Re:I love how Gates speaks of Windows... (Score:3)
Uh, why would a company's leader talk about his competitors when he's talking about his own product?
Tell you what, Bill, we've got this stuff called "Linux" and "Mac OS X" out there, among others.
Yeah, let's compare their marketshare to that of Windows...though OS X is definitely making headway lately.
P.S. Maybe I'm the only one, but I'm getting tired of people addressing "Bill" whenever they talk about Microsoft. "Yeah, Bill, do this-and-this
Re:Also also known as (Score:5, Insightful)
And AMD supports it first. They support it right now. Intel is dragging their feet on it. That's the reason I WILL be buying AMD and boycotting Intel (although there are others, this would be the main one).
Re:"focus on security," eh? (Score:3, Insightful)
Unfortunately, once you add the bells and whistles you can no longer say with any certainty that the code still "works." Anytime someone touches working code they risk breaking it. Only way to avoid that is testing, which is as much of an inexact science as programming is
Re:Working with AMD/Intel on NX ? (Score:3, Insightful)
Second, there is a lot of variety in Linux installations even though