MS Virtual PC Flaw Defeats Windows Defenses 141
Coop's Troops writes "An exploit writer at Core Security Technologies has discovered a serious vulnerability that exposes users of Microsoft's Virtual PC virtualization software to malicious hacker attacks. The vulnerability, which is unpatched, essentially allows an attacker to bypass several major security mitigations — DEP, SafeSEH and ASLR — to exploit the Windows operating system. As a result, some applications with bugs that are not exploitable when running in a not-virtualized operating system are rendered exploitable if running within a guest OS in Virtual PC."
Which only goes to show, it's always something (Score:1, Insightful)
If you want security, unplug the 'net. You ain't gonna get it any other way.
Re:Which only goes to show, it's always something (Score:5, Funny)
Are VMware, Parallels, and VB also vulnerable? (Score:2)
Makes one wonder if the disabling of these crack-thwarting mechanisms are also killed in other desktop hypervisors. Bad news.
Re:Are VMware, Parallels, and VB also vulnerable? (Score:4, Interesting)
It's probably just a bug in the way VirtualPC handles the virtual TLBs or some such. It's not even present on Hyper-V, also from Microsoft, so I think the danger here is pretty low.
It's not like this actually makes the host OS vulnerable, either. I doubt it can even crash the VM software, although it could certainly lead to crashing the virtualized OS.
Re: (Score:3, Interesting)
That's what I'm wondering. Does randomized address still occur on VPC7's competitors? And if VPC is this way, then does Hyper-V thwart host address randomization, and so on? What's the difference in architecture that allows VPC to thwart this, and others go merrily on their way-- with whatever memory ring permitting the randomization of kernel access? Hmmmmm.
Re: (Score:2)
So as long as it's just the guests providing the critical services that get crashed or subverted, it's OK since the mere container for those guests is OK?
That doesn't make a lot of sense.
Re: (Score:2)
It's OK because you can't step out of the sandbox. If the guest OS running the DNS server gets compromised, the compromise code can't step out of its sandbox and attack the guest OS running the webserver, or reach into the guest OS running the Active Directory server and grab the password list.
An attack that can break out of a virtual machine is a much, much bigger problem than one that stays contained inside the VM. If a guest gets compromised, you restart it from a known-clean state. If the host gets c
Re: (Score:2)
You're still missing the point, the CRITICAL SERVICE running on the guest OS is now vulnerable to attack, including slow and subtle corruption of the data. If the critical service dies or the data is corrupted to unusable, it hardly matters if the host OS is still OK.
In other words, when all the gold comes up missing, how many people will be relieved to hear the vault isn't damaged?
Re: (Score:2)
No, you're the one missing the point: Even though the gold in this vault has been replaced with pyrite, the gold in the next vault over is still fine.
Re: (Score:2)
Except that it too is subject to the weakened security. It may be full of gold now, but it could easily contain pyrite tomorrow, but the vault will be unharmed. Not much comfort.
Re: (Score:2)
A random guess would be that some developer took a few shortcuts so he could show off the performance improvements he made on the hypervisor.
Re: (Score:2)
This gets me every time (Score:4, Insightful)
So how many months do you need to review once you are told about it???
Re:This gets me every time (Score:5, Interesting)
Simple. How many months will you give them before you go public?
At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes? I know Linux and Mac have had their share of holes, but it seems as if every week there's a new announcement about some MS product that has either a 0 day flaw, or another MAJOR flaw? And even worse is their failure to deal with them in a reasonable amount of time! I mean 6 months to COMMENT on an advisory? That's ridiculous... Sure, they may have a lot of notices to work through, but if that's the case, hire more developers to deal with the security issues! They are out spreading the message that you can depend on MS products, and then leave gaping holes open for months... Not to long ago (within the month), they delayed a patch --well, wanted to anyway before they were called out on it-- for a 0-day in IE by 3 weeks, so that they could put it in a "planned update to IE"... If this was a popular open source project trying to pull this stuff, how quickly would a fork surface? Then again, it's all about placating the sheeple, right?
Re: (Score:2, Insightful)
The moment they put out a patch that breaks anything, or makes things worse the uproar will be greater. Its also amazing how it will work find in say, the spanish version, but not on the chinese versions. So many things and so many different products.
Re: (Score:2)
Re: (Score:2)
I could make my wife's car theft proof by removing cables from the engine management system and bolting it to the garage floor but then she would never be able to drive it.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Thats his point. When Microsoft breaks things to fix something else, people are in in arms.
Re: (Score:2)
Re: (Score:1)
True that. Renting an OS (yes you don't buy the OS from MS), you hold the owners accountable for bad shit happening. Open source plays less point-the-finger and more help-another.
Re: (Score:2)
1. Works for me
2. Not my distro
3. Did you read the man page?
Then yeah, Linux has that down.
Re:This gets me every time (Score:5, Insightful)
Let's play devil's advocate:
MS has quite a lot of competing agendas: ...
- keep backwards compatibility, v1. That means a bunch a old APIs, services, apps... Not only was security not much of a concern back when those were written, but any change in the environment risks unveiling new vulns. These pooor guys are actually supposed to maintain IE 6, IE7, and IE 8.
- keep backwards compatibility, v2. MS can't really change the security model or the way they expose it without, again, breaking apps. Since NT, Windows's security model is not bad. But MS can't really implement it fully (no apps changing system-wide ressources, no writing outside of a handful of approved dirs...) without, again, breaking apps.
- add features
- maintain an incredibly wide array of software. MS = Oracle + Linux+ php + Apache + OOo + Firefox +
So yes, I really hate the pain that managing MS systems is. I, and they, know they could make things better by breaking a lot of apps. They choose not to... prolly because their customers want them not to. I can understand that.
Re: (Score:3, Interesting)
then with windows vista why didn't MSFT include an XP mode, than ran in it's own self contained section while using the higher security of a modern OS?
MSFT is trying to maintain compatibly with single user OS's in a networked world and failing miserably. Apple simply included a backwards compatibility mode and with every release slowly stopped installing.
Re: (Score:1)
Re: (Score:3, Insightful)
then with windows vista why didn't MSFT include an XP mode, than ran in it's own self contained section while using the higher security of a modern OS?
Windows 7 Professional/Ultimate includes exactly that. But it's implemented using Virtual PC, which is where this flaw was discovered.
Priorities, priorities - oh, wait! Policy: (Score:4, Informative)
When we face a choice between adding features and resolving security issues, we need to choose security. [cnet.com]
- Bill Gates, January 16, 2002 .
Re: (Score:2)
He said they NEEDED to... not that they WOULD.
Bill said that in 2002... (Score:2)
And I told people at the time that I expected Microsoft to take _at_least_ 10 years to be able to do that consistently. 15 years wouldn't surprise me.
While I have not yet tried out Win7 or IE8 myself, everything that I've read says that they've made remarkable progress in improving their overall security stance. They just might finish up nearer the shorter end of my estimate than I thought at the time. :)
Re: (Score:3, Insightful)
Re: (Score:2)
Mythical man month much?
Pouring more resources into security doesn't make it happen. Sorry.
Re: (Score:3, Informative)
Re: (Score:2)
It's not about fixing 1000 issues, if you tackle security like that, you'll be fixing 1000 issues every month until the end of time. And your problem will grow as your company and the amount of code you write grows. So theoretically you could eventually break even, but the worst security issues will be the ones you don't know about, the ones you can't measure in your tickets closed per month metric. So what if you closed 1000 bug tickets in a month? Anyone can do that, how about you go an entire month witho
Re: (Score:2)
Re: (Score:2)
Well then we'll have to agree to disagree. I think Vista was an important and painful step forward for security, and that Windows 7 is probably about as secure as Linux 2.6.x. (Nothing can stop a user from wanting to see the dancing bunnies, etc.)
In Linux for example, gksudo is not a secure way to enter your password, and neither is entering your password into a sudo prompt in a shell. In Windows, you'd need to have already exploited the computer in order to read a UAC prompt.
Re: (Score:2)
Re: (Score:2)
I think it's important to remember that the vast majority of online linux boxes are going to be servers which are already locked down, being run by at least semi-competent admins and probably with almost all the ports blocked except 80, 443, 21, an SSH port, etc. Essentially, they have a very small surface area, and even if there was a zero day, it's very easy for you to say "ah, that's not Linux's fault, that's Apache's fault. Even running OpenBSD would not have saved them."
So it's very hard to compare "Wi
Re: (Score:2)
At the possibility of being flamebait here, how the heck does MS keep publishing products full of security holes?
Because many security flaws are in old software - which they aren't "pushing" any more. Today's flaw is a exception but requires a user that use XP mode in such a way that an attacker can get at it (say - if you're running an old insecure version of Firefox in XP mode) which, you have to be honest here, is not all that likely since XP mode will be more used for old games and business apps.
As for the the "0day flaw" you mentioned, if it was an Open Source project you'd likely been asked to update to IE8 i
Re: (Score:2)
I agree 110%. But I also want a patch in a reasonable amount of time (and that time is dependent on the risk). If it's a true 0-Day, I want the fix today. Not 3 months from now. I want it today (I know I won't get it today, but that doesn't mean it shouldn't be an ASAP thing)...
Ugh, this isn't good. (Score:5, Informative)
The good news is that this doesn't affect the big iron (Hyper-V). However, for people who have Windows 7 and XP mode, using it for Web browsing, this will cause them a world of hurt.
Since this essentially doesn't affect servers, I'm going to recommend to people that they move to VMWare Workstation if they want commercial support, or VirtualBox if they desire an open source solution. Either one of these has as many features as VirtualPC (although VirtualPC has one nice advantage -- it drops changes to the undo disk fast compared to the 2-3 minutes VMWare does.)
A hole in a hypervisor is a really bad thing. A lot of people use VMs for honeypots, and this would cause unintended infections, or other damage, perhaps catastrophic.
Re: (Score:3, Funny)
Re: (Score:2)
Re:Ugh, this isn't good. (Score:4, Informative)
The hole is not in the hypervisor. The GUEST OS is the one that is compromised, not the OS running the VM.
Re: (Score:2)
The hole is not in the hypervisor. The GUEST OS is the one that is compromised, not the OS running the VM.
The hole is in the hypervisor; if the hypervisor worked correctly, the guest OS would behave identically whether or not it was running as a guest.
But, yes, it would appear that this flaw does not provide a way guest code can escape the virtual environment. Essentially: local privelege escalation bug restricted to virtual machine guests.
Re:Ugh, this isn't good. (Score:5, Informative)
Honeypots are designed to get hit. This bug doesn't make the host system vulnerable, it just means that the client OS is easier to exploit.
If it worked on Hyper-V, this would be a big problem; that's a server-level technology where even the clients are expected to remain secure. On the other hand, Virtual PC isn't even a hypervisor; it requires a full OS onderneath it, running itself as just another Windows app. Up until 2007 didn't even require hardware support for virtualization.
Re: (Score:2)
Re: (Score:2)
2007 doesn't require hardware virtualization either, only the Windows 7-only version does.
There was a bit of upset about that point when XP mode got reviewed. Since it's based on VPC and not Hyper-V, it shouldn't require x64 and AMD-V or Intel-VT, but for some reason, it does. A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode. Of course, that bullshit is actually Intel's fault, so I tend to cast a more glaring eye at them when I think about it.
Re:Ugh, this isn't good. (Score:4, Insightful)
A lot of people considered that to be all sorts of bullshit because Intel uses their VT feature to differentiate product lines; I.E., moderately priced business desktops don't support XP mode.
Moral: if you're looking for something modestly priced, go with AMD processors. Not only are they cheaper, but nearly all the ones you can find today support virtualization.
Re: (Score:1)
And you can feel good about not supporting a monopolist.
Re:Ugh, this isn't good. (Score:4, Interesting)
I actually had a chance to talk with one of the guys behind Wirtual PC (including the one that powers Virtual XP Mode) a few months back. His answer was that when MS started work on the Windows Virtual PC (WVPC, the current version) 3 years ago (roughly when VPC2k7 shipped), they contacted Intel and AMD and asked if they were going to offer hardware virtualization on all models going forward. Both companies answered Yes, so to save development and testing costs, the (large block of tricky) code that enabled vitrualization on CPUs without hardware support was cut from WVPC. Skip forward a couple years to WVPC getting ready for release, and... still a lot of Intel CPUs without support for virtualization. At that point it was too late to add the feature without delaying shipping, so they didn't.
I asked whether they would add it in later, and he said they weren't planning to but might change their mainds if it became clear that this was a problem for enough of their customers. In the meantime, they were telling Intel to get its shit together the way it had said it would three years earlier, and he personally recommended going with AMD chips.
On a side note, I didn't hear anything at all about it requiring x64. According to http://www.microsoft.com/windows/virtual-pc/download.aspx [microsoft.com], it works just fine on x86.
Re: (Score:2)
You don't nee
Re: (Score:2)
On the other hand, Virtual PC isn't even a hypervisor; it requires a full OS onderneath it, running itself as just another Windows app
So ... install Virtual PC in a Virtual PC virtual machine.
I haven't tried, as it is slow enough
Re:Ugh, this isn't good. (Score:5, Insightful)
If someone is using VirtualPC for a honeypot, they are an idiot.
The idea of a honeypot is that it is indistinguishable from "the real thing."
That this flaw even exists means it is identifiable as a virtual machine.
Re: (Score:2)
Re: (Score:2)
> VMWare Workstation if they want commercial support, or VirtualBox if they
> desire an open source solution.
You know very well that commercial support is available for Open Source.
Re: (Score:2)
It's a good thing this vulnerability doesn't allow the host system to be compromised, otherwise we'd be in real trouble!
(AKA: Parent poster is wrong.)
Still can't exploit the host OS (Score:5, Informative)
This is definitley a bug, but all it does is allow bypassing of security features in the virtualized system. In other words, you can exploit the VM client, but you still can't get at the host.
It's worth of a patch, but not of a panic. If you're virtualizing for security, you don't really care what happens to the virtual system (that's the point). If you're virtualizing so you can run an old OS, it's going to be full of holes anyhow. If you're virtualizing for any other reason, why the hell are you using consumer-grade virtualization software?
Re: (Score:1)
Most people don't utilize the function of an "undo disk" in VPC, which allows you to restore a VM to a previous state when you turn off the VM.
So the infection will stay there, if somebody use it as a spam or phishing server, the FBI will be knocking on your door.
Re: (Score:1)
Out of interest, I develop on two XP SP3 VPC's, against older systems that do not support XP+. It's a bit worrying, doing production work in these environments.
Credits (Score:5, Informative)
I would like to add that the exploit writer at Core Security Technologies that discovered this vulnerability is Nicolás Economou [coresecurity.com] and congratulate him on the great work he has made.
Disclaimer: I also work at Core
Re: (Score:1)
Thanks for the good work Nicolás :)
How many people even use VirtualPC/XP mode anyway? (Score:5, Insightful)
I'm not surprised that MS shrugged it off for now.
Re: (Score:3, Interesting)
I mean, talk about small targets. I highly doubt that any hacker would find it worth his time to attempt to exploit this. I mean, first you have to find someone running XP mode. Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system) on the guest OS instead of the host OS. Then the person still has to have more than 2 gigs of RAM and be utilizing more than 2 gigs at once. Then, after all that, you only have access to the XP VM, which may or may not have anything of worth on it.
I'm not surprised that MS shrugged it off for now.
Sorry, nice try, but you don't seem to understand the issue here. You don't need to "get them to open an executable" - the point is that this vulnerability makes it possible to exploit existing vulnerabilities by bypassing mitigation techniques such as SafeSEH, DEP, and ASLR. It also has nothing to do with the amount of physical RAM on the system or how much is being used - the mentions of memory accesses refer to a process's virtual address space.
I agree that this doesn't have nearly the same impact as i
Re: (Score:3, Informative)
Article: "It causes memory pages mapped above the 2GB level to be accessed with read or read/write privileges by user-space programs running in a Guest operating system."
Me: "Then you have to get them to open an executable (or exploit some other vulnerability to get onto the system)"
Re: (Score:2)
The target isn't that small. The fact that being virtualized breaks their security models is a big issue, and indicative of other big issues. (Using virtualization to break copy protection is one of my personal favorites.) And there are plenty of home and business users who have gotten Windows Vista machines foisted onto them who use and need to use Windows XP for software compatibility reasons, and who therefore run old games or critical applications in Windows XP under Virtual PC. I've done it myself for
No kidding (Score:4, Interesting)
To the extent we use it at work, it is for running stubborn old software that won't run in Windows 7 and/or 64-bit OSes. To date, we've discovered two applications like that. We also set them up to run seamless in the host OS (their window appears along any other window) where you don't see or play with the guest VM. It's easier for the user, and less potential trouble. They generally don't even know (or care) that the program is running in a VM.
So yes, it requires some fairly edge situations to exploit. Not many people use XP mode in the first place (most apps run natively in 7), if they do, reasonable bet they are just using it for compatibility for one or two old apps, not on a regular basis. So you have to convince them to get your exploit, and run it in their XP system. While I suppose you could craft it so that it doesn't run in 7, they may just say "Eh, do not want," and ignore it. If not they might wonder why a new app would have that problem. Either way you've got to get them to use it in XP mode and then... Well I guess you can own their XP VM. Wonderful, that does you a whole lot of nothing in general.
Also this isn't a case of "Bypasses any and all security," it just gets by some additional protections that can help in some cases. DEP, for example, doesn't do anything to stop malware, it doesn't check the "evil bit" and stop programs from running. All it does is prevent buffer overflows in some cases. You can't execute code in the data area of a program's memory. Ok, fine, however to even matter at all you have to have a program that is vulnerable to that kind of thing. If programs are checking their inputs and so on, then DEP never even comes in to play.
Don't get me wrong, I'm happy that MS has added some additional protections to make common problems harder to exploit, however they are not the first, last, and only line of defense. They are just things that cause additional problems for various sorts of exploits. Something has to find a way to try and get in to the system in the first place before they even matter.
I can't see this as any kind of big deal. I'm certainly not at all concerned with regards to the computers that use it at work.
Whats new... (Score:2)
Its like they do this on purpose...
"security mitigations"? (Score:2)
Aren't those called "exploits"?
Re: (Score:3, Informative)
Aren't those called "exploits"?
No, you're misunderstanding the article. A "security mitigation" is something that stops exploits working without actually removing the hole that allows the exploit. Stuff like checking your stack is still intact before returning from a function in order to make stack overflow exploits fail: the stack can still be overflowed, but you can't (easily) exploit this any more.
Not a vulnerability (Score:3, Informative)
This is really a vulnerability in any meaningful sense of the word. Rather, this means that certain advanced protections that Windows uses are less effective in a Virtual PC. Microsoft is actually in a leading postion when it comes to memory protection features as compared to anyone this side of OpenBSD.
What isn't someone issuing an "advisory" that the MacOS implementation of things like GS, ALSR, early-heap-termination and SafeSEH are either weak or nonexistent?
ASLR could use more entropy. Stack coookies could be present in every function, instead of just some. Every defense can be improved, and I don't think Microsoft has ever claimed that ASLR or GS is a reason NOT to produce a patch.
IMHO, Microsoft is completely correct to not issue a bulletin for this since that is an indication of a severe issue. And Core is free to make the issue known publically as well, and people can decide for themselves. But the Slashdot title is midleading at best.
Use a VHD for booting and your screwed? (Score:1)
Alltough I never got this working: booting from a VHD :, it occurs to me that are a lot of people doing this for different purposes...
http://www.sevenforums.com/tutorials/2953-virtual-hard-drive-vhd-file-create-start-boot.html [sevenforums.com]
Would this be affected too?
Obvious... (Score:1)
Re: (Score:2)
Also, they have a funny definition of unpatched [microsoft.com]
2 "hacks" i found in Windows recently (Score:1)
Not sure if anyone knows about these but...
The document and settings transfer wizard in Windows 7 did not ask me to authenticate for the other profiles I transferred. So I assume that if one were to examine that program there might be something in there.
When I installed Windows 7 on my laptop - at the point where it asked me for the Key I unplugged to take the laptop to my desk to get the key - and the Key dialog was simply bypassed! I was on the next screen. So I still haven't entered my key. Maybe th
Re:Linux (Score:5, Insightful)
Every time I read an article like this, it gives me a smug face wondering why more people don't switch.
Swtch to what, VMware or Parallels?
Re:Linux (Score:5, Informative)
Re: (Score:1)
Disclaimer: This post made on OSX 10.5.8 running VirtualBox 3.1.2
Re: (Score:2)
Seriously, why is the parent modded funny? I switched to VirtualBox after MS bastardized Virtual PC for Win7, and haven't looked back. Admittedly, having all the media registered in a central database is annoying compared to the XML and path based approach of VirtualPC, but apart from that it's a solid product.
Re: (Score:2)
The central database for media is a little annoying but only until you get the media you usually use in it and then you can pretty much forget about it. Have actually come in handy sometimes when I need to figure out on what disk a
Re: (Score:2)
"VirtualBox hardlocks the host after about a month running XP without VT on my system. "
Elaborate, please? I've never had a hardlock with my VBox machines. You're saying that one month continuous uptime on the VM will do that? Do you have any idea why?
Re: (Score:2)
Elaborate, please? I've never had a hardlock with my VBox machines. You're saying that one month continuous uptime on the VM will do that? Do you have any idea why?
When VT is disabled my system will sometimes hardlock. This happens rarely so it's difficult to assert for certain if vbox was the guilty party but it only happened while vbox was running and was sometimes foreshadowed by vbox first crashing and the host following shortly.
Fortunately there's no reason not to activate VT unless you don't have it or run another VM that needs VT alongside vbox.
Re:Linux (Score:5, Insightful)
Re: (Score:2)
I know, I know. And yet, I'm not entirely convinced that it's better to have the apps you want/need while helping to send spam, and have your personal information sold to not just the highest bidder but to all bidders, running Windows, than it is to be secure on Linux, and be forced to make do with either no app, or simply a different app (not always worse) and have to learn something different.
It's a matter of priorities. Do I want to a) fight Windows security and have the apps I want, b) ignore security
Re: (Score:3, Insightful)
It's a matter of priorities. Do I want to a) fight Windows security and have the apps I want, b) ignore security and have the apps I want, or c) have security, but have to learn some other app, or maybe do without that app.
The whole point of having a computer is to run the programs you want to run. If you're going to have to "do without", you might as well unplug the damn thing (thereby achieving perfect security).
Re: (Score:2)
Could run his VM without a network interface. Unless he is using the VM for Outlook of course.
Re: (Score:2)
That helps to emphasize what some of the developers are doing with ChromeOS and similar offerings.
More than half the people in the world who own computers do nothing but check email, play a few flash games, do some online shopping, and other similar frivolities. Most people don't need multi-Ghz CPU's, super Fps video cards, terrabytes of hard disk space, or more than a gig of memory. And, most people don't need all the utilities, games, services, etc that are found in any standard Windows installation.
*ni
Re: (Score:2)
Do I want to a) fight Windows security and have the apps I want, b) ignore security and have the apps I want, or c) have security, but have to learn some other app, or maybe do without that app.
d) actually get some work done using apps which are only available for windows meaning I occasionally have to deal with a virus or other security issue but it's rarely an issue.
My answer is d.
Re: (Score:2)
A lot of people make that claim. The number of people who have NEVER had ANY security issue with Windows is simply amazing, if we are to believe all those claims.
Oddly, McCaffee, Symantec, and all the rest continue to make money hand over fist, and tens of thousands of computer shops in the US have steady, reliable incomes, thanks to the various security issues.
I can't possibly say whether this particular AC is full of shit or not, but whenever I hear such a claim, I can't help wondering.
Re: (Score:2)
A lot of people make that claim. The number of people who have NEVER had ANY security issue with Windows is simply amazing, if we are to believe all those claims.
Yes, and that's because for that lot of people it's probably true. I've never had this sort of problem with Windows either. The one time in my youth I first encountered "CoolWebSearch" it took me some time to discover it and how to fix it, and since then nothing.
Re: (Score:1, Redundant)
Because Linux doesn't have the apps they want? They don't want to have to relearn years of knowledge built up using Windows? That it's not as simple to switch an entire OS and migrate all your programs and data as people like you would have people believe?
Re: (Score:2)
Depends on what "programs and data" you need. Now that most of my development is on web apps rather than standalone apps, it's pretty damn trivial for me to switch between OSes. I use a VM for the very occasional bout of Windows development I have to do, and Remote Desktop for server administration.
And your "years of knowledge built up using Windows"? Gimme a break. Those "years of knowledge" for most (but obviously not all) people amount to how to do a right click and where to find "My Documents". OSX and
Re: (Score:1, Flamebait)
Re: (Score:1, Insightful)
Re: (Score:2)
Re: (Score:3, Funny)
Not all of us can afford Macs.
Re: (Score:2)
Re: (Score:2)
When are you going to get tired of paying to be screwed?
I don't think we can get an estimate on that. Given The Oldest Profession, and given that I'm fairly certain that prostitutes still exist in some parts of the world, I'd say we've been happy to pay to be screwed for a very long time, with no data ever suggesting that we'd grow tired of it.
Re: (Score:2)
And if that's the case, you'd realise you aren't licensed to run Windows. MSDN licenses (without the BizSpark, Empower or WebsiteSpark exemptions) are for Development use only. Not production.
Re: (Score:2)