04-09-2003 17:27									#1
	Microsoft screw up again Support Apolyton, buy GURPS/ Alpha Centauri

From www.fool.com .

quote: More Microsoft Mess By Motley Fool Staff September 4, 2003 Do you use any of Microsoft's (Nasdaq: MSFT) Office software products? Like, say, Word? If so, you need a little fixin' up. The world's No. 1 software maker says a flaw in its ubiquitous office suite of programs could allow a really mean user to access your computer and do really mean things (like run programs and delete files, for instance). So, if you use any version of Office, Word, FrontPage, Publisher, or Works Suite, you should visit this link to see if you're at risk. But wait, there's more. Mr. Softy identified four other flaws yesterday, bringing its total to 39 this year. (We're not making that up.) So, if you run Microsoft software at all -- including the Windows operating system -- visit the link anyway to see if you need to apply a patch. Microsoft has had a horrible few weeks. While Apple's (Nasdaq: AAPL) Mac devotees just shake their heads in wonder, Windows users have had to contend with the Blaster worm and several variants. And yet, the stock price only trails the S&P 500's 12% gain this year by about four percentage points. (Apple, meanwhile, is up over 50%.) Luckily, the five latest flaws can only be exploited if the user opens an infected document; the code can't execute automatically as was the case with the Blaster worm. But Microsoft users are getting tired of the same ol' song and dance. Bill Gates and his team have made better security a top priority in the company, but so far there's a critical flaw in their execution.

	04-09-2003 17:30									#2
	Help yourself to an AD-FREE life

quote: While Apple's (Nasdaq: AAPL) Mac devotees just shake their heads in wonder, Windows users have had to contend with the Blaster worm and several variants.

Ain't that the truth.

	04-09-2003 17:30									#3
	Support Apolyton, buy Civilization 2

But in the future, journalism textbooks will use this subject line, rather than "Dog Bites Man," as the quintessential example of something that is not news.

	04-09-2003 20:18									#4
	Support Apolyton, buy Civilization: The Boardgame

you know, sometimes the fault of these worms propagating isn't in the software as much as in the user.

stupid users do stupid things, like installing spyware, opening every attachment...

	04-09-2003 20:21									#5
	Support Apolyton, buy Alpha Centauri

Q Cubed, very true. But still that's no reason why software with this many flaws is acceptable.

quote: But wait, there's more. Mr. Softy identified four other flaws yesterday, bringing its total to 39 this year.

This is just ridicilous. After all, people working for Microsoft are skilled enough programmers, although sometimes I'm just awed at them.

I know that the programmer who wrote fdisk for DOS had only learnt C a short time before making fdisk.

	04-09-2003 20:25									#6
	Support Apolyton buy from Amazon

I'm in awe at the lack of common sense a lot of people show when criticizing this kind of stuff.

	04-09-2003 20:31									#7
	Support Apolyton, buy Civilization 2

to Asher.

It is ridiculous how much of target Microsoft have become over this. But now that it is so, it is a good move of them to put extra focus on the issue. After all, they do have a huge responsibility, considering how many incredibly dumb users they have.

Asmodean

	04-09-2003 20:34									#8
	Put an end to popups!

What do you expect? They've marketed their OSes as something that's simple enough for anyone to use. People who don't know anything about computers want something that just works. If they get something that breaks easily then their perception is that it's crap. They don't care about how much code there is or any of that, they just don't want their computer crashing all the time, getting hacked and getting viruses etc.

	04-09-2003 20:36									#9
	Support Apolyton, buy Galactic Civilizations

I also have a major pet peve with financial writers talking about computers, especially when they lack any kind of basic reasoning skills like this author:

quote: Bill Gates and his team have made better security a top priority in the company, but so far there's a critical flaw in their execution.

How is there a flaw in their execution, based on this article? The software affected in the article have shipped before (and designed WAY before) the trustworth computing campaign was launched.

It's simply stupid for him to look at old software from before, which MS has discovered and patched just now, and say "see, the old software didn't magically and secretly become more secure. They had to patch it -- which shows just how flawed their plan is!"

	04-09-2003 20:39									#10
	Browse Apolyton AD-FREE

quote: Originally posted by MikeH What do you expect? They've marketed their OSes as something that's simple enough for anyone to use. People who don't know anything about computers want something that just works. If they get something that breaks easily then their perception is that it's crap. They don't care about how much code there is or any of that, they just don't want their computer crashing all the time, getting hacked and getting viruses etc.

I'm not talking about the general consumer, I'm talking about the:
1) Mac user who wrote this article (the Mac users "shake their heads" and ridiculous slant on the article gave that one way
2) The Linux geeks and others

But you have the right idea, consumers want something simple enough for anyone to use. That's why they use Windows. But to make it simple enough for anyone to use, sacrifices in security have to be made.

Somehow I don't think home users would appreciate mandatory passwords, with mixed case, at least 1 numeral, 12 characters long or more, with at least one symbol...and force you to log into root to install anything systemwide.

	04-09-2003 20:43									#11
	Avatar Enlargement: We've got the solution

That article was rubbish. Agreed.

Agreed, they might not appreciate it but that's only because they've got used to not having to do it. If they'd always needed to do things like that they'd be used to it now.

	04-09-2003 20:43									#12
	Support Apolyton, buy Call to Power 2

Asher,

While the media love to critcize MS more, Linux doesn't have as many security issues. I only have to download security patches for my Linux box very rarely - holes are mostly found in exotic packages, or are not very critical. Something as large as the recent RPC vulnerability is rare. And yes, I know that users are to blame for not patching up.

I have nothing against MS... I'm a supporter of theirs. I respect Bill Gates completely. And I hate it when Gates, personally, is being blamed.

quote: Very few pieces of software in widespread commercial adoption are as complicated or large as Office and Windows.

True, but software such as Visual Studio, which is very compliciated, has no such issues. Of course, I know that Windows issues are understandable, because it defines a lot... Windows is an OS, therefore, does a LOT of stuff.

May I remind you about the Shatter vulnerability, though. The hole has been there for what, 10 years? And they say it can't be even fixed...

	04-09-2003 20:45									#13
	Suffering from ads?

quote: But you have the right idea, consumers want something simple enough for anyone to use. That's why they use Windows. But to make it simple enough for anyone to use, sacrifices in security have to be made. Somehow I don't think home users would appreciate mandatory passwords, with mixed case, at least 1 numeral, 12 characters long or more, with at least one symbol...and force you to log into root to install anything systemwide.

Users , in general, are stupid, that being the first law of IT. Blaster existed because of user stupidity... and that's the problem. They want something simple (Windows). They want something so simple that they don't even bother with security patches, or anything. That doesn't fall into the "simple" category, and so the majority of users will never even update.

Though I believe that Windows should force every account to be passworded...

	04-09-2003 20:47									#14
	Support Apolyton buy from Amazon

quote: Originally posted by Solver Though I believe that Windows should force every account to be passworded...

Although when 90% of the stupid users will have their password as a date, a short sequence of consecutive numbers, the word "password" or their own name it will have very limited effectiveness.

	04-09-2003 20:49									#15
	Support Apolyton, buy Alpha Centauri

quote: Originally posted by MikeH What do you expect? They've marketed their OSes as something that's simple enough for anyone to use. People who don't know anything about computers want something that just works. If they get something that breaks easily then their perception is that it's crap. They don't care about how much code there is or any of that, they just don't want their computer crashing all the time, getting hacked and getting viruses etc.

No, no and no. As Asher pointed out, other OS'es have just as many flaws. They just don't have as many users, so it doesn't get as much publicity.

As for expecting a program with 40 million lines of code to be flawless. It just can't be done. No way. Especially a program like Windows. There are a gazillion ways to use Windows. In a gazillion different environments, with a gazillion different configurations. No amount, repeat, no amount of testing can foresee all cases. No amount of carefull thinking can foresee all the possible ways hackers will attempt to break the security of Windows.

That people don't understand this is simply beyond me. This is not comparable to buying a car or a foodprocessor, and expecting them to be safe. Windows is so many times more complex. Besides, common sense should tell most people how to operate a car, and what is potentially dangerous. Common sense is not always enough for inexperienced computer users, when determinating is an operation is safe to perform on his/her PC. Therefore you simply can not blame Microsoft for not caring. They have the difficult task of creating an easy-to-use OS that at the same time is complex enough to satisfy experienced users.

Not an easy task, believe me.

Asmodean

	04-09-2003 20:52									#16
	Remove this text

quote: Although when 90% of the stupid users will have their password as a date, a short sequence of consecutive numbers, the word "password" or their own name it will have very limited effectiveness.

At least an automated scan of network computers for unprotected accounts won't work.

quote: No, no and no. As Asher pointed out, other OS'es have just as many flaws. They just don't have as many users, so it doesn't get as much publicity.

Will someone point me to a Linux flaw as dangerous as DCOM RPC one?

quote: They have the difficult task of creating an easy-to-use OS that at the same time is complex enough to satisfy experienced users.

True, a very difficult task. But sometimes, I just get the feeling that parts of their software are poorly coded - not just regular flaws. Of course, I can't exactly judge it...

	04-09-2003 20:53									#17
	Lose 30 kilos (of popups)

quote: Originally posted by Solver Asher, While the media love to critcize MS more, Linux doesn't have as many security issues.

This is a common misconception. Linux accounts for more corporate compromises every year than Windows, and Linux is on a small fraction of the number of machines. Further, on my Mandrake 9 box I was downloading no less than a dozen security updates for various packages every week.

quote: True, but software such as Visual Studio, which is very compliciated, has no such issues.

And does this surprise you?
Visual Studio is a development studio and compiler, and is used by people who know what the hell they're doing. So is it any wonder why it doesn't have security issues, compared to an OS which manages an entire computer (network, disks, etc) with 90% of the users being totally clueless?

VS isn't a target. There's probably loads of potential security vulnerabilities, but it'd be a ***** to get any of them used since the users are computer literate, and they don't run all of the time.

quote: May I remind you about the Shatter vulnerability, though. The hole has been there for what, 10 years? And they say it can't be even fixed...

Shatter vulnerability? Please.

The "vulnerability" is it allows you to use VPN software remotely to log into accounts which you granted remote access, and have full access to the computer.

I wonder why it's unpatched...maybe because people want that "hole"?

	04-09-2003 20:54									#18
	Get a bigger avatar today!

What do you mean No? That's exactly my point. People see computers as tools like televisions or food processors and expect them to work like that. It might be obvious to you (and me) that that isn't the case but a very high proportion of home PC users know next to nothing about computers, and don't want to know either. They just want it to work.

Microsoft have actively promoted the idea that their OSes are easy enough for anyone to use which isn't quite true because you do need some knowledge to maintain a windows system.

I didn't say it was easy, of course it isn't.

	04-09-2003 20:57									#19
	Increase the size of your Attachments

quote: Originally posted by Solver Will someone point me to a Linux flaw as dangerous as DCOM RPC one?

http://www.ciac.org/ciac/bulletins/l-067.shtml

	04-09-2003 20:58									#20
	Support Apolyton, buy GURPS/ Alpha Centauri

quote: VS isn't a target. There's probably loads of potential security vulnerabilities, but it'd be a ***** to get any of them used since the users are computer literate, and they don't run all of the time.

While it's obvious that 99% of people who use VS are very advanced users, I'm not sure if there actually are any possibly holes in it.

quote: The "vulnerability" is it allows you to use VPN software remotely to log into accounts which you granted remote access, and have full access to the computer.

The vulnerability is that, if you can attach a debugger to a service running as localsystem, you can execute shellcode with localsystem rights.

	04-09-2003 21:00									#21
	Support Apolyton, buy Civilization: The Boardgame

Hoe did I know Asher would have posted in this thread?

	04-09-2003 21:00									#22
	Enter the AD-FREE zone

But you did blame MS for their marketing, no.

When you install windows, it's default settings should be enough to keep everyone out of trouble, what with automatic updates and (for XP) firewall turned on. It's when people tinker with what they don't know about that things go wrong. And then, after they have tinkered with what they don't know about, they go blaming MS. That, frankly, p_isses me off

Asmodean

	04-09-2003 21:01									#23
	Tired of ads?

WHO CARES?!?!?!?!

There are more important things to worry about than a few megabytes of code!!

I have a new pragmatic attitude with such things which are of no significance to me. I dont care about windows and linux. I use the best system for me. If there are problems with windows, i'll patch it and use a firewall! Its nothing to get psycho about. I'll let microsoft lose sleep over it, I dont really give a damn.

	04-09-2003 21:03									#24
	Suffering from ads?

quote: When you install windows, it's default settings should be enough to keep everyone out of trouble, what with automatic updates and (for XP) firewall turned on.

Not exactly. As you know, with default setup, the first user created has admin rights. There's the "Administrator" user, but the next one also has admin. Now, what does this mean? This means that a malicious program can modify the registry and do anything, if ran.

I don't care, though, if anyone would run a malicious program on a Linux box. Worst they can do is erase all of their folder, but not kill the system.

	04-09-2003 21:03									#25
	Support Apolyton, buy Galactic Civilizations: Deluxe Edition

quote: Originally posted by Solver While it's obvious that 99% of people who use VS are very advanced users, I'm not sure if there actually are any possibly holes in it.

And what do you base that off of?

quote: The vulnerability is that, if you can attach a debugger to a service running as localsystem, you can execute shellcode with localsystem rights.

Oh, that one. Fixed years ago.
http://www.securiteam.com/windowsnt...5EP0L0U75S.html

	04-09-2003 21:06									#26
	Support Apolyton buy from Amazon

quote: And what do you base that off of?

Never had to patch my VS because of my computer restarting if I add a new class to my program .

Do you keep a database of all flaws and their solutions, or what?

	04-09-2003 21:07									#27
	Support Apolyton, buy Civilization III: Complete

quote: Originally posted by Solver Not exactly. As you know, with default setup, the first user created has admin rights. There's the "Administrator" user, but the next one also has admin. Now, what does this mean? This means that a malicious program can modify the registry and do anything, if ran. I don't care, though, if anyone would run a malicious program on a Linux box. Worst they can do is erase all of their folder, but not kill the system.

That's another thing that amazes me about most Linux users -- they don't understand that this is one of the main reasons Linux is such a pain in the ass to use.

Windows is easier to use, by default. Windows is not incapable of the same stuff Linux does by restricting accounts (actually, Windows has more advanced ACLs, but we won't go there...), but customers simply don't want that. Then they *****.

But if MS made you a limited user by default, a lot of people would be confused and calling tech support, and end up making their account Admin anyway for ease of use...

	04-09-2003 21:09									#28
	Got spare money?

quote: That's another thing that amazes me about most Linux users -- they don't understand that this is one of the main reasons Linux is such a pain in the ass to use.

As a Linux user, I don't care if it's a pain in the ass to use . For whenever I need to install a new program, it's not a pain for me to type su in console .

In Windows, they could simplify it... for limited users, instead of simple "You need admin privileges" message, show up a prompt for admin password...

	04-09-2003 21:09									#29
	Support Apolyton, buy Civilization 2

quote: Originally posted by Solver Never had to patch my VS because of my computer restarting if I add a new class to my program .

So somehow this means it doesn't have potential security vulnerabilities? Fascinating logic, Solver.

quote: Do you keep a database of all flaws and their solutions, or what?

Yes, I call it "Google".

	04-09-2003 21:10									#30
	Support Apolyton buy from Amazon

quote: So somehow this means it doesn't have potential security vulnerabilities? Fascinating logic, Solver.

I know .

quote: Yes, I call it "Google".

Thought so .