Microsoft Warns: Critical Flaw in Windows

[fancypiper]

Hmm.. keeping secrets is the Microsoft way and the way of the ancient uilleann pipe makers, isn't it? That doesn't fit into the Linux community where freedom of information is queen and king of it's philosophy.

I haven't seen any references to those exploits on any of the security sites I monitor since I abandoned Microsoft, so I doubt the current kernels (past the version that was hacked on the Debian site) would be vulnurable.

I access the internet on one account, then transfer anything I want to keep to my working account, just in case I mess up my surfing account.

I lost my entire system 3 times using Windows and I love Linux because of it's flexibility, stability, security and support, none of which I found in Microsoft products.

The best things in life are free, it seems, in computer operating systems, at least.

[ciberspiff]

Security through obscurity, the Microsoft mantra. Remember though, just because you have not seen it does not mean it is not there. Let me assure you, it is. All it takes is a malicious program to take advantage of it.

Even with the inherent security flaws in any piece of software, that doesn't mean it should not be used. You have to be responsible for the security of your computer, just like you are for your house, car or any personal possesion. Run AntiVirus software, internet security software, encryption software. No computer OS is secure as long as the computer is turned on Some are more secure than others, yes. But none are absolutely secure.

[peeplj]

I agree with the sentiment. Absolutely no computer is 100% secure.

Linux does a better job that a lot of other systems, though.

As to specific exploits, on the Linux side they are almost always fixed within hours after being found. That's not a claim Microsoft can make by any means.

--James

[Tony]

That's not a claim Microsoft can make by any means.

--James

I see Microsoft has updated their website. The focus now isn't how secure their product is (remember all those claims of increased security?) but how fast they are responding to virus and security updates.

Perhaps they should rename their next product 'Patchworks"

[ciberspiff]

Perhaps they should rename their next product 'Patchworks"

- That's funny.

Anybody else notice this article about Microsoft source code to Windows 2000 and Windows NT being leaked to the internet? http://www.cnn.com/2004/TECH/internet/0 ... index.html

Guess they'll get to blame the next years worth of security flaws on this. And probably use it as a way to scare people into upgrading to Windows Next Acronym.

[tinker]

Ok, I'll bite. (FYI, I work at MS on Windows, but the viewpoints here are my own, and don't represent any official satement from MS, etc, etc...)

<rant>

https://rhn.redhat.com/errata/rh9-errata.html

Linux posts/fixes at least at many security holes as Windows (usually more), it's just that crackers aren't nearly as aggressive at exploiting them, because:
1) There aren't nearly as many users
2) Linux users, on the whole, are probably better about patching

Do you have any idea how frustrating is that hackers / crackers reverse engineer our security patches to figure out how to exploit the users that haven't updated. Often times they do it in days to a few weeks. It doens't always work this way, but in the case of Blaster, the fix had been out for quite a while. The Linux situation would be no different if they had an installed base of a few hundred million or so casual users, instead of a small installed base of primarily servers and power users.

As for the source leak, that is also frustrating, possibly not just for MS. Our code often contains a lot of licensed IP, trade secrets, etc, and so there may be a lot of things in there that a lot of companies weren't ready to give away. For what it's worth though, it sounds like it's not the complete source, since a full source enlistment is many GB, and this is only a few hundred MB extracted. I'm not going to guess at the fallout, but as someone who pours my heart and soul into building that code, sometimes 80 hours a week, well, I'm proud of what I write, but I'm still quite upset with the fact that it was stolen. We do license it out to educational institutions and other entities. The notion that we believe in security through obscurity is very debasing, and with the effort that all of us put in at MS, I take that personally and am quite hurt. You have no idea the amount of effort we put in at all stages of the process to keep the OS trustworthy. I don't think some people outside MS appreciate how challenging it is, or to what lengths the crackers out there go to in attempting to beat us.

Oh yeah, to our credit, it appears what code has leaked has held up to some fierce slashdot scrutiny of our respect for intellectual property. Of course, Linux seems to be doing OK against SCO scrutiny at the moment too.

I work at MS, and I take a lot of pride in the work I do. The flames about security through obscurity are unfounded, unfair, and ill-informed. Despite the fact that I know all this, they still hurt like hell, because I (and everyone I work with at MS) take the topic very seriously, and devote a lot of effort to it.

</rant>

Well theres a waste of a good morning... oh well, sometimes I just gotta get it out of my system... FYI, no need to flame, it's all out of my system. I don't feel like getting into it, and anyway need to get some work done now.

- Ben

[Bloomfield]

The flames about security through obscurity are unfounded, unfair, and ill-informed. Despite the fact that I know all this, they still hurt like hell, because I (and everyone I work with at MS) take the topic very seriously, and devote a lot of effort to it.

</rant>

Whatever sympathy I might feel for MS quickly dies when I read MS's statements about open-source/gnu licence/linux.

[fancypiper]

I figured the leak of source code was a rumor, but I see that Drudge is reporting it, so possibly some was leaked. Hopefully, no one stole Microsoft's "crown jewels". Anyhow, I hope they catch the crook that did it if s/he did actulally release the source code.

Statement from Microsoft Regarding Illegal Posting of Windows Source Code

Would you happen to have any hints on how I could get a Microsoft Sidewinder joystick working in Windows 2000 Professional. Many searches on Windows help sites and by google turn up no help.

<my rant>I feel your pain as I once used to be a teacher and some pupils just don't want to learn, no matter what. It must really be hard to make something usable by someone with absolutely no knowledge of computers/the internet or any desire to learn about it.

I would use Microsoft software more if the underlying OS was more stable, but I haven't succeded with either Windows 98 Second Edition or Windows 2000 Professional. Somehow, none of the Microsoft OSs I have purchased is satisfied with my current hardware (older, common hardware bought specifically for good Linux support and performance). I fear I have bought my last Microsoft hardware or software as I have been dissappointed in it's performance.

If you had a stable base to build your software on, perhaps your work would be more rewarding.</my rant>

[ciberspiff]

The flames about security through obscurity are unfounded, unfair, and ill-informed. Despite the fact that I know all this, they still hurt like hell, because I (and everyone I work with at MS) take the topic very seriously, and devote a lot of effort to it.

I must disagree with the above. The statement is not unfounded, unfair or uninformed. It is a fact. It is also a fact that pretty much every single non--open-source computer company does it. Apple, IBM, HP, whatever. I spent 20 years at DEC developing UNIX and VAX/VMS kernels and we did the exact same thing.

As a user, I would no more expect nor want Microsoft to release their source code than my company to release our design documents for cable systems. That is called IP (Intellectual Property) and is owned by the company.

What users want, at least in my case, is honesty. If you have a security hole, fix it, release a patch, and move on. Don't deny it, hide it or blame someone else. Microsoft has finally seemed to catch onto this and has done an increasingly good job at security. Personally, I just want my computer to work.

[Caj]

The flames about security through obscurity are unfounded, unfair, and ill-informed. Despite the fact that I know all this, they still hurt like hell, because I (and everyone I work with at MS) take the topic very seriously, and devote a lot of effort to it.

I must disagree with the above. The statement is not unfounded, unfair or uninformed. It is a fact. It is also a fact that pretty much every single non--open-source computer company does it. Apple, IBM, HP, whatever. I spent 20 years at DEC developing UNIX and VAX/VMS kernels and we did the exact same thing.

The academic name for this principle is Kerckhoffs's Criterion: design a security system so that it will remain secure even if an attacker gets the full source code, or blueprints, or pretty much everything except passwords/keys/combinations.

Outside of security, there is the misconception that this is based on some pessimistic worst-case assumption. But KC not a law, it is a design goal. It does not say that this worst case will happen often, but that any decent system should work anyway. Unfortunately, the impression of KC as an "unrealistic assumption" leads many people to simply ignore it. This leads to some pretty amazingly breakable security systems.

Nevertheless, security engineering is like any other kind of engineering: it is applied science, and science requires a scientific community who can examine things and share information. This is why banks only trust ciphers like AES, which have been fully published and subjected to years of review.

Caj