Steve Ballmer has a hard job. Being the CEO of a company the size of Microsoft is brutal and exhausting. Against his nature, Ballmer has been trying to change his own persona and the company culture. So far, he appears to have made progress. In my mind, Microsoft is a more mature corporate entity that it used to be. The startup mentality is important to hold on to, but isn’t functional as the core value of a $30 billion company. What Ballmer needs to do is hold on to the best of the existing culture, while transforming it into something new. Tough job. I couldn’t do it.Editorial Notice: All opinions are those of the author and not necessarily those of osnews.com
Ballmer has also re-engineered himself. His combative, hardball salesman nature is inappropriate for a Fortune 500 CEO. You can insert any bean counter joke you want, but CEOs have to balance a lot of different interests. Almost nobody gets it right. Ballmer has done pretty well. But its a strain, and sometimes it shows. It did yesterday in Orlando.
Ballmer was onstage at a Gartner sponsored Tech love-in. I don’t know what he was led to expect, but what he got were some pretty sharp questions. Some of the sharpest were about security, and the constant drumbeat is clearly getting to him. In what I am guessing was a “shoot-from-the-hip” throwback to the old Ballmer, he blurted a few doozies. When asked if open source software is not by definition more secure than closed, he said, “The data doesn’t jibe with that. In the first 150 days after the release of Windows 2000, there were 17 critical vulnerabilities. For Windows Server 2003 there were four. For Red Hat (Linux) 6, they were five to ten times higher…There’s no roadmap for Linux. There’s nobody to hold accountable for security issues with Linux. There’s nobody sort of, so to speak, rear end on the line for issues.”
Obviously, the data is suspect. Any comparison between Windows and Linux security bulletins has to take two things into account. First, Red Hat comes with more than 1000 applications. They issue security bulletins for all of them. A Sendmail or MySQL security problem gets publicized the same as a kernel issue. Windows security bulletins concern Windows and its associated applications only. Thus a raw number comparison of bulletin frequency is misleading. In addition, MS and its minions have cited total bulletins for Linux compared to Windows. This is equally misleading. When MS discovers a problem, they issue a bulletin. When a Linux application discovers a problem, every distribution that carries that application issues a bulletin. That can mean more than a dozen bulletins for an important problem. But not everyone needs to pay attention to all the bulletins. I use Mandrake Linux, and ignore bulletins concerning RedHat, SUSE and the rest.
The second reason the data is suspect is that Microsoft has occasionally changed the definition of “critical vulnerabilities”. This raises or lowers the number of criticals without changing the overall number of actual security issues. Are the numbers Ballmer cited critical vulnerabilities by today’s definition or those in effect at the time? And does MS use the same kind of criteria in categorizing Linux vulnerabilities as it does its own?
Apart from these two data problems, there is a more substantive objection. By choosing the appropriate time periods, one could “prove” that winter is hotter than summer. Comparing Windows Server 2003 with RedHat 6.0 (released in 1999) sounds like that kind of exercise. In terms of the actual number of security issues that one needs to act on, there isn’t much doubt that Windows is way ahead (behind?). Groklaw did a wider comparison of the numbers with predictable results.
Ballmer also poured scorn on the patching process in the open source world, saying “The vulnerabilities are there. The fact that someone in China in the middle of the night patched it–there is nothing that says integrity will come out of that process. We have a process that will lead to sustainable level of quality. Not saying we are the cat’s meow here–I’m saying it is absolutely not good reasoning to think you will get better quality out of Linux. ”
Like I said, its getting to him. They may have “a process that will lead to sustainable level of quality”, but it hasn’t so far. And the “someone in China in the middle of the night” isn’t an accurate characterization of the Linux process either.
Mr. Ballmer’s statements don’t actually bother me much. Although his inaccurate “data” can’t go unchallenged. As I said above, this seems to me a throwback to an older, more combative persona. I expect he’ll snap out of it.
What is worth commenting on is the potential he and Mr. Gates show for “executive insulation syndrome”. This is a little known business malady that I’ve just made up. The most blatant example of the syndrome was Alex Trotman. When Mr. Trotman became President and CEO of Ford in 1993, he admitted that he had never in his life actually bought a car. He joined Ford in 1955 as a young man and drove nothing but company cars. Buying a car is a wretched process, and someone who has never done it can’t understand how unpleasant it really is. Or the essentially adversarial relationship it creates between company and customer.
I am guessing that Mr. Ballmer has a small army of IT people that make sure everything he, Gates and the other mucky-mucks touch is all smooth and seamless. I wonder how well he understands what a pain it is to run a system. Any system. Those that actually run multiple operating systems know very well that Linux is not as great as people say, and that Windows is not as bad. But they also know that Linux is unquestionably more secure than Windows. It comes like that out of the box. Windows is insecure out of the box. You can make it secure, but with the patch-a-minute regime in Redmond, its a lot of work to keep it that way. The change to monthly patches doesn’t actually improve the situation. It reduces the workload, but leaves more vulnerabilities unpatched for longer periods.
The “we’re better than Linux when it comes to security” line seems au courant at Microsoft lately. Bill Gates said last week in Germany about security patches, “We’ve gone from little over 40 hours on average to 24 hours. With Linux, that would be a couple of weeks on average.” What a wacky guy. Really though, this kind of statement is just self-defeating. It creates a no-win for MS. First, there’s nothing Gates or Ballmer can say to convince me Windows is more secure than Linux. Because in my daily experience, its not. Second, even if it were, that would help me the customer how? I have multiple Windows machines to take care of and switching to Linux across the board is not an option. If it were, I would have. Mr. Ballmer has famously stated a new dedication to customers. I believe he means it. But he should start by dealing with reality rather than spin. Who’s rear end, so to speak, is on the line at Microsoft?
>Of course he picks redhat to compare the amount of security
>advisories have been issued for windows. Redhat is probably
>the most hacked up distro out there.
And yet, it’s the company that _is_ making a profit. It’s always that “use-that-other-distro” argument that makes no sense to me. Well, I agree: “give me a break.”
Whenever his mouth opens all that comes out is FUD. I just get so irritated at the site of him. He has no idea what OSS is at all. It really just seems like he has an OSS advisor or something that tells him how to answer questions.
You would prefer… his company endorsed open source? Somehow that doesn’t seem like a winning business strategy.
There is an excellent overview of Ballmer’s recent talk over at Groklaw.net. PJ does an excellent job of correcting the gross errors in Ballmer’s speech.
Basically, Ballmer is reaching for anything here because he knows deep down that MS is in trouble. Don’t get me wrong, they are not going away overnight or even in the near future. But what is happening is the OSS movement is finally making MS accountable for their actions. Buggy software, security flaws, way, way overpriced software…..you feel free to add more. People and businesses are getting tired of it. This is truly the beginning of a signficant revolution in the computing industry and MS refuses to believe that they will be affected, but again, deep down, they have to know what is coming.
I could go on and on about the errors of MS’s ways but that has been rehashed here and various other places many, many times. The bottom line is this, to use an old, tired expression: what comes around, goes around. MS, you want to be an arrogant, monopolistic bully…fine. But it will eventually come back around to you. It is your turn to pay the price.
Well I honestly don’t think that Slackware is out there trying to break the bank. Althought its basically I think a 4 man team so I’m sure they’re not doing too bad.
And debian is a non profit distro. I’m completely missing ur point. Are you agreeing w/ me or trying to start an argument?
The point of linux isn’t necessarily to make a profit. The two companies (while one is commercial) aren’t out there to run m$ over. What exactly are you saying? Should I use redhat because they’re making a (very small) profit? No, that doesn’t make sense. I use what works for me.
One thing is certain, whatever his status, he is still JUST “CEO”. Gates is still the Chairman and he is the guy with the brains in the family. I don’t care about Microsoft Propaganda what I care about is products. And from my knowledge the new era of Microsoft products will definitely change people’s perceptions about what software is all about. This is evident in the consumer level Windows XP. It’s an improvement. All all this whinig when it came out “buy it now it doesn’t crash as much” etc.. Of course that’s how software evolves. At first it sucks, then it gets better. And if people belive in a company and a vision they will go with the flow. There are two types of services, one is what some call “mission critical” like Nuclear Facilities and NASA. They don’t use $MS products for their critical data. They use it for typing memos and makeing excel spreadsheets. Maybe they use WebEX and interactive applications for presentations etc…. Business is about money and software that enhances productivity will get bought. I haven’t seen that from Linux yet, sure Openoffice works but not well enough. IT will take many moons to have the features of office. So get outside and learn how the world works. Anyone who thinks Linux will get to the desktop (this is my main argument) has to realize there better be billions of r&d before anything can happen to put a dent into Microsoft’s Ferrari. So my advice to the college kids compiling libdvdcss is to grow up and when you get a real job you will learn why Microsoft runs the software world for businesses.
You would prefer… his company endorsed open source? Somehow that doesn’t seem like a winning business strategy.
It’s working for Apple, why not?
But seriously, I understand that OSS is a major threat to MS. However, they need to atleast do their homework so they can go out and not sound like idiots. They also need to actually do something inovative and which addresses security, and quit releasing crap like Office 2003. Office 2003’s only new “feature” is not being able to open your documents where you want when u want. Absolutely ridiculous.
Mmh. I don’t want to offense the contributor, but does he have a proof that he really says the following sentance :
[[ The fact that someone in China in the middle of the night patched it ]]
I don’t see any link with the interview. If it’s a real interview, can you prove that the journalist doesn’t misrender what he really says as it is often the case
I regard this sentance as just plain ordinary racism, and I have a hard time to believe that the CEO of one of the biggest company said it in public.
Wait for replies.
“Now there’s a mature Balmer.”
That he was confident about himself enough to do that without caring what people might think… Yes, I would say that it shows him as mature.
On the other hand posting about it on web forums and calling someone they don’t know “monkey boy” doesn’t say anything positive about the poster…
[i]I don’t see any link with the interview. If it’s a real interview, can you prove that the journalist doesn’t misrender what he really says as it is often the case
http://zdnet.com.com/2100-1105_2-5094279.html
“…Most people that who are putting their softare under opensource are doing so, because it wasn’t very successful when it was sold. And if something is not very successful sold, why not make it free. That’s not where we come from, we’re trying to build software that actually builds value.”
–Steve Balmer
He’s such an idiot. Ok so samba isn’t very good, um its faster than Windows 2003. KDE, Gnome, Gaim, Grip, Mozilla. Such horrible pieces of software I know, it’s too bad they never worked out commercially. Oh wait, they were never being sold.
BTW this quote came off of the video clip of his interview on http://zdnet.com.com/2100-1105_2-5094279.html
It’s working for Apple, why not?
Apple is fighting the status quo. They need a host of interoperability tools in order to be competative in a Windows dominated market, and many of these they have pulled from open source projects.
Microsoft *IS* the status quo. Interoperability with 3rd party programs is their enemy, as this opens the door for consideration of the alternatives.
However, they need to atleast do their homework so they can go out and not sound like idiots.
Whether or not they sound like idiots to someone with a technical background has little effect on the public perception.
They also need to actually do something inovative and which addresses security
Microsoft’s “securing the perimeter” strategy (i.e. automatically updated firewall/netfilter rules) is the most innovative approach to security I’ve seen in recent history. If effectively implemented, this would allow network security vulnerabilities, such as the ones exploited by such worms as Code Red, Nimda, Slammer, Blaster, and Welchia, to be closed within hours after rules are released, eliminating the need to patch systems immediately after the discovery of each vulnerability.
Thanks for the link.
It comes from a major site, and there is a clip while I’m not able to see it I must admit thie sentance was really said.
Sigh.
This OS war pertubs many people ; I can only hope they will calm down and use better arguments in the future.
Actually I’m quite sure that I don’t want to administrate Systems/Firewalls without knowing why rules are set up.
I’m too paranoid to believe that this feature wouldn’t be abused. Let’s say the RIAA want’s MS to close some Ports globally..
“Business is about money and software that enhances productivity will get bought. I haven’t seen that from Linux yet, sure Openoffice works but not well enough. IT will take many moons to have the features of office. So get outside and learn how the world works.”
The argument would be stronger if You could produce a list of features not available in OpenOffice.org and widely used in ‘real business’.
I’m using Linux/OOo for two years now and never missed a single feature. ‘Business’ uses MS-products because of their marked dominance.
Just as linux users often refer to Windows 95, MS refers to redhat 6.0 Everyone is full of unfair comparisons.
I do find it strange that an article based solely on bashing Balmer for not using ‘real’ provable facts, makes such a blatant statement as
“But they also know that Linux is unquestionably more secure than Windows”
At least Balmer’s ‘facts’ are simply derived from using favourable metrics.
Bash balmer all you want, but don’t use his same style of ‘rhetoric’ to promote Linux in the same article.
Yamin
Actually Office 2003 is what Office XP should have been. It has far more updates, features, and new programs than XP did. Outlook 2003 is worth it alone for the corporate enviroment. The company I work at is thinking of rolling Outlook 2003 now because of the changes and features it brings to the table.
Microsoft does alot of stupid things and does quite a few things badly. Yet, it does learn and it does get better. Yes, it improves slowly and often times with questionable business practices but…its making money and its at the top. *shrugs* Unless it gets shut down by the government…its going to be the global leader when it comes to operating systems, office applications, etc. for the forseeable future. Realize it, get with it…and try and make Linux better. Instead of constantly glorifying Linux…make it better. Fix the problems of which there are leagues
@skaeight
It’s working for Apple, why not?
Is it really correct to say Apple has endorsed OSS? Hitching one’s cart to open source is not the same as endorsing it. After all, the source for Aqua, Finder, iTunes, &c are not publicly available.
“Is it really correct to say Apple has endorsed OSS?”
Absolutely.
“Hitching one’s cart to open source is not the same as endorsing it.”
Considering the fact that the Free Software Foundation endorses Apple’s open source license for darwin and because Apple has actively contributed code to many open source projects, not only do they endorse it, but they support it.
“After all, the source for Aqua, Finder, iTunes, &c are not publicly available.”
That does not make them any less supportive of open source software.
I wish you people would recognise these facts and stop trying to pick nits all the time.
Is it really correct to say Apple has endorsed OSS? Hitching one’s cart to open source is not the same as endorsing it. After all, the source for Aqua, Finder, iTunes, &c are not publicly available.
======
It is correct to say that Apple benefits a lot of free software. It must be said that they give some things in return ( Darwin Streaming Server, Compiler Tools, Rendezvous, WebCore, X11). It must be said that the APSL 2.0 is this time really free.
Obviously though, they took more in free software that they give in return. I can see two domains where Apple can make a good PR action and not hurt (who said benefit ?) their business :
* Help the gnustep.org project to achieve these goals (implementation of the nextstep api). More software
for macosx won’t hurt. Some devs are reluctant to develop apps for macosx. If they can develop cocoa apps not only for macosx but also for the following platforms (http://gnustep.org/information/machines_toc.html), they will feel better.
* Microsoft Office is a big vendor lockin. The netbios/smb networks were a big vendor lockin but Samba has broken it. In the domain of Office, AppleWorks just cannot compete. What is needed is to change the rules of the game with a app who haves the SAME features, BUT is cheap, BUT is cross-platform, BUT has an open XML fileformat. This app exists and it is OpenOffice.org . A basic port for macosx+X11 already exists. In my opinion, Apple should move his ass and make from it a just-working Aqua application. It’s up to them.
They have no obligation to do so, but I think it would be clever. Hope that helps.
Apple Public Source License Now FSF Approved
http://apple.slashdot.org/apple/03/08/06/1729213.shtml
“Is it really correct to say Apple has endorsed OSS? Hitching one’s cart to open source is not the same as endorsing it. After all, the source for Aqua, Finder, iTunes, &c are not publicly available.”
Apple have done something which very few other companies have so far managed; to utilise Open Source (OS) software in a way which enables them to make a profit and still keeps the community happy! They take an OS product, polish it, add essential features to it and release it as their own along-side proprietary products while returning their improvements to the community for everyone elses benefit.
Just because a product uses OS, doesn’t mean it all has to be OS. OS software such as Konqueror/KHTML, Mozilla and Open Office provide good non-proprietary base platforms for others to extend and sell commercially. The more you improve and integrate them into your targetted environment, as Apple has done with its OS based products, the more perceived value they have. Willingly adhering to the requirement to return your changes to the community means the project as a whole benefits and the original developers accept you as a member of their community. A symbiotic relationship which so many closed-minded “business men” just don’t get.
Ballmer and Gates are the epitomy of this type. Men with bad cases of tunnel vision. If MS were to have a complete re-think, admit they were wrong in some of their opinions, and adopted some OS projects as the new bases for their products everyone would benefit. Microsoft would immediately improve their standing in the security community and could direct their resources more efficiently on improving their core products; their customers would have more reliable and open products to avoid being locked-in; and the OS community would gain valuable returns from MS’ investments. Will this happen? Never! Ballmer and Gates will reap what they have sown by stifling competition in the past and it will humble them, if not completely destroy them. They will never accept OS even though it is the only thing which can ultimately save them.
[/i]Microsoft’s “securing the perimeter” strategy (i.e. automatically updated firewall/netfilter rules) is the most innovative approach to security I’ve seen in recent history. If effectively implemented, this would allow network security vulnerabilities, such as the ones exploited by such worms as Code Red, Nimda, Slammer, Blaster, and Welchia, to be closed within hours after rules are released, eliminating the need to patch systems immediately after the discovery of each vulnerability.
Do you know what [i]why you patch software? It’s because there’s usually a buffer overflow in the software that allows a malicious attacker to execute arbitrary code, not because certain “ports” are open when they shouldn’t be. Maybe some attacks use open ports, but any decent firewall will block everything but essential ports, which you don’t want closed. Ever.
Do you even know what patches do? They usually fix buffer overruns, actually. One thing they never do is block ports. Open ports and remote exploits are two different beasts, friend. Sounds like you’ve bought into Microsoft’s techno-babble propaganda.
Linux & OpenOffice because i don’t want to put my customers in a bind with Microsoft’s file format, so i use .rtf and OpenOffice’s pdf export tool. why would i want to make ANYONE pay several hundred dollars for a Office suite just to read & edit a few pages of documents…
who says you have to use Microsoft’s OS & Office to make professional documents is just a microsoft shill.
Do you know what why you patch software? It’s because there’s usually a buffer overflow in the software that allows a malicious attacker to execute arbitrary code, not because certain “ports” are open when they shouldn’t be. Maybe some attacks use open ports, but any decent firewall will block everything but essential ports, which you don’t want closed. Ever.
Thats true however you need to trigger the exploit in some way and to date the most common method of doing that is via an open port that exposes the service with the exploit.
I was unpatched when Blaster hit and yet I wasn’t effected. Why ? Because my hardware firewall was configured properly and the ports that Blaster was looking for were not open on my system.
Yea, Ballmer has a TOUGH job trying to preserve 80 percent profits on products that there’s an OSS free equivalent.
Let’s be honest, the ONLY reason those profits are still around is Office file format lock in and windows lock in through the large universe of windows apps. That’s it. That accounts for the billions in profit.
If we could have an open file format for Office type files and linux versions of all those windows apps out there, then Ballmer and Gates would be forgotten and never heard from again.
“I regard this sentance as just plain ordinary racism, and I have a hard time to believe that the CEO of one of the biggest company said it in public. ”
Racism? Where is the racism, exactly?
Ports are already blocked fine by intelligent firewalls, yet systems still get compromised. The person I was replying to implied that changing which ports get blocked is a replacement for patching. Companies networks get compromised through ports they cannot block.
I’m puzzled whenever I hear corporate guys talk about responsibility, accountability or indemnification. Can anyone tell me which company has ever received a check from Microsoft to compensate their losses due to Redmond’s malware ? How many IT executives went to jail because their product caused problems like identity theft, shutdown of a US Navy destroyer, power shortage throughout the East Coast, … ? Where in Microsoft EULA does it say they’re willing to indemnify customers ? On the contrary, they’re among those who created their own private law enforcement agency (the BSA) to wreak havoc in businesses (ask Ernie Ball about this), schools and municipalities.
If wealth causes Gates and Ballmer to forget the meaning of words, maybe they should stick to exclamations (great, wrong, super, cool, …). This way, we won’t have to guess what they’re actually saying.
I didn’t said racism, I said plain ordinary racism, the kind of things you see every day, a little like making comments about the physic of a woman in politic when you strongly disagree with her. This last thing happens in the OS community
in Europe those days agains Arlene McCarthy (England, proposal for software patents), and I try to fight it every time I see it.
Check the sentance and tell me what is wrong.
[[ The fact that someone in China in the middle of the night patched it … ==> no sustainable level of quality ]]
http://www.pbs.org/cringely/pulpit/pulpit20031023.html
Absolutely right. One of the greatest ironies is to hear Gates go on and on about protecting Intellectual Property. That’s what’s so evil about Open Source; can’t protect IP.
But Microsoft has been convicted several times and settled out of court many more for stealing code.
If I had to use Linux for a year I would quit using computers after a week and join a Mennonite Community. You are right I am addicted to what works.
Just before you posted, you may have view a little link
“Submission of a comment on OSNews implies that you have acknowledged and fully agreed with THESE TERMS”
So, if you didn’t agree with point #4, and what bothers me more point #3, it was not worth to post.
More, I don’t see what is wrong with Steve Ballmer in this video. I think I would prefer a boss who acts from time to time just like an human.
Truly yours.
Apple isn’t 100% opensource. Only the kernel and some tools came from BSD licensed software. The GUI is not opensource, it’s poprietary. Apple also aims on a different target users than MS does, though i honestly can’t define the exact difference.
By Bascule (IP: —.atmos.colostate.edu) > “Microsoft’s “securing the perimeter” strategy (i.e. automatically updated firewall/netfilter rules) is the most innovative approach to security I’ve seen in recent history. If effectively implemented, this would allow network security vulnerabilities,”
Can you tell me more about this feature? It sounds like a NIDS. Or like pfysnc… or like PortSentry…
If the Windows box downloads firewall rules from a Microsoft.com machine ”automagically” i see it as a hostile/trojan feature.
Apple isn’t 100% opensource. Only the kernel and some tools came from BSD licensed software. The GUI is not opensource, it’s poprietary
Which company makes 100% free software ? Redhat, Mandrake, not much more. All others make proprietary software : SuSE has YAST, IBM, Oracle, HP, … have participate in free software projects and have their proprietary software as well.
It doesn’t usually make sense to make opensource for a company what is in the core of your strategy. But they are very often some domain where it makes sense.
I tried to list two for Apple (gnustep.org and OpenOffice.org)
“Microsoft’s “securing the perimeter” strategy (i.e. automatically updated firewall/netfilter rules) is the most innovative approach to security I’ve seen in recent history. If effectively implemented, this would allow network security vulnerabilities,”
Can you tell me more about this feature?
Sure, read the TrustedComputing/TCG/TCPA/NGSCB/Longhorn/Palladium/ FAQ from this security expert guy http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html
Prove it to yourself, quit for a year and use something else, anything else. Prove you are strong enough to quit your “junk” habit.
Too much hassle.
On the server side Linux has been an easy move. On the desktop its just not ready for me. I don’t have time to screw around and find replacements for the software I run. There is no point anyway. The stuff I use is already paid for and it works.
“If I had to use Linux for a year I would quit using computers after a week and join a Mennonite Community. You are right I am addicted to what works.”
Hmm … let me see. Exactly how many times has my Linux system (since RH6 – currently RH9/XD2) actually not worked. Well there was the time I overwrote /dev/null by mistake (that’s how much of a Linux newbie I was – reminded me of when I ran Cleansweep on an early version of Win98 and it deleted a load of IE/Explorer system files – ahh memories :o) ). I tried to re-compile the kernel once and that didn’t go too well either (I *can* now but never bother – the RH stock is fine but at least I have the option). Driver support has got progressively better and now supports all of my hardware with at least generic drivers if not specific.
X occasionally locked up on me but that got diagnosed to a hardware fault in the end. A funny story actually as it was the very same fault causing problems in WinXP which finally got me using Linux full time (Mandrake 7 IIRC). Once I figured out what it was I found I could live without Windows but I couldn’t live without Linux so, although I have tried numerous distros, I am still using Linux to this day!
I’m not going to say Linux is faultless, but even after learning it from scratch and trying several flavours, I would still consider it to have been a very worthy investment which make me more productive than Windows ever did. That said, I am trialling BeOS R5 ATM and very much looking forward to giving Zeta a good thrashing. I think it might just be the comfortable middle ground I am looking for with the power of the Unix command line I have grown to love and a GUI which is faster and more intuitive than Windows. We’ll see how that goes though. Whatever happens, Linux will still live on in the various servers because it’s so secure, reliable and easy to manage.
Addicted to what works? Yep, but it ain’t the drug you’re expecting!
“Which company makes 100% free software ? Redhat, Mandrake, not much more. All others make proprietary software : SuSE has YAST, IBM, Oracle, HP, … have participate in free software projects and have their proprietary software as well.”
Didn’t knew YaST was proprietary. Does RedHat include such stuff too? If so, which?
I also think a setup tool like YaST is something totally different than a GUI like Apple made.
“I tried to list two for Apple (gnustep.org and OpenOffice.org)”
Sorry, i don’t understand what you mean with this. What do you mean with ”list two for Apple”? What did you tried?
“Can you tell me more about this feature?
Sure, read the TrustedComputing/TCG/TCPA/NGSCB/Longhorn/Palladium/ FAQ from this security expert guy http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html“
Didn’t Orwell innovate this?
anyway thanks for clearifying, i didn’t knew it was a part of TC(G)/NSSCB. I’m not so sure wether the ”block everything, allow some” idea is really innovative… on firewalls it isn’t. On servers with virtual OSes, chroots, et al it isn’t either. And finally, i at least know an implementation of this in NetBSD called verified exec which also exists as kernel patch for OpenBSD, called Stephanie. Seems very similair…
Excuse me, forgot to add URL for Stephanie
http://www.innu.org/~brian/Stephanie/
NetBSD docs somewhere at http://www.netbsd.org
“By Anonymous (IP: 12.105.181.—) – Posted on 2003-10-23 22:06:47
Apple Public Source License Now FSF Approved
http://apple.slashdot.org/apple/03/08/06/1729213.shtml“
(6 august 2003)
No, NOT FSF approved. OSI approved. Which doesn’t mean much to me taken they also approve this license which is imo far from Free:
http://www.opensource.org/licenses/real.php
Didn’t knew YaST was proprietary.
Yep. Specically it does not allow commercial redistributions
of derative works, so ain’t free softwar.
Does RedHat include such stuff too? If so, which?
Yes. Each distro developp their own tool, for this reason each setup tool works only at 95% . I think it’s a consequence of YAST being proprietary. Mandrake has urpmi and the drak* tools. I don’t know the exact names for Redhat.
“I tried to list two for Apple (gnustep.org and OpenOffice.org)”
Sorry, i don’t understand what you mean with this.
My english sucks 😉 I talked about that http://osnews.com/comment.php?news_id=4898&limit=no#157619
Didn’t Orwell innovate this?
A guy said before that Microsoft really innovate in the security domain. I have to agree. Classical security tries to defends the PCs from foreign attacks. The DRM and the trusted computing try to protect the PC against hist user.
No, NOT FSF approved. OSI approved. Which doesn’t mean much to me taken they also approve this license which is imo far from Free: http://www.opensource.org/licenses/real.php
=====
Nope. Version 2.0 of the APSL is both OSI AND FSF approved.
There is absolutly no doubt :
http://www.gnu.org/philosophy/license-list.html
Microsoft’s “securing the perimeter” strategy (i.e. automatically updated firewall/netfilter rules) is the most innovative approach to security I’ve seen in recent history.
(1) Cisco NetRanger could dynamically reprogram perimeter routers to repel attacks back in 1999 when I worked with them.
(2) Dynamically reprogramming firewalls doesn’t help you when your laptop users bring a worm in from outside (or they maliciously or through ignorance, download a trojan etc. off the net).
Remember this, when baseball legend roger clemmons stood up because people were appluading him, the other team lauded him as well. When MSFT put be out of business, it can be said from that point foward, that it would be very difficult to regain *that* sort of mutual respect.
And, BeOS is like bsd, and linux, except, we use a well fleshed out gui without a lot of cruft. Security experiments, nonwithstanding.
You can protect IP in OSS. You can actually manage it, and make money on it.
Also, Be people do it for way cheaper than free…
“Do you even know what patches do? They usually fix buffer overruns, actually.” — ThanatosNL
This brings me to an (alas, somewhat off topic) question:
Why don’t operating systems simply mark their executable’s stack pages non-executable? It seems as if this would eliminate 90+% of the buffer overrun exploits possible.
Basically, Ballmer is reaching for anything here because he knows deep down that MS is in trouble. Don’t get me wrong, they are not going away overnight or even in the near future. But what is happening is the OSS movement is finally making MS accountable for their actions. Buggy software, security flaws, way, way overpriced software…..you feel free to add more. People and businesses are getting tired of it. This is truly the beginning of a signficant revolution in the computing industry and MS refuses to believe that they will be affected, but again, deep down, they have to know what is coming.
No, actually I would say Microsoft suffers from attention deficit desorder. When people aren’t paying absolute attention to Microsoft, Balmer and Gates go nuts doing anything that can get the spotlight to shine back onto them. Say a lie or two about Linux, give something away for free, they’ll try absolutely anything to get that industry spot light back on them.
Linux now has the industry spotlight and for all of Microsofts anti-Linux and anti-UNIX remarks, it has done them diddly squat in stopping Linux’s marketshare from increasing. It is time for Microsoft to suck in their bottom lip and find out what people like in Linux as a server operating system and adopt the same approach.
Linux is popular because is familar; UNIX-Like, dynamic; constantly evolving with a transparent development process where implementations compete to get into the kernel and are chosen because of they’re superior, compatible; this allows many companies who have UNIX applications to get them ported to Linux with minimum fuss, low cost; ISV’s love the fact that the operating system is no longer hogging up the huge about of money it did before. Look at Red Hat Enterprise for example, you can buy the biggest, meanest support package and unlike Microsoft, you don’t need to pay for every computer accessing that server. It is flat rate meaning that you don’t have to increase licenses as more people access the server.
With money freed up there, more can be spent on third party software, which is why IBM is happy, They’re the middleware king and if a customer saves money on the operating system, the customer can then be sold DB2 and a whole heap of other software without the customer having a huge cost over their head.
One of the reason you see Ballmer spouting out false and stupid phrase about Linux as if he had a bad case of tourettes syndrome is because of story’s like the one below.
http://story.news.yahoo.com/news?tmpl=story&ncid=1817&e=3&u=/techta…
Highway patrol gives Linux a green light
WASHINGTON, D.C. — As Microsoft’s support for Windows NT Server 4.0 grinds to a halt, many enterprises will be tackling challenging server upgrades.
Information systems directors, like Cliff Gronauer of the Missouri State Highway Patrol, have tuned and tweaked NT servers during recent years to keep systems afloat. Gronauer has decided to avoid the “expense and pain” of upgrading to Windows Server 2003 and opt for Linux when support from Microsoft concludes at the end of 2004, he said Wednesday at the Enterprise Linux Forum conference.
“Our planning started a year and a half ago and, during the last six months, we’ve gotten everything of substance implemented. The functionality is there and the performance is there,” Gronauer said. “Most customers don’t even know we’ve converted, which is a good thing.”
The highway patrol is now humming along on Red Hat Enterprise Linux 2.1, running on Dell rackmount servers. The boxes are production machines, doing everything from file and print services to Web serving, plus supporting internal staff and users on the Web. Eventually, Gronauer said, Linux will have a presence deeper in the data center, doing database serving and other mission-critical work.
“NT was working fine for us. It all boils down to support issues,” Gronauer said. “So far, we’ve been lucky enough to find [the applications] we’ve been looking for. We do a lot of our core applications on the mainframe. Most of what we’re looking for right now is available: Web services, like Web serving and e-mail, file- and print-serving applications.”
Gronauer said his biggest challenge might just be in-house expertise. Moving from Windows to command-line Linux requires extensive training in some cases, more so than moving from a Unix environment. Gronauer said some admins with AIX Unix experience have already begun working with Linux.
“Finding people with Linux experience is going to be our biggest challenge,” he said. “We’re in Jefferson City, Missouri. It’s not exactly a computing capital.”
Gronauer said his department is also undergoing a server consolidation project, making it difficult to gauge cost savings. He added that not paying hefty Windows licenses will be a welcome relief in a cost-conscious government setting.
“The decision was mine. I’ve been in this business 20 years, and I’ve watched it evolve and develop,” Gronauer said. “I had a number of discussions with some colleagues that I respect and decided to try Linux on a smaller basis in our enterprise doing file serving. Myself and the admins in my division decided it was a stable environment and said we should press forward.”
Howdy,
Reading what Gates and Ballmer both have to say about Linux, I am struck by the realization that they seem to completely miss the real reason for Linux’s success. They both focus on the fact that some people say Linux is cheaper and try to argue whether that is true or not. They seem to just dismiss any other Linux advantage out of hand. I know I did not leave the Windows world because of the cost. I would have kept paying them pretty much whatever they asked. I left because of the increasingly unreasonable license terms and DRM. It was hard at first. I thought Linux(and FreeBSD) were just weird, doing things the hard way. But as I have grown more experienced, I find that Linux is easier to use than Windows. Almost everything I do on a computer works better on Linux that on Windows and the momentum is not in Windows favor.
But I can’t decide if Microsoft’s blinders are a good thing or a bad thing. They clearly do not seem to understand the long term implications of what they say and do.
So, I don’t think Ballmer slipped at all. He said what he thinks. He’s just wrong, is all.
There was a good point in the article how the “top of the food chain” has no idea what it takes for the little guys to survive…
For example to understand a user and his motivation to move to linux they should aks themselevs: “How many application come with any flavor of Windows, that help me as a user to get the job done and without paying extra for it?” The answer is: NONE!!!
And what you get with … lets say RedHat Linux (8.0, 9.0):
office suit – oh yes! – OpenOffice.org
Webserver (Apache), fileserver (Samba), databases (MySQL, PostgreSQL), programming (C, Perl, …)….
and on top of that you find the system out of box is secure, while your friends battle with windows patches that break the system you are being productive!!!
That’s why I gave up on Windows…
It seems as though people are confused and think that I said “securing the perimerter” was a good idea. That was someone’s responce to me saying MS needs to do something about security.
If MS’s only tactic is to “Secure the Permimeter” that is the dumbest thing I’ve ever heard of. It’s even dumber to say that it is “inovative.” Ok here’s some proof:
netstat -a of my linux machine at home:
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:x11 *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:631 *:* LISTEN
tcp 0 0 localhost:x11-ssh *:* LISTEN
netstat -a of my windows 2000 box at work:
Proto Local Address Foreign Address State
TCP charlie:epmap charlie:0 LISTENING
TCP charlie:microsoft-ds charlie:0 LISTENING
TCP charlie:1029 charlie:0 LISTENING
TCP charlie:1034 charlie:0 LISTENING
TCP charlie:2954 charlie:0 LISTENING
TCP charlie:2977 charlie:0 LISTENING
TCP charlie:3090 charlie:0 LISTENING
TCP charlie:3092 charlie:0 LISTENING
TCP charlie:3097 charlie:0 LISTENING
TCP charlie:3115 charlie:0 LISTENING
TCP charlie:3120 charlie:0 LISTENING
TCP charlie:3123 charlie:0 LISTENING
TCP charlie:3128 charlie:0 LISTENING
TCP charlie:3130 charlie:0 LISTENING
TCP charlie:44334 charlie:0 LISTENING
TCP charlie:netbios-ssn charlie:0 LISTENING
TCP charlie:1032 charlie:0 LISTENING
TCP charlie:1334 charlie:0 LISTENING
I run slackware and by default the only ports I have open are 22 (ssh) and 631(cups). It also listens for x11 connections when I’m running X. Windows 2000, who knows why all those ports are open. It’s stupid, my system is wide open (well not really I’m running TPF)
But my point is, it’s not innovative to “secure the perimeter.” Most other operating systems are already realatively secure by default. Yes firewalls are a great thing, but you also have to worry about internal security policies (i.e. why does every version of windows make Administrator accounts by default?)
I wouldn’t put much store, in what Missouri government officials do. They probably couldn’t figure a way to siphon money off from thier present contractors and MS.
I live in Missouri. It is has one the most corrupt state governments in the US. Around a decade sg $60,000.000.00 dollars earmarked for improvement of the interstate system got squandered off into thin air. Some of the local construction companies were really upset at the time. No one paid attention. They thought the companies were just complaining because they didn’t get the money. Now our highway’s are in dire need of repairs and it is not getting done. Look at the rating for interstates Missouri is one of the worse.
Is your computer at work on local network? Is your computer at home?
“Yes firewalls are a great thing, but you also have to worry about internal security policies (i.e. why does every version of windows make Administrator accounts by default?)”
The local admin thing has to stop. Certain programs will not run unless the user is a local admin and this is just plain stupid. I don’t know aobut newer versions of MS Office, but on Office 97 the spell checker in Word was non-functional unless you were local admin. The registry can be set to allow locked down users to access the correct keys for many of these programs but with a multitude of machines and apps, this far from feasible.
In my opinion the above is the greatest security flaw with Windows and one that I don’t feel they truly are addressing.
Yes both computers are on a network. My home computer has also has “true” SPI firewall between itself and the internet, so it’s not like I’m saying that ports being closed is the ultimate in security (i’m pretty paranoid about security).
And that’s exactly what I was saying, why doesn’t microsoft see it as a problem that just about every windows user out there is using a “root” account? I rememeber when I first started using linux and was still very much in the MS mindset, I was like wow this is a pain in the a$$, whenever I want to do something I have to do it in root (and before i learned about su and CLI text editors I would sometimes open X up as root, DOH!) Anyways, yeah I agree it doesn’t even seem like MS sees this as a problem whatsoever.
I think apple approached this issue perfectly. Basically, whenever a major system change is about to happen, they prompt you for your password. It’s not a true “root” account approach, but its better than nothing (although osx does have a root account, you just have to enable it). I’m sure they didnt’ want to lock things down so much that the average user woudln’t be able to user their machine. MS really needs to learn that if they limited user accounts by default, viruses might become a non issue like they are in other OS’s, simply because unless I go out of my way to authorize an executable, it CAN’T run. It’s impossible.
Thank all you OSS nay-sayers out there! My consulting company works exclusively with OSS, and so far its been a gold mine. People (especially business owners) are tired of Microsoft’s licensing schemes and expensive forced upgrades (not to mention the crashes.) I can replace NT servers with FreeBSD or RedHat, switch Windows desktops with Mandrake or RedHat running OpenOffice.org, and offer full support, all for less than the cost of running a Microsoft shop. I’m glad few people have awakened to realize that the latest OSS solutions (samba, OOo, the various 9.* versions of several distros, etc) are in fact ready for business RIGHT NOW. I’m glad because I’m getting in early while there is lots of money to be made. By the time you guys try to get on this ship (2-3 years), there won’t be any more room.
RedHat Linux is 100% free software, feel free to ask them.
“People (especially business owners) are tired of Microsoft’s licensing schemes and expensive forced upgrades (not to mention the crashes.)”
MS is going to have modify thier licensing. Not just because of Linux but because poeple aren’t going to be told when they have to upgrade. It also imposes an artificial deadline on MS themselves. What are thier cusotmers going to say when they have renew thier software assurance lisc. for XP and there was no upgrade provided during the last period.
About a year ago I bought Visio 2002 Pro. I want the Technical to go with it but my rep at Insight told me it only came with software assurance which would double the price of the product to $800.00. I told her no way.
Two months later they discontinued the product. I called her and asked her what would have happened if I had bought the software assurance. She didn’t have an answer for me. Not good.
As far as crashing goes, W2K and XP rarely crash. When they do it is almost always hardware related. The only time I have had to reboot any of my servers or PC’s running w2k, xp or w2k3 is when installing patches (too often) or other software that requires a reboot.
For my clients they wouldn’t like the idea of me putting OSS software on thier computers. Maybe in the future. But I think they feel that would make them too dependant on me as thier provider. They just aren’t familiar enough with it. Best of luck in your biz though.
“Basically, whenever a major system change is about to happen, they prompt you for your password.”
Windows 2000 is doing that for years: executing a program as a-name-account.
But I agree: windows has a problem with multi users; more exactly, most non microsoft programms have problems : they still write configuration in programm files, which is stupid !
It is actually very difficult to use a windows with several account, perticularly on XP Home edition. For example, I need to be root to have the access to the infra red port !
Jim Parker
“This brings me to an (alas, somewhat off topic) question: Why don’t operating systems simply mark their executable’s stack pages non-executable? It seems as if this would eliminate 90+% of the buffer overrun exploits possible.”
Virtually every operating system does this… on CPU architectures that support it (e.g. Solaris has a non-executable user stack per default on sparcv9 architectures) Unfortunately, the list of architectures that supports this doesn’t include x86. It’s also not a silver bullet against buffer overflows.
skaeight
But my point is, it’s not innovative to “secure the perimeter.” Most other operating systems are already realatively secure by default.
Yes, but the instant a buffer overflow is discovered in any service (especially ones running as root) your system can most likely be completely compromised. The only ways to protect yourself on a typical operating system are 1) disable the service 2) patch/upgrade the service to a fixed version. Both of these require user intervention, and the first may take away a valuable resource.
“Securing the perimeter” is innovative because it allows services to continue to operate, but works without any user intervention. The need for user intervention in maintaining system security leads to millions of vulnerable systems which can be used for the purposes of propogating worms. Microsoft will be the first company to offer a means of automated, transparent system security that has little/no chance of impacting system operation.
Did anybody else notice how often Steve Ballmer referred to Linux Programmers as being “in China” in the video of the gartner interview? Why China? Open Source is coded by programmers resident in hundreds of countries on earth – why be so careful to specify one particular country?
The reason is rather cunning, and very cynical. China is the great Communist ‘Bogey man’ of the West. Mr Ballmer is intentionally inferring that Open Source is in some way associated with the ideals of communism, rather than wholesome All-american big business. This is classic FUD, and typically Microsoft.
It is also part of a strategy. The company caused much anger in the past by claiming that Open Source was in some way “un-american” and “like a Cancer”. Open Sourcers were deeply offended that their principles of academic openness, intellectual fraternity and intensive peer-review were misrepresented as being akin to Communism – when of course the Open Source movement is most clearly akin to the finest principles of freedom and liberty. The insult is made more ironic by the fact that Microsoft has itself has been found guilty of abuse of power and monopoly control. Rather ‘communist’ sounding charges, don’t you think?
Oscar Wilde once said that “Patriotism is the last bastion of the scoundrel”. Perhaps he might have added that McCarthyism is the last bastion of the morally bankrupt.