Linked by Thom Holwerda on Wed 9th Apr 2008 21:53 UTC
Microsoft plans to make a key Internet Explorer default change to thwart attackers trying to hack into its Web browser. The software maker will enable DEP/NX by default in IE 8 when the browser is running on Windows Vista and Windows Server 2008, a major tweak aimed at mitigating browser-based vulnerabilities. DEP/NX (Data Execution Prevention/No Execute) is already available in IE 7, but it's turned off by default because of compatibility issues.
Thread beginning with comment 308972
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[3]:Nothing - Gimme a break
by deathshadow on Fri 11th Apr 2008 00:51
in reply to "RE[2]:Nothing - Gimme a break"
Member since:2005-07-12
Tiem to stop drinking the kool-aid dude. Microsoft is the only one responsible for the security problems they have.
Yes and No. Back when most of this stuff was introduced it was innovative to do so and considered a good thing. As I said, hindsight is 20/20.
HOw can you not know that putting self executing code into your email system is a recipe for disaster?
Simple... nobody had ever tried it before - and it worked great in every other program they had. (remember, most activeX features appeared in Office FIRST). It's WAY TOO EASY to sit here today and badmouth decisions of a decade ago.
And who actually uses that?
Corporate dimwits using the API for in-house crapplets on their private intranets!
That feature alone is behind proabably 3/4 of the virus out there.
Correct - I'm in full agreement on that - What I'm saying let's be fair about why we reached the current situation. Developers were jumping up and down for joy when activeX and VBS extensions were introduced for Outlook and IE - We can call it short sighted today, or we can realize that people JUST DIDN'T KNOW. If it was such a horrible thing back then, how did it get such widespread adoption?
Or how about the fact that it runs as ROOT?
There is no 'root', it just runs atop a less secure filesystem... Let me ask you this, how many HOME computers before 1997 even had filesystem or OS level execution protection? Sure in the back-room *nix server world you had all this stuff (as an old AIX and Xenix guy, I was there) - but Apple didn't have it, DOS based machines didn't have it, CP/M didn't have it, Sinclair, Commodore, Atari and Tandy certainly didn't... and if you've been online from the 150 baud days, you know this quite well. I'm talking about the commercial companies that drove the REAL computer revolution of years past that brought the home computer to the masses - Not the FSF fanboys trying desparately to call their stuff a revolution when the old-timer *nix geeks got left behind, and the kids dipping into the FSF kool-aid who don't know any of this since most likely they were still suckling at the teat when this stuff happened.
Dont tell me that role based security hasnt existed far longer than Windows.
It did - with back room *nix server geeks. As I said above prior to the mid 90's you can't name me one mainstream home computer that had anything approaching it.
You are right about one thing though, people do bitch when MS changes things. SOmetimes you gotta break a few eggs if you want to make an omlet.
Except as a business, Microsoft has to answer to it's customers. Look at people bitching about Vista won't run all of their XP games, or how people bitched about 2K & XP not running all the Win9x games, or how 95 didn't run all of the Win3.1 games. We're talking a handful of non-essential programs in each case, and Microsoft bent over backwards to maintain as much compatability as they could - yet people talk about it like the sky is falling... Imagine if you made ALL applications people built using you own tools, most of them business based and not games - not run. They did exactly what you suggest, and you'd have companies like Symantec suing them for pretty much breaking all of their applications and how do you think the EU would react?
Af for innovation, CSS was developed by the W3C
Which Microsoft is a active member of... and at the time IE was praised for following W3C guidelines MORE than Netscape was... In fact, Netscape was repeatedly badmouthed for introducing and implementing techniques that did NOT follow the W3C spec, which is why Gromit was aborted, and Netscape was effectively declared dead at the end of '98 until AOL revived it with NS6 two years later... and it would still be close to SIX YEARS before the buggy, unstable and effectively unusable Gecko would become the useful entity we know it as today. Prior to 2004, how many web developers had even HEARD of the W3C, "Web Standards", markup/CSS validation, or even cross-browser development?
It was the talk of a handful of fringe wackos, NOT mainstream developers. Mainstream software developers had just one question prior to 2004 - Does it work in IE5 or later? Yes, today concepts like minimalist semantic markup, code validation, and standards compliance are the norm, but are people's memories so short they can't remember that only four years ago the vast majority of developers had never even HEARD of these? Hell, most books and courses still barely touch upon them except for only a handful of shining gems - if they did, steaming pile of garbage WYSIWYG's like Dreamweaver would have little or no customer base given the total rubbish EVERY wysiwyg outputs for code, and the decade old javascripted rubbish that comes with most of the templates and examples. (see that STUPID malfing MM_Swap rubbish)... likewise fat bloated rubbish frameworks and libraries like YUI or MooTools would be pitched in the trash as well.
and even Mosaic had browser extensions for things like video playback and stuff.
You mean plugins. I'm talking extensions in the sense of firefox extensions - or as they call them today, add-ons - which change or add functionality to the browers INTERFACE.
https://addons.mozilla.org/en-US/firefox/
For all the talk of firefox extensions/add-ons as an innovation in browser usability, how exactly are these ANY DIFFERENT from what ActiveX introduced with IE 4 over a decade ago? The only difference is that you have to choose to start the installation, instead of answering a yes or no question that everyone usually answers wrong. Mind you, that's a BIG difference and why they are LESS of a security risk, but really under the hood aren't they pretty much the same damned thing?
However, IE 7 was the first IE to not contain Mosaic code. So much for innovation.
WRONG, Trident was introduced with IE4, and was the first break from the original Mosiac renderer... The second break being Tasman which was used to drive IE 5.x for the Mac. (yes, the mac versions of IE 5.x does not use the same renderer as the windows versions)
Nice try though.
Edited 2008-04-11 01:09 UTC
Member since:
2006-01-14
Tiem to stop drinking the kool-aid dude. Microsoft is the only one responsible for the security problems they have. HOw can you not know that putting self executing code into your email system is a recipe for disaster? And who actually uses that? Yet do you see Microsoft changing it? That feature alone is behind proabably 3/4 of the virus out there. Or how about the fact that it runs as ROOT? Dont tell me that role based security hasnt existed far longer than Windows. You are right about one thing though, people do bitch when MS changes things. SOmetimes you gotta break a few eggs if you want to make an omlet.
Af for innovation, CSS was developed by the W3C, and even Mosaic had browser extensions for things like video playback and stuff. Unless you are talking about a specific kind of extension...However, IE 7 was the first IE to not contain Mosaic code. So much for innovation.