Experts: Microsoft Monopoly Represents National Security Risk

Submitted by Michael Lauzon 2003-09-25 Microsoft 66 Comments

Some of the nation’s leading computer science and network security experts issued a report warning that computers and critical technological infrastructure worldwide are increasingly vulnerable to attack because of the security practices and dominance of Microsoft software in desktop computing. UPDATE: Microsoft chosen as exclusive Homeland Security contractor!

About The Author

Eugenia Loli

Ex-programmer, ex-editor in chief at OSNews.com, now a visual artist/filmmaker.

Follow me on Twitter @EugeniaLoli

66 Comments

2003-09-25 4:36 am

Anonymous
I knew those Linux zealots were right all along
2003-09-25 4:59 am

Anonymous
Any reason why this one-sided report by anti-Microsoft pundits and competitors is taken at such face value? No statements are backed up by references or empirical statistics. Indeed it is full of a lot of whining and wringing of hands, though — hardly makes for a legitimate report.
2003-09-25 5:04 am

Anonymous
You know this paper is a joke when the second paragraph is:

“Microsoft’s efforts to design its software in evermore complex ways so as to illegally

shut out efforts by others to interoperate or compete with their products has succeeded.”

Comments like this just show that they are baised. It’s not the public’s welfare they are concerned about, it’s their own companies’ profits that is the main driver. Since they compete with MS they just want to drag them thru the dirt since it’s really sexy to MS-bash.

It’s fine to do this, but under the guise of “national security”. Blah!
2003-09-25 5:08 am

Anonymous
Go to the downloads section at http://www.microsoft.com and look at all the damn patches you can download for MS products. Now tell me this crap is secure. Windows operating systems leave too much crap running by default that the ordinary user has no idea what it does and has no idea how to turn it off. Does the ordinary user really need RPC and DCOM? (the 2 targets of the recent blaster worm).

Almost everyone i know that runs windows at home got hit by the blaster worm. I didnt get hit because im a network admin and i sit behind a hardware firewall at home. However the people i know are just ordinary computer users like the millions out there who cant even remember what the right mouse button does let alone how to download and install 50 patches from Microsoft and install them

This has become a serious problem and it is a massive security risk as people rely on computers so much these days.

My 2 cents
2003-09-25 5:10 am

Anonymous
Didn’t MS drag out the “national security” card during the anti-trust hearings to state that it couldn’t disclose its source code? And what is it now doing with its shared source programme? Just pointing out a little hippo-crazy.

Can you honestly say that having an MS monopoly is good for computing? If so, then you understand nothing of market economics, and the effects of a monopoly on innovation.

It may be fashionable to bash MS, however, a lot of people have a lot of good reasons to be fashionable.

Matt
2003-09-25 5:17 am

Anonymous
Using National Security as a smoke-screen is also very sexy these days. I was just pointing out that this paper is using it. MS is guilty of that too.

This paper is drivel though! The authors whine about lots of patches. Well, wah! Look at Sun…have you ever had to manage patch-clusters? Aix, HP-UX, even Linux. Everyone has boat-loads of patches. This is their main gripe?

This paper is pure marketing fluff.
2003-09-25 5:22 am

Anonymous
How hard is it to run Windows Update? Yes, this mechanism has it share of problems (availability and the patches sometimes are broken), but for the most part, people can patch their machines fairly easily. In fact it can do it automatically (of course, the user would have to know this and set it up…not a common “joe-user” thing).

In general, most computer users can run Update and protect themselves.

Hopefully, people will run a firewall at protect themselves a bit more. It’s cheap and easy to do these days.
2003-09-25 5:29 am

Anonymous
2003/09_sep/news/mswinblows0923.htm

Winblows ? Yes they sound very serious “Corporate Media News”
2003-09-25 5:33 am

Anonymous
Smeagol wrote:

“You know this paper is a joke when the second paragraph is:

“Microsoft’s efforts to design its software in evermore complex ways so as to illegally shut out efforts by others to interoperate or compete with their products has succeeded.” ”

Actually, the quoted text is the second paragraph of the introduction by the CCIA. The second paragraph of the report says:

“Most of the world’s computers run Microsoft’s operating systems, thus most of the world’s computers are vulnerable to the same viruses and worms at the same time. The only way to stop this is to avoid monoculture in computer operating systems, and for reasons just as reasonable and obvious as avoiding monoculture in farming. Microsoft

exacerbates this problem via a wide range of practices that lock users to its platform. The impact on security of this lock-in is real and endangers society.”

Smeagol: “Comments like this just show that they are baised. It’s not the public’s welfare they are concerned about, it’s their own companies’ profits that is the main driver. Since they compete with MS they just want to drag them thru the dirt since it’s really sexy to MS-bash.”

Regardless of bias by the CCIA or the authors of the report, you have not addressed the merits of their arguments. I would like to hear a substantive critique, if there is one.

Smeagol: “It’s fine to do this, but under the guise of “national security”. Blah!”

I’m happy to hear that you think it’s O.K. for people to criticize MS, its products and its business practices. However, I think that computer security is a national security issue. For example, see this report concerning the effects of a virus on U.S. State Dept. computers:

http://www.washingtonpost.com/wp-dyn/articles/A60650-2003Sep24.html

Regards,

Mark Wilson
2003-09-25 5:58 am

Anonymous
Smeagol wrote:

“Using National Security as a smoke-screen is also very sexy these days.”

Actually, it’s not sexy – it’s a matter of life and death.

Smeagol: “This paper is drivel though! The authors whine about lots of patches. Well, wah! Look at Sun…have you ever had to manage patch-clusters? Aix, HP-UX, even Linux. Everyone has boat-loads of patches. This is their main gripe?”

Evidently, Smeagol did not actually read the paper. The authors “main gripe” is with an operating system monoculture.

Smeagol: “This paper is pure marketing fluff.”

And your comments are…? Really though, I don’t see how a reasonable person could call the paper marketing fluff after reading it.

Regards,

Mark Wilson
2003-09-25 5:59 am

Anonymous
Windows Update got disabled on my machines when a “patch” broke networking. I live 650 miles away from home, and don’t get back for months at a time. I cannot afford to have things break while I’m not there. I run ~x86 (the experimental branch of Gentoo) and I have never had an update that fundementally broke the system!

Thankfully, my Linux firewall protected the Windows machines from blaster…
2003-09-25 6:18 am

Anonymous
The Windows security model is very good… however due to various backwards compatibility and poor programming techniques, just about breaks the security model in half… However it is possible to get a windows box secure, it just takes some effort, which the above report seems to forget about…

As for patches… may I say “OpenSSH”. Being a medium term subscriber of CERT, MS Security, and BugTraq, I can honestly say, that all platforms have there fair share of problems, and the number of problems is roughly equal among each platform, (OS + apps).
2003-09-25 6:58 am

Anonymous
I must admt I laughed when I heard that the USA’s new Paranoia-Central Visa administration and checking system ahd been wiped out worldwide because it was running on unpatched NT x boxes and they caught Welchia worm

A long time ago there was a funny email that did the office circuit: Things I Would Do If I Were An Evil Megalomaniac

These are some of its recommendations:

All my computers will run a special operating system designed for complete incompatibility with Windows Laptops or Apple Powerbooks

All important secret files will be padded to 1.45 Mb in size

There will be a single unbreakable password and i will NOT tell this secret to the hero of the piece before killing him. I will kill him first then tell nobody.

This is sooo gonna get modded down.
2003-09-25 7:04 am

Anonymous
“Ironically,” Geer continued, “Microsoft’s efforts to deny interoperability of Windows with legitimate non-Microsoft applications have created an environment in which Microsoft programs interoperate efficiently only with Internet viruses.”

ROTFL! Quite an exaggeration though.

Seriously there are reasons why to choose monoculture and Windows:

1. it’s expensive to maintain many OSs at a time. (Well, I agree that it can expensive to get a virus too)

2. Windows is more familiar and the dominant OS – increases productivity (Well, Linux doesn’t differ *that* much in GUI)

3. Marketing, Politics, Personal connections to vendors 😉

You’ll have to do a cost-benefit analysis. A monoculture is cheaper and easier to maintain but increases risk. If reducing risk is important use redundant systems; both in hardware and software (and maybe even have some way of doing things *without* computers, just in case).
2003-09-25 8:04 am

Anonymous
Some reading about what “the other side” says:

http://newsforge.com/newsforge/03/09/24/2333239.shtml?tid=2

Seems as if the conclusion depends on who is backing the study 😉
2003-09-25 8:04 am

Anonymous

2003-09-25 8:45 am

Anonymous
How hard is it to run Windows Update?

I was given a brand new machine at work running XP a few months ago. The first thing I did was run Windows Update. It took over 3 hours with numerous restarts and repetition. That’s at a transfer rate of over 100K. For your average broadband user we’re talking over 6 hours easily and you have to sit with your machine running clicking on it every half hour. Now try that on a 56K connection (yes, people with dial-up get viruses too).

So that’s how ‘easy’ it is to run Windows Update.

2003-09-25 8:47 am

Anonymous
After doing all my Linux-is-safer-propaganda, I managed to convince a friend of mine (who was really upset about the late virus attacks on his XP machine) to try Mandrake Linux.

When he clicked on “Mandrake Update”, and saw a HUGE list of Security Updates there (>200 Mb), I had some problem convincing him not to boot back to XP…especially when the update crashed straight away (well, actually after downloading all the patches, 2 hours later) due to “dependency hell”.

I am a Linux user and a bit of “evangelist”, but I think sometimes we’re a bit too forgiving on Linux’s own issues and a bit too eager to kick MS, after all being anti-M$ sounds so cool.

2003-09-25 9:16 am

Anonymous
I heard that future versions of Windows will have Windows Update set by default to update AND INSTALL newly available updates, to avoid blaster-like avoidable dramas. For the inexperienced user it might be nice (unless he is on dial-up), but what about updates that break your network connection? (like we had before), not to mention the ‘unwanted’ ‘updates’ you could then be downloading, like DRM, WM-player9, .NET framework, etc…

BTW, a new version of Windows Update is coming soon, which will not only update your windows system, but all microsoft software, at least according to the rumors.

2003-09-25 9:51 am

Anonymous
DUH!

2003-09-25 10:16 am

Anonymous
that link you posted was very funny…..

“Of 660 million Windows users worldwide, less than one-tenth of one percent were impacted by the notorious MSBlast worm last month. ”

heheheheheheheehehehehehehehehehehehehehehe

I must know every one of them personally then !

2003-09-25 10:48 am

Anonymous
Smeagol asked “How hard is it to run Windows Update?”

How many of your tax dollars do you want spent by people updating the 140,000 desktops at Homeland Security every week?

2003-09-25 10:48 am

Anonymous
I was given a brand new machine at work running XP a few months ago. The first thing I did was run Windows Update. It took over 3 hours with numerous restarts and repetition. That’s at a transfer rate of over 100K. For your average broadband user we’re talking over 6 hours easily and you have to sit with your machine running clicking on it every half hour. Now try that on a 56K connection (yes, people with dial-up get viruses too).

I think a better test would be to ask the average person on the street about whether they know about windowsupdate.microsoft.com. I’ll put money on it 9/10 people will not know what it is.

As I said previously, Microsoft has created a market filled with clueless users and they only have themselves to blame. They created that bar so low that even a monkey can use their operating system, now it is time for them to teach the monkeys that their computer needs updating once and a while.

The problem is made worse when you have large networks managed by clueless idiots who don’t install updates. There is SP4 released, yet, there are people running SP2, then whine when security fixes require that SP4 is installed. Companies who hire idiots like that only have themselves to blame. Instead of simply hiring people because they have a four letter acronym after their name, how about some real world experience, how about getting someone to quiz the applicant on computer knowledge one would expect an admin to know.

As for “incompatibilities” between applications and service packs, has any of these people actually thought about telling the vendor? give them a ultimatium and move to another solution if they don’t provide a patch to work around the issue.

2003-09-25 10:53 am

Anonymous
A better question, why did Homeland Security go for Microsoft when they could have signed a contract with SUN for $12million per year, unlimited clients, meaning, employees could also run it on their home computer.

Heck, why not just all the way, and go the full monty and move the whole public service over the the Java Desktop System. In regards to the Dell hardware side, Dell has agreed to bundle the software with their corporate line of Desktops.

Imagine how much money could have been saved had they weighed 3 months and gone with the SUN solution instead of being grabbed by the short and curlies by Microsoft.

2003-09-25 10:56 am

Anonymous
“I was given a brand new machine at work running XP a few months ago. The first thing I did was run Windows Update. It took over 3 hours with numerous restarts and repetition. That’s at a transfer rate of over 100K. For your average broadband user we’re talking over 6 hours easily and you have to sit with your machine running clicking on it every half hour. Now try that on a 56K connection (yes, people with dial-up get viruses too).

”

Yes, sure. But how is it different on linux ? I run fifty/fifty windows XP and debian. Debian requires more bandwidth than windows. And the number of security patchs is huge (but well, this number doesn’t tell anything on the security itself anyway).

Debian more secure than windows ? Maybe. But by default, ssh daemon is available for root, for christ sake ! So, let’s imagine that thing for almost all computers in the world, with the last openSSH bug… And tell me it wouldn’t be as big, or even bigger than Blaster. ( but, well, sshd is not available by default, I agree).

The problem is more the monoculture thing than microsoft itself. If all computers run the same Linux distribution around the world, I am far from convinced that it would be better… And I agree that a lot of stuff should be disabled by default on windows (like distant access registry, telnet, etc…)

PS : even if the debian packaging rocks, I had some problems with upgrade, sometimes. Mainly X server configuration lost, sound that doesn’t work, nothing too big, but I don’t know any upgrade process without failure.

2003-09-25 10:58 am

Anonymous
Trade-in your existing Windows or Linux Desktop and receive a 50% discount off your purchase of the Sun Java Desktop.

How do I qualify?

You need to provide Sun with proof of purchase and your license for your old desktop system. Details of how to do so will be posted here at the same time as the Sun Java Desktop becomes available for purchase.

What do I get?

In return for each desktop license you trade-in you will receive a 50% discount on the purchase price of a Java Desktop System. Its as simple as that – trade-in your existing desktop and get an even better deal on the best value desktop system available.

2003-09-25 11:02 am

Anonymous
> You’ll have to do a cost-benefit analysis. A monoculture is cheaper

> and easier to maintain but increases risk.

One of the certainties of a monopoly is that it is NOT cheaper. I don’t think you are really taking licensing into account.

Maybe it seems people could be more productive and tech support should be less, but this is Windows we’re talking about. In my own office there is always some computer that has apps not working for some reason, or viruses; and someone will spend hours trying to get things working.

2003-09-25 11:02 am

Anonymous
“Some reading about what “the other side” says:

http://newsforge.com/newsforge/03/09/24/2333239.shtml?tid=2

Seems as if the conclusion depends on who is backing the study ;-)”

Nice link, Steffo.

Man, can Mr. Zuck really pump out the BS… First, lets take a look at the title of his response:

“The Myth of the Monoculture: Why the CCIA Security Study is Just Another Thinly Veiled Attempt to Get the Government to Punish Microsoft and Give AOL and Sun a Leg Up”

How much of a professional tone is that? Its hard to believe that legislators are convinced by this guy that OSS is the wrong thing to do (or, at least, to not even consider it).

Now, this gem from the first line:

“…Ed Black is riding in with his own Marxist Government-mandated Software Security plan.”

Why is it the anti-OSS crowd always plays the commi-card? Was that really called for? Or relavent? As someone already pointed out, the CCIA has a minority membership of people who compete with MS. And none of them are exactly OSS (or communist, so that Mr. Zuck will understand) activist companies (with the exception of Sun. Although, it depends what day of the week it is as to whether or not they like OSS).

“Of 660 million Windows users worldwide, less than one-tenth of one percent were impacted by the notorious MSBlast worm last month.”

660,000,000 * .0009 = 594,000.

Not very big, but not very small, either… And what’s his source?

“On the operating system level, the authors do little to show why mandating a heterogeneous environment would create any greater security.”

Simple. It’s easier to write a virus that will infect one platform that to write one that will effect all platforms… Hence, why you don’t see many viruses that travel from species to species in biology.

Man, this is like shooting fish in a barrel

2003-09-25 11:17 am

Anonymous
There was something wrong with the link for the JavaDesktop Tradin offer. Here’s a good one:

http://wwws.sun.com/software/javadesktopsystem/tradein/index.html

2003-09-25 11:20 am

Anonymous
It may be fashionable to bash MS, however, a lot of people have a lot of good reasons to be fashionable.

I like that quote a lot. Kudos.

2003-09-25 11:21 am

Anonymous
“Of 660 million Windows users worldwide, less than one-tenth of one percent were impacted by the notorious MSBlast worm last month.”

Both sides are obviously making claims that are dubious to say the least. In love and OS-wars… 🙂

Nice that the link was appreciated. A good laugh a day keeps the doctor away.

2003-09-25 11:22 am

Anonymous
Maybe those who criticize the authors of the article fell asleep just after reading the press release. I suggest they wake up, take some coffee and read the entire report, it’s only 25 pages long. The authors raised some points, then discussed them. They were not ranting or bashing Microsoft : they only stated what is common knowledge for anyone who reads news related to computers. Their preoccupations would have been the same if another botched operating system was to be found everywhere, from homes to military bases.

Once again, this has nothing to do with Windows update, Nokia, Fujitsu, etc. It’s all about bad OS design, illegal conduct and their security implications.

2003-09-25 11:24 am

Anonymous
Nokia and Fujitsu are also members of the OSDL, Nokia develops a standard DVB (Digital Video Broadcast) system based on Linux together with Convergence Integrated Media/ Germany, as well as other Linux based solutions. They are a competitor of MS, too (Symbian).

Fujitsu also does a lot of Linux work, for example the Linux Center in Japan. They developed robots based on Linux HOAP1/ HOAP2, and they sell the Fujitsu Linux Primergy servers.

2003-09-25 11:27 am

Anonymous
Recently I installed Mandrake 9.0.

1.2ghz tualatin 384mb ram, 47gb scsi drive.

I wanted to update it.

I used Mandrake’s Package Manager and chose an appropriate FTP.

Trying to update everything at once crashes. Everytime.

There’s lots of updates.

So I gave up on Mandrake’s PackageManager.

I tried to install Apt4RPM, cyclic dependency problem.

“missing Glibc” I try to install GbliC. Says I need 3 other things. I try to install them. each one says it needed the other. I gave up on Apt4RPM.

I try to install Synaptic.

Says I need GlibC. Here we go again.

My Mandrake 9.0 CDs were RELEASES, not beta.

WHat

The

FORK?

my KDE updates to version 3.0.5. If I’m not mistaken, isn’t like ver 3.2 out now? Can someone tell me why I can’t update to it automatically? If I had APT4RPM would it do this?

I’m not giving up on linux (though maybe on mandrake,) so any advice would be helpful (even it you recommend a different distro.)

PS., I have a WinXP machine. I patch the security holes. No problems yet.

2003-09-25 11:45 am

Anonymous
“One of the certainties of a monopoly is that it is NOT cheaper. I don’t think you are really taking licensing into account.”

I was considering hardware, software, maintenance, user and admin training costs when making that claim. Heterogeneity costs. You have to buy licenses for other OSs or apps and maybe you lose discounts. You have to hire new admins or retrain your old ones.

I agree that a monopoly usually charge a premium price but the difference may be offset by the increased cost of heterogenity.

2003-09-25 11:55 am

Anonymous
“I agree that a monopoly usually charge a premium price but the difference may be offset by the increased cost of heterogenity.”

Right, but the “increased cost of heterogenity” is a one time cost, while the monopoly premium price continues for the life of the monopoly.

2003-09-25 12:08 pm

Anonymous
“Right, but the “increased cost of heterogenity” is a one time cost, while the monopoly premium price continues for the life of the monopoly.”

Yes, there is a short-term long-term aspect. Pay now and benefit later. It’s a shame though that companies today only considers the short run.

Note that a homogenous system might as well be a Linux, BeOS or whatever system. My comment was rather about homogenous vs heterogenous systems in general than about Windows systems vs the rest.

2003-09-25 12:15 pm

Anonymous
“In return for each desktop license you trade-in you will receive a 50% discount on the purchase price of a Java Desktop System. Its as simple as that – trade-in your existing desktop and get an even better deal on the best value desktop system available. ”

Why would anyone want to trade their hunting rifle in for a stone tipped spear? By the time java is finished loading(if it doesn’t crash) the work day would be over! Java with cream and sugar nothing else. C the orginal write once run anywhere

I have a solution to this problem! since the gist is that corporations selling software do not have national security interests as their top priority. Lets make software a government controlled public service! It is obvious to me that these companies being unable to compete in and open market and after law suits failed now label Microsoft as an accomplice to the enemies of the free world. Pathetic!

2003-09-25 12:40 pm

Anonymous
I haven’t got a lot of experience with Mandrake. I am using Redhat 9 and Ximian XD2 with it which works great. Ximian uses redcarpet as their packet-manager and in terms of updates and installing software it works great (it can’t upgrade distributons though).

I have also used Debian, which i don’t use anymore because of XD2 and the stable branch of Debian is a bit outdated. Having said that, Debian is a rock solid distribution, with the best packet-managing system for binary installs (at least i and a lot of other people think so). Updating and upgrading your distribution with apt is a breeze and i haven’t found anything like it in any of the other .rpm based distributions. I will propably give it another go when i buy a new computer.

2003-09-25 12:44 pm

Anonymous
“Of 660 million Windows users worldwide, less than one-tenth of one percent were impacted by the notorious MSBlast worm last month.”

Yeah right – almost everybody i know, who has a WinXP machine (me included) had problems with it. I mean c’mon – a virus that can take down your PC when you simply serve the net, without any doing of your own !!! That is just crap crap crap – How Microsoft can charge € 400.- for Software that alows that to happen is just beyond me.

2003-09-25 12:54 pm

Anonymous
Smartpatrol (IP: —.kuwait.army.mil) – Posted on 2003-09-25 12:15:08

“In return for each desktop license you trade-in you will receive a 50% discount on the purchase price of a Java Desktop System. Its as simple as that – trade-in your existing desktop and get an even better deal on the best value desktop system available. ”

Why would anyone want to trade their hunting rifle in for a stone tipped spear? By the time java is finished loading(if it doesn’t crash) the work day would be over! Java with cream and sugar nothing else. C the orginal write once run anywhere

Who said anything about Java?

http://wwws.sun.com/software/learnabout/desktopsystem/index.html

“Sun Java Desktop System

Sun Java Desktop System is an affordable, comprehensive, simple to use, and secure enterprise-grade desktop solution. The software consists of a fully integrated client environment based on open source components and industry standards, including a GNOME desktop environment, StarOffice Office Productivity Suite, Mozilla browser, Evolution mail and calendar, Java 2 Standard Edition and a Linux operating system. Key features include a well-defined, integrated look and feel, familiar desktop themes, as well as file, folder, and print interoperability with Microsoft Windows and Linux/UNIX environments.

I have a solution to this problem! since the gist is that corporations selling software do not have national security interests as their top priority. Lets make software a government controlled public service! It is obvious to me that these companies being unable to compete in and open market and after law suits failed now label Microsoft as an accomplice to the enemies of the free world. Pathetic!

What has that got to do with this discussion. GWB is you a-typical republican president, bought by big business, pushes the US so far into the red the words “Banana Republic” are uttered by some economists, the citizens finally wake up, a democrat is bought it, fixes the mess and so the cycle continues again.

It seems that no one has learnt anything from the Reagen years. Yes, the US can sustain a deficit, however, one day that debt does have to be paid back. It cannot continue expanding at an controllable pace other otherwise you end up with an Argentina.

As for the precurement policy of the US government. Don’t get me started on the number of 767 mid air refueling tankers that were bought by the Air Force, not because they were needed but because it would bail Boeing out of a spirling profit decline and massive layoffs (equaling votes). The US government is typical of a government with way too much money on their hands. There is this belief that as soon as they have money, they must spend it and it must be on the most expensive, unreliable and unnecessary piece of equipment(s).

Why should I even comment, I mean, heck, the original poster is in the US Army, it speaks for itself. Its like putting Indonesian Army and terrorism in the same sentence, one is never surprised to see it occur.

2003-09-25 1:22 pm

Anonymous
The findings of the study are really obvious. It is sad that the first pages takes so much the form of an MS bashing but hey, who else has got such a monopoly ?

I am really amazed that some will argue with the core statement of the study.

PS:

To the guy who wants to keep Mdk 9.0 up-to-date, start with using the current version which is 9.1 and soon 9.2. Not only there will be less updates but also, the update engine has been improved and polished.

2003-09-25 1:29 pm

Anonymous
“Of 660 million Windows users worldwide, less than one-tenth of one percent were impacted by the notorious MSBlast worm last month.”

That seems funny. I got Blaster, my sister got Blaster, my best friend got Blaster and the local computer shop got Blaster on their intranet. I suspect that a huge percentage of Windows machines were affected and the owners did nothing about it. I was aware simply because my dialup slowed to a crawl and my network traffic showed a huge amount of upload traffic. I doubt that the average person would be able to fix the problem. My ISP for example is firewall unfriendly – it requires ICMP echo requests – most firewalls block them by default.

2003-09-25 1:30 pm

Anonymous
“PS:

To the guy who wants to keep Mdk 9.0 up-to-date, start with using the current version which is 9.1 and soon 9.2. Not only there will be less updates but also, the update engine has been improved and polished.”

That is kind of like complaining that your ’87 thunderbird doesen’t get as good gas mileage as a new car, eh?

2003-09-25 1:40 pm

Anonymous
We’re just seeing the first effects of how bad things

can get when one company controls everything. With computers

controlling more & more of everything around us we can only

expect things to go downhill from here. I think you will

slowly change your minds when it starts to affect you personally on a daily basis.

Ex:

Cant get any of your money because your bank is down again!,

and the ATM out front is on the BSOD.

Cant get to work because your cars onboard computer keeps rebooting for no reason.

Your kids cant turn in there homework because another national televised virus alert has infected your home network…………

2003-09-25 2:07 pm

Anonymous
Let’s assume the average emailer has 10 contacts in his addressbook.

With outlook having around 90% of the market, that would mean that a virus would hit around 9 out of 10 people in the list on average.

In the case where there would be 3 major players with each 30% market share, it would hit only 3 out of 10 people.

But, if the virus would have to spread, it would have to take multiple hops. Then the numbers scale very quickly:

2 hops : 81 vs. 9

3 hops: 729 vs. 27

4 hops: 6561 vs. 81.

Conclusion: more diversity makes it more difficult to write a virus.

2003-09-25 2:16 pm

Anonymous
According to the paper, this integration of applications requires writing code that is 15 to 35 times more complex and, by extension, more vulnerable to attack than that of its peers.

What are they using to judge code complexity? Who are the peers that they mention? Do they mean some sort of COM objects? Anyway, I am no fan of microsoft, but a statment like this dosen’t make sense. If they are making a direct connection to say UNIX then they are off base in some areas. Sure to pipe data from one application to another may be easier in a UNIX enviroment, but writting a GUI application using X calls only, is complex to say the least.

I think the main problem (this idea was lifted from Rob Pike http://www.cs.bell-labs.com/who/rob/utah2000.pdf) is that people no longer differentiate between an OS and all of the applications that run on top of it.

2003-09-25 2:18 pm

Anonymous
It does not matter whether it is Linux, Windows, FreeBSD, or any other operating system; all operating systems will have flaws and security holes. However, Windows operating systems will always have the most security problems because it has the largest market share. Most virus writers are not going to spend their time writing viruses for an operating system that is only used by a small percentage of computer users. They are going to write viruses for the operating system that holds the largest market share, which is Windows.

I will never understand why Linux zealots always keep talking about “insert a Linux distribution here” is going to kill Windows. In fact, the Linux zealots should be glad that Windows has the largest market share. It just means that for the people using Linux, the internet is much more of safer place.

2003-09-25 2:48 pm

Anonymous
the choice of the homeland security department to use m$

software was not in the best interests of U.S. taxpayers.

http://www.nsa.gov/selinux/ security enhanced kernel has been tested on redhat.

propagation of computer virii to other systems would be

reduced with an operating system modified for higher security.

where is http://www.nsa.gov/sem$/ ?

2003-09-25 2:51 pm

Anonymous
“In fact, the Linux zealots should be glad that Windows has the largest market share. It just means that for the people using Linux, the internet is much more of safer place.”

Right, lets be thankful for..

Clogged pipes (worms)

Few commercial software packages (marketshare)

Few vendor drivers (marketshare)

Lets all be thankful for the above.

2003-09-25 3:14 pm

Anonymous
There seems to be an assumption that heterogeneity means incompatibility ! It’s only the data that needs to be in a consistent format. Apps don’t need to be all done in the same way neither do operating systems.

An html/xml/csv/mpeg/gif/email/pdf and other can all be opened by a huge number of applications, but also of programming API and even handheld devices. Do they all run the same OS ?

Similarly, people can use different apps without getting lost contrarily to what some say. Or MS would have been unable to get people to use something else than Lotus 123 or wordperfect. Did Western companies make huge productivity losses in the process ? Seriously !

2003-09-25 4:06 pm

Anonymous
I did not mean to imply that Linux should not try to increase its’ market share, but I believe it to be in Linux’s best interest not to try to “kill Windows.” If that would happen Linux would become almost like Windows.

Right now, Windows is the main target of virus writers. I would like for it to stay that way, but if Linux gains too much market share virus writers may start targeting Linux just as they are doing with Windows.

2003-09-25 4:09 pm

Anonymous
I doubt they would get too far, honestly. They have had since 1991 to try. 😉 I don’t think Linux should “kill” Windows eiter, just gain enough marketshare to make it a really viable platform for everyone just as MacOS and Windows are today.

I would like to get some of my bandwidth back though if anyone at redmond is listening.. 😉

2003-09-25 4:21 pm

Anonymous
got “blasted” on 2 pc’s one xp and the other win 2000. I must be special

2003-09-25 4:22 pm

Anonymous
I did not read that report but i find the OS monoculture issue to be quite concerning from a security point of view.

Its a simple matter of probability. If everyone is linked to one OS (95%) then it is that much easier to infect everyone.

JLG had a statement on this that i thought was appropriate. He compared the OS to a biological organism and said that the chances of infection are much lower if you have a diverse gene set. He proposed a gene set consisting of beos, apple, linux, and MS.

Security is a serious issue and will be regardless of MS’ own precautions. The isue is really monoculture. That one issue is going to help linux and alternative os’ get a foothold in the market.

2003-09-25 4:54 pm

Anonymous
Isn’t it that you can download more than *700* pages of directions on how to secure Windows from the CIA or some other agency..? And it is not even complete !!!

2003-09-25 9:18 pm

Anonymous
I’ve read a lot of writing about the “whining” nature of the article in question. People arguing back and forth over the “unprofessional” nature of the report, the apparent “bias” of the researchers. Let’s ignore for a moment the name calling and childish prattle. The heart of the matter is this: Microsoft has coded and marketed itself into a security nightmare. Let’s look at the facts.

1) By my own informal poll, I’d say at LEAST 8 out of every 10 people I asked that owned a Microsoft based computer did NOT understand that regular updates are necesary, let alone what “Windows Update” really does. Of that number there were several that were still using Windows 98 and were unaware that Microsoft has discontinued support thereof.

2) According to one study at least half of the security breaches at US government institutions are the result of a Microsoft vulnerability.

3) Microsoft often only patches known vulnerabilities after a proven attack has been carried out. In some cases a patch is released only after a widespread attack has occured.

4) Microsoft security patches often break other softwares which inhibits the acceptance of new patches in uptime critical computer systems.

5) Microsoft patches have been known in themselves to create new vulnerabilities or not actually fix the real axis of the attack.

6) The vast majority of viruses, trojans, and worms exploit known weaknesses in Microsoft products that Microsoft refuses to “tighten up” because they are “useability features”. Case in point, but by no means limited to: one click execution of binaries, the hiding of file extentions, and universal granting of execution permissions by default on certain file extentions.

7) Microsoft does not try to educate it’s users as to the proper use of it’s tools. Windows comes with no real documentation, no training, and the expectation that icons are self-explanatory. Social engineering is currently the most effective method of delivering mal-ware both of a more benign nature in the form of standard spyware like Gator, and in the form of more carcenogenic malware like the current “Worm.Automat.AHB” that masquerades as MTA error messages and e’mailed updates ostensibly from Microsoft.

8) Microsoft’s year long security push resulted in an OS (Server 2003) that was released with vulnerabilities (the Etherleak vuln for example) that were discovered and reported months before Server 2003’s release.

9) Microsoft routinely spys on it’s customers through various functionalities with IE, Windows Media Player, and other applications.

10) MIcrosoft is on court record stating that Microsoft code bases would be a national security threat if released to 3rd parties and foreign governments.

I can list more facts on Microsoft security problems, but I believe my point has been made.

2003-09-25 9:51 pm

Anonymous
The first thing I did was run Windows Update. It took over 3 hours with numerous restarts and repetition. That’s at a transfer rate of over 100K.

Replace “numerous” with two and I’ll begin to believe you. The only update that requires a separate reboot is SP1. Conversely, if you attempt to apply the IE service packs/updates on a Windows 2000 system, these will also require a separate reboot.

3 hours is ludicrous. On what I would consider a typical midrange system (800MHz PIII w 128MB RAM) installing both SP1 and the remaining security/recommended patches takes approximately a half hour.

Are you trying to use XP on a system with less than 128MB RAM? That would be an acceptable explanation. I’m growing increasingly tired of the hyperbole I’m hearing around here though…

2003-09-25 10:57 pm

Anonymous
The only two ways I can understand the Homeland Security Department decision to choose Microsoft are :

a) the bureaucrats who were consulted on that issue were chimps taught how to sign a report;

b) it was meant to thank Microsoft for the contributions they made to G. W. Bush and his cronnies.

No matter how we look at it, the whole deal stinks. Now, the US have officially become a banana republic. It stresses out the idea that the Department itself is a joke : it’s an insult to security consultants and to the other law enforcement agencies that have been in place for decades.

2003-09-26 12:24 am

Anonymous
To me it seems that Homeland Security is not too concern with security by signing that contract with Microsoft to provide the operating system for their computers. I don’t trust my personal data on any Windows computer that is connected to the internet, neither should they.

I believe the main reason that the Homeland Security Department signed the deal with Microsoft is because they were too lazy to research the different alternatives to Windows. In the very least they could have used Linux to get a cheaper deal out of Microsoft.

2003-09-26 3:40 am

Anonymous
“I can list more facts on Microsoft security problems, but I believe my point has been made.”

Informal polls and unamed studies don’t make facts. So no real point has been made.

2003-09-26 8:13 am

Anonymous
Chewy509

However it is possible to get a windows box secure, it just takes some effort, which the above report seems to forget about… As for patches… may I say “OpenSSH”.

As for OpenSSH… may I say “nice straw man”. The OpenSSH vulnerability is one of a handful of non-MS security issues that are recogniseable by name in the media — mainly because of MS shills bleating about it. The fact that the OpenSSH vulnerability is so memorable speaks for itself. [1] [2]

Anonymous (IP: —.netcom.no)

When he clicked on “Mandrake Update”, and saw a HUGE list of Security Updates there (>200 Mb), I had some problem convincing him not to boot back to XP…especially when the update crashed straight away (well, actually after downloading all the patches, 2 hours later) due to “dependency hell”.

You’re a good man, helping a friend get acquainted with Linux. You should remember that while Windows patches only apply to the OS itself, all-inclusive Linux distros tend to patch their entire installation, so it’s not a direct comparison. I don’t use desktop Linux yet, as I don’t personally feel that it’s quite there, but there have to be trailblazers like you to get it there

Kick the Donkey

Why is it the anti-OSS crowd always plays the commi-card? Was that really called for? Or relavent?

What I find amusing is that Americans [3] actually think it’s insulting to anyone outside their borders (or outside the 20th century for that matter). Up here in Canada, we have an official Canadian Communist Party in many provinces, and a Marxist-Leninist party at the federal level. Would uber-capitalists be insulted if we called their system “electoral collegiate”?

Chris

Windows operating systems will always have the most security problems because it has the largest market share.

Partly. The fact that they’re closed-source certainly doesn’t help:

http://www.techextreme.com/perl/story/22319.html

http://lwn.net/Articles/22623/

I believe it to be in Linux’s best interest not to try to “kill Windows.” If that would happen Linux would become almost like Windows.

Doubtful. The more eyeballs land on Linux[4] code, the more secure it gets. Now, this is compensated by the fact that it becomes a bigger target.

Conversely, the opposite is true with Windows: instead of their development philosophy compensating for a larger market, it multiplies the dangers — the larger the market, the more incentive to pack it with features and still deliver on time, which steals resources from other aspects of software development such as security analysis.

ILBT,

Good grief

————————-

[1] Here’s a hint — it’s memorable because it’s so bloody rare! Since when is it bad for an application and/or development methodology to rarely have security issues?

[2] I won’t even get into the ridiculous comparison between a hard-to-exploit vulnerability in a network service that has to be actively hunted down and attacked by a knowledgeable hacker, and a worm that automatically infects you within minutes of being connected to the internet. [5]

[3] It’s almost always American businessmen who use this tired analogy. And if it’s said by a non-American, that makes it even stupider.

[4] ..by which I assume you mean GNU/Linux..

[5] ..despite which, it was still taken far more seriously by the OpenBSD team than MS has ever taken ANY of their own vulnerabilities. The patch was available within days of the exploit discovery, not weeks or months. And it didn’t break previous security patches.

2003-09-26 11:34 am

Anonymous
got fired after he made these statements. Readed in the Dutch news (webwereld.nl)

As for the person in the US army , i advise you to not post with that hostname, since it only makes your army looking more moronic

2003-09-26 11:55 am

Anonymous
“Informal polls and unamed studies don’t make facts. So no real point has been made.”

The mood on the street, the average person’s opinion, when taken formally or informally is a fact, even though it’s a fact about an opinion. It’s *fact* that most people that use a Microsoft computer do NOT know how to use it safely. I would expect you to be able to do a search for polls. Aberdeen, Gartner, Sans, and many other post their findings on a regular basis. If there is even ONE person out there on the Internet that doesn’t know to upgrade his computer, he or she is a threat to everyone else’s security. But the *fact* is, there are millions out there that are unaware of proper computer use and security issues. Take a “formal” poll if you wish, but all you really have to do is ask random people that you meet in a certain time period 1) do they own a computer, 2) is it a Microsoft Windows product, 3) when was the last time you used “Windows Update”, 4) are you aware of how “Windows Update” works

That is a correct statistical poll, you can call it formal or informal, the symantics doesn’t matter. It’s identical to the methodologies of the “formal” scientific pollsters. You can take or leave poll information. The rest of the points are valid and easily verifiable by scanning Security Focus archives, CERT archives, and Microsoft’s own bug report databases and advisories.

2003-09-26 5:24 pm

Anonymous
Well i am not in the US ARMY i haven’t been for 10 years. So i do my part as a civilian. Thanks for the info on the java station! About your other comments All i will say is that I myself and millions of other people around the world have jobs because of Microsoft. This includes alot of the Open source jobs!(PC hardware developed primarily for Microsoft OSes). This is capitalism at its greatest… this is the big business that according to the tired old liberal saying George Bush is in bed with. OK! Who else will employ great masses of people? Small businesses? Did all you learn in college was to spout the old tedious liberal sayings? ever try to apply some logic to modern issues?

P.S. its the other way around the Democrats screw things up Republicans fix it problem is that once its fixed the democrats are in office and are more than happy to take crdit for it.

2003-09-26 6:02 pm

Anonymous
Homeland “Security” is going to use windows!!