11.16.09
Microsoft Won’t Secure Firefox/Chrome Users, Shows More Negligence
Summary: ActiveX required by Microsoft’s OneCare; investigation into Vista 7 vulnerabilities a case of “too little, too late”
MICROSOFT pretends to have changed for the better. It pretends that it allows users of Windows to use Web browsers other than Internet Explorer, but the following post — artistically titled “Microsoft being a Onecare [Wanker]“ — suggests otherwise:
For starters, it uses an ActiveX control – Internet Explorer required in other words – that’s annoyingly hard to install. You get warnings galore from Windows 7′s UAC and IE about popups and do you really really really want to install something that has the potential to roger your system well and truly?
ActiveX was designed to restrict competition by supplanting Web standards. It ended up becoming one of the biggest security nightmares out there and Novell supports this.
Here is the new story of a man who has just been fired because of these practices from Microsoft:
Linux Contractor Fired for Using Firefox/Linux
[...]
The irony? The “compentency test” was a Security & Privacy test from the four letter credit card company that HAD to be taken on MS Windows with IE?
I’ll let you be the ones to point out the obvious…the fact that this large computer/server company with three letters in their name is reportedly a “friend to Linux”. I’ll let you talk about how a Linux Professional who uses Linux as their desktop environment was denied access to employment. Employment that was based on his knowledge of Linux. Yeah, the server side…but still…
Now let’s brag about how much ground Linux has made…
And a Linux Project Manager for said company asking the question:
“What’s this Foxfire thing?”
As a secondary item of news, some days ago we argued for Microsoft liability when it comes to the latest Vista 7 vulnerability. Microsoft deserves to be accused of negligence and the following article implies deception too.
Is Microsoft Overhyping Security In Windows 7?
[...]
Microsoft has been aggressively marketing the security improvements in Windows 7, but some security experts believe this strategy could leave the software giant open to some unpleasant repercussions.
Vista 7 has been breached before and to give some examples of insecurity, we have:
- Cybercrime Rises and Vista 7 is Already Open to Hijackers
- Vista 7: Broken Apart Before Arrival
- Department of Homeland Security ‘Poisoned’ by Microsoft; Vista 7 is Open to Hijackers Again
- Vista 7 Security “Cannot be Fixed. It’s a Design Problem.”
- Why Vista 7 Could be the Least Secure Operating System Ever
- Vista 7 Vulnerable to Latest “Critical” Flaws
- Vista 7 Seemingly Affected by Several More “Critical” Flaws This Month
- Reason #1 to Avoid Vista 7: Insecurity
- Vista 7 Left Hijackable Again (Almost a Monthly Recurrence)
- Vista 7 as Insecure as Predecessors, Shows Sophos
- Microsoft, Novell, SCO, and NASDAQ Delistings
Now there is the SMB flaw that Microsoft finally acknowledges.
Microsoft on Friday said it is working on a fix for a vulnerability in the Server Message Block file-sharing protocol in Windows 7 and Windows Server 2008 Release 2 that could be used to remotely crash a computer.
It really took them too long, having waited for attack code to appear before properly investigating. That’s negligence and it is irresponsible. Gregg Keizer writes:
The zero-day vulnerability was first reported by Canadian researcher Laurent Gaffie last Wednesday, when he revealed the bug and posted proof-of-concept attack code to the Full Disclosure security mailing list and his blog. According to Gaffie, exploiting the flaw crashes Windows 7 and Server 2008 R2 systems so thoroughly that the only recourse is to manually power off the computers.
Why has Microsoft waited so long before looking into the problem? Could it be that lack of security and increased fear help Microsoft sell more ‘solutions’ to those very same problems? As we showed some days ago, is clearly profiting from Conficker, for example. █
Needs Sunlight said,
November 16, 2009 at 11:17 am
A verdict of Negligence would assume a competency or willingness to fix the problem. Likely neither are present in any measurable quantity.
From the outside it looks more like a case of further anti-competitive behavior.