EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

05.15.11

Negligence at Microsoft, Not ‘Market Share’, Causes Major Technical Problems

Posted in Deception, Microsoft, Security, Windows at 11:51 am by Dr. Roy Schestowitz

Not a victim of “success”

Swing

Summary: Microsoft’s vanity about market share is being used as a distractor in face of allegations that its software is inherently shoddy

THE MONOPOLIST (poor Microsoft) loves blaming its illegally-earned market share on the desktop for security problems, but as we explained yesterday, this is a nonsensical argument and it is negligence [1, 2, 3] — not installed base — which makes software vulnerable. Vista 7 is not secure and even Microsoft’s fanbase is willing to admit this. And in Windows, the “latest hole will soon be patched after a decade of vulnerability,” says a blogger. It is not the first such example of belated patching. If Microsoft’s installed base is the reason exploitable errors can be found, why has it taken a decade? The matter of fact is, less auditing of code lowers the quality of the code. Developers can get away with terrible programming practices and security is assumed to be assured by secrecy, not peer review that requires full transparency. This explains not only why Microsoft software is not secure but also why it is of such low quality (which makes the coders embarrassed to show it). As mentioned briefly in the daily links, Microsoft Fog Computing turns out to be as unreliable as its desktop-side software:

Customers on BPOS in the US and worldwide were kicked off their hosted Exchange email systems, being unable to read, write, or access their messages. All users were affected – from down in the cubicle farm all the way up to the CEO’s corner office. The outages started Tuesday and came after weeks of the service slowly degrading.

In conclusion, secret code is shoddy code. Free code is high-quality code. The more a stack uses components like Linux and Apache, the more solid it is likely to be. Every day I write software that will be freely shared; the visibility of the code comes with a burden — the burden that the code should actually be decent and well tested, not “spaghetti” as Vista’s codebase was once referred to as.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

2 Comments

  1. Needs Sunlight said,

    May 16, 2011 at 2:51 am

    Gravatar

    Incompetence as much as negligence is likely to blame.

  2. TemporalBeing said,

    May 19, 2011 at 12:15 pm

    Gravatar

    Microsoft has several problems on the security front:

    1. They don’t have a very good patch management system, likely due to their source code management practices. The big problems result in one patch fixing an issue, and another unfixing it; this then goes round and round over years.

    2. Win32 by design is insecure and cannot be fixed. The basic interface for applications with the Windows API is a system that utilizes and object called a HANDLE. Applications are suppose to use the HANDLE to do something, and then clean it up when they’re done. However, there is not protection against one application getting a HANDLE for an object of another application. Furthermore, a HANDLE is merely a _pointer_ into one of several different tables (which one depends on the use of the HANDLE) inside kernel space, and by the way there is no method to authenticate the validity of a HANDLE – at least from the application layer.

    What this means is that Win32 by design allows other applications to put bugs into your application. here’s one very valid example:

    Your application creates a text box that is suppose to only be 256 characters long. You specify this on the creation of the text box. You properly use the text box to get the 256 characters.

    However, your friend BillB writes another application that accesses your text box and changes it to be 64536 bytes long, and inserts a lot of extra text into it to use up the entire space. Windows updates your text box to be the size BillB’s application said it is, but its YOUR text box, not BillB’s. Your application is now subject to a buffer overflow attack through no fault of your own. (Your application properly used the text box.)

    That is just one attack vector – and it applies to any use of a HANDLE to do something – whether it is a text box or a lock; yes, Locks use HANDLES – so BillB’s application could access one of your locks and cause your application to go into a Deadlock situation -or worse, unlock something at the wrong time. There are simply no protections and no method of protecting against those kinds of attacks – it’s the design of the Win32 API.

What Else is New


  1. Links 24/3/2019: Microsoft Does Not Change; Lots of FOSS Leftovers

    Links for the day



  2. Just Published: Irrational Ignorance at the Patent Office

    Iancu and his fellow Trump-appointed "swamp" at the USPTO are urged to consult academics rather than law firms in order to improve patent quality in the United States



  3. Microsoft Paid the Open Source Initiative. Now (a Year Later) Microsoft is in the Board of the Open Source Initiative.

    The progression of Microsoft entryism in FOSS-centric institutions (while buying key "assets" such as GitHub) isn't indicative of FOSS "winning" but of FOSS being infiltrated (to be undermined)



  4. Jim Zemlin's Linux Foundation Still Does Not Care About Linux Desktops

    We are saddened to see that the largest body associated with Linux (the kernel and more) is not really eager to see GNU/Linux success; it's mostly concerned about its bottom line (about $100,000,000 per annum)



  5. Links 23/3/2019: Falkon 3.1.0 and Tails 3.13.1

    Links for the day



  6. The Unified Patent Court is Dead, But Doubts Remain Over the EPO's Appeal Boards' Ability to Rule Independently Against Patents on Nature and Code

    Patents used to cover physical inventions (such as engines); nowadays this just isn't the case anymore and judges who can clarify these questions lack the freedom to think outside the box (and disobey patent maximalists' dogma)



  7. Patent Law Firms Still Desperate to Find New Ways to Resurrect Dead Software Patents in the United States

    There's no rebound and no profound changes that favour software patents; in fact, judging by caselaw, there's nothing even remotely like that



  8. Links 22/3/2019: Libinput 1.13 RC2 and Facebook's Latest Security Scandal

    Links for the day



  9. Why the UK Intellectual Property Office (UK-IPO) Cannot Ignore Judges, Whereas the EPO Can (and Does)

    The European Patent Convention (EPC) ceased to matter, judges' interpretation of it no longer matters either; the EPO exploits this to grant hundreds of thousands of dodgy software patents, then trumpet "growth"



  10. The European Patent Office Needs to Put Lives Before Profits

    Patents that pertain to health have always posed an ethical dilemma; the EPO apparently tackled this dilemma by altogether ignoring the rights and needs of patients (in favour of large corporations that benefit financially from poor people's mortality)



  11. “Criminal Organisation”

    Brazil's ex-President, Temer, is arrested (like other former presidents of Brazil); will the EPO's ex-President Battistelli ever be arrested (now that he lacks diplomatic immunity and hides at CEIPI)?



  12. Links 21/3/2019: Wayland 1.17.0, Samba 4.10.0, OpenShot 2.4.4 and Zorin Beta

    Links for the day



  13. Team UPC (Unitary Patent) is a Headless Chicken

    Team UPC's propaganda about the Unified Patent Court (UPC) has become so ridiculous that the pertinent firms do not wish to be identified



  14. António Campinos Makes Up Claims About Patent Quality, Only to be Rebutted by Examiners, Union (Anyone But the 'Puff Pieces' Industry)

    Battistelli's propagandistic style and self-serving 'studies' carry on; the notion of patent quality has been totally discarded and is nowadays lied about as facts get 'manufactured', then disseminated internally and externally



  15. Links 20/3/2019: Google Announces ‘Stadia’, Tails 3.13

    Links for the day



  16. CEN and CENELEC Agreement With the EPO Shows That It's Definitely the European Commission's 'Department'

    With headlines such as “EPO to collaborate on raising SEP awareness” it is clear to see that the Office lacks impartiality and the European Commission cannot pretend that the EPO is “dafür bin ich nicht zuständig” or “da kenne ich mich nicht aus”



  17. Decisions Made Inside the European Patent Organisation (EPO) Lack Credibility Because Examiners and Judges Lack Independence

    The lawless, merciless, Mafia-like culture left by Battistelli continues to haunt judges and examiners; how can one ever trust the Office (or the Organisation at large) to deliver true justice in adherence or compliance with the EPC?



  18. Team UPC Buries Its Credibility Deeper in the Grave

    The three Frenchmen at the top do not mention the UPC anymore; but those who promote it for a living (because they gambled on leveraging it for litigation galore) aren't giving up and in the process they perpetuate falsehoods



  19. The EPO Has Sadly Taken a Side and It's the Patent Trolls' Side

    Abandoning the whole rationale behind patents, the Office now led for almost a year by António Campinos prioritises neither science nor technology; it's all about granting as many patents (European monopolies) as possible for legal activity (applications, litigation and so on)



  20. Where the USPTO Stands on the Subject of Abstract Software Patents

    Not much is changing as we approach Easter and software patents are still fool's gold in the United States, no matter if they get granted or not



  21. Links 19/3/2019: Jetson/JetBot, Linux 5.0.3, Kodi Foundation Joins The Linux Foundation, and Firefox 66

    Links for the day



  22. Links 18/3/2019: Solus 4, Linux 5.1 RC1, Mesa 18.3.5, OSI Individual Member Election Won by Microsoft

    Links for the day



  23. Microsoft and Its Patent Trolls Continue Their Patent War, Including the War on Linux

    Microsoft is still preying on GNU/Linux using patents, notably software patents; it wants billions of dollars served on a silver platter in spite of claims that it reached a “truce” by joining the Open Invention Network and joining the LOT Network



  24. Director Iancu Generally Viewed as a Lapdog of Patent Trolls

    As Director of the Office, Mr. Iancu, a Trump appointee, not only fails to curb patent trolls; he actively defends them and he lowers barriers in order to better equip them with bogus patents that courts would reject (if the targets of extortion could afford a day in court)



  25. Links 17/3/2019: Google Console and IBM-Red Hat Merger Delay?

    Links for the day



  26. To Team UPC the Unified Patent Court (UPC) Has Become a Joke and the European Patent Office (EPO) Never Mentions It Anymore

    The EPO's frantic rally to the very bottom of patent quality may be celebrated by obedient media and patent law firms; to people who actually produce innovative things, however, this should be a worrisome trend and thankfully courts are getting in the way of this nefarious agenda; one of these courts is the FCC in Germany



  27. Links 16/3/2019: Knoppix Release and SUSE Independence

    Links for the day



  28. Stopping António Campinos and His Software Patents Agenda (Not Legal in Europe) Would Require Independent Courts

    Software patents continue to be granted (new tricks, loopholes and buzzwords) and judges who can put an end to that are being actively assaulted by those who aren't supposed to have any authority whatsoever over them (for decisions to be impartially delivered)



  29. The Linux Foundation Needs to Speak Out Against Microsoft's Ongoing (Continued) Patent Shakedown of OEMs That Ship Linux

    Zemlin actively thanks Microsoft while taking Microsoft money; he meanwhile ignores how Microsoft viciously attacks Linux using patents, revealing the degree to which his foundation, the “Linux Foundation” (not about Linux anymore, better described as Zemlin’s PAC), has been compromised



  30. Links 15/3/2019: Linux 5.0.2, Sublime Text 3.2

    Links for the day


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts