05.15.11

Gemini version available ♊︎

Negligence at Microsoft, Not ‘Market Share’, Causes Major Technical Problems

Posted in Deception, Microsoft, Security, Windows at 11:51 am by Dr. Roy Schestowitz

Not a victim of “success”

Swing

Summary: Microsoft’s vanity about market share is being used as a distractor in face of allegations that its software is inherently shoddy

THE MONOPOLIST (poor Microsoft) loves blaming its illegally-earned market share on the desktop for security problems, but as we explained yesterday, this is a nonsensical argument and it is negligence [1, 2, 3] — not installed base — which makes software vulnerable. Vista 7 is not secure and even Microsoft’s fanbase is willing to admit this. And in Windows, the “latest hole will soon be patched after a decade of vulnerability,” says a blogger. It is not the first such example of belated patching. If Microsoft’s installed base is the reason exploitable errors can be found, why has it taken a decade? The matter of fact is, less auditing of code lowers the quality of the code. Developers can get away with terrible programming practices and security is assumed to be assured by secrecy, not peer review that requires full transparency. This explains not only why Microsoft software is not secure but also why it is of such low quality (which makes the coders embarrassed to show it). As mentioned briefly in the daily links, Microsoft Fog Computing turns out to be as unreliable as its desktop-side software:

Customers on BPOS in the US and worldwide were kicked off their hosted Exchange email systems, being unable to read, write, or access their messages. All users were affected – from down in the cubicle farm all the way up to the CEO’s corner office. The outages started Tuesday and came after weeks of the service slowly degrading.

In conclusion, secret code is shoddy code. Free code is high-quality code. The more a stack uses components like Linux and Apache, the more solid it is likely to be. Every day I write software that will be freely shared; the visibility of the code comes with a burden — the burden that the code should actually be decent and well tested, not “spaghetti” as Vista’s codebase was once referred to as.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

2 Comments

  1. Needs Sunlight said,

    May 16, 2011 at 2:51 am

    Gravatar

    Incompetence as much as negligence is likely to blame.

  2. TemporalBeing said,

    May 19, 2011 at 12:15 pm

    Gravatar

    Microsoft has several problems on the security front:

    1. They don’t have a very good patch management system, likely due to their source code management practices. The big problems result in one patch fixing an issue, and another unfixing it; this then goes round and round over years.

    2. Win32 by design is insecure and cannot be fixed. The basic interface for applications with the Windows API is a system that utilizes and object called a HANDLE. Applications are suppose to use the HANDLE to do something, and then clean it up when they’re done. However, there is not protection against one application getting a HANDLE for an object of another application. Furthermore, a HANDLE is merely a _pointer_ into one of several different tables (which one depends on the use of the HANDLE) inside kernel space, and by the way there is no method to authenticate the validity of a HANDLE – at least from the application layer.

    What this means is that Win32 by design allows other applications to put bugs into your application. here’s one very valid example:

    Your application creates a text box that is suppose to only be 256 characters long. You specify this on the creation of the text box. You properly use the text box to get the 256 characters.

    However, your friend BillB writes another application that accesses your text box and changes it to be 64536 bytes long, and inserts a lot of extra text into it to use up the entire space. Windows updates your text box to be the size BillB’s application said it is, but its YOUR text box, not BillB’s. Your application is now subject to a buffer overflow attack through no fault of your own. (Your application properly used the text box.)

    That is just one attack vector – and it applies to any use of a HANDLE to do something – whether it is a text box or a lock; yes, Locks use HANDLES – so BillB’s application could access one of your locks and cause your application to go into a Deadlock situation -or worse, unlock something at the wrong time. There are simply no protections and no method of protecting against those kinds of attacks – it’s the design of the Win32 API.

DecorWhat Else is New


  1. Centralised Git Hosting Has a Business Model Which is Hostile Towards Developers' Interests (in Microsoft's Case, It's an Attack on Reciprocal Licensing and Persistent Manipulation)

    Spying, censoring, and abusing projects/developers/users are among the perks Microsoft found in GitHub; the E.E.E.-styled takeover is being misused for perception manipulation and even racism, so projects really need to take control of their hosting (outsourcing is risky and very expensive in the long run)



  2. Links 29/11/2021: FWUPD's 'Best Known Configuration' and Glimpse at OpenZFS 3.0

    Links for the day



  3. President Biden Wants to Put Microsofter in Charge of the Patent Office, Soon to Penalise Patent Applicants Who Don't Use Microsoft's Proprietary Formats

    The tradition of GAFAM or GIAFAM inside the USPTO carries on (e.g. Kappos and Lee; Kappos lobbies for Microsoft and IBM, whereas Lee now works for Amazon/Bezos after a career at Google); it's hard to believe anymore that the USPTO exists to serve innovators rather than aggressive monopolists, shielding their territory by patent threats (lawsuits or worse aggression) and cross-licensing that's akin to a cartel



  4. Microsoft GitHub Exposé — Part VIII — Mr. Graveley's Long Career Serving Microsoft's Agenda (Before Hiring by Microsoft to Work on GitHub's GPL Violations Machine)

    Balabhadra (Alex) Graveley was promoting .NET (or Mono) since his young days; his current job at Microsoft is consistent with past harms to GNU/Linux, basically pushing undesirable (except to Microsoft) things to GNU/Linux users; Tomboy used to be the main reason for distro ISOs to include Mono



  5. Dr. Andy Farnell on Teaching Cybersecurity in an Age of 'Fake Security'

    By Dr. Andy Farnell



  6. IRC Proceedings: Sunday, November 28, 2021

    IRC logs for Sunday, November 28, 2021



  7. Links 29/11/2021: Linux 5.16 RC3 and Lots of Patent Catch-up

    Links for the day



  8. By 2022 0% of 'News' Coverage About Patents Will Be Actual Journalism (Patent Litigation Sector Has Hijacked the World Wide Web to Disseminate Self-Promotional Misinformation)

    Finding news about the EPO is almost impossible because today’s so-called ‘news’ sites are in the pockets of Benoît Battistelli, António Campinos, and their cohorts who turned the EPO into a hub of litigation, not science; this is part of an international (worldwide) problem because financial resources for journalism have run out, and so the vacuum is filled/replaced almost entirely by Public Relations (PR) and marketing



  9. Trying to Appease Those Who Never Liked Free Software or Those Who Blindly Loved All Patent Monopolies to Begin With

    It’s crystal clear that trying to appease everyone, all the time, is impossible; in the case of the EPO, for example, we hope that exposing Team Battistelli/Campinos helps raise awareness of the harms of patent maximalism, and when speaking about Free software — whilst occasionally bashing the alternatives (proprietary) — we hope to convince more people to join the “Good Fight”



  10. Links 28/11/2021: Laravel 8.73 Released, GitHub Offline for Hours

    Links for the day



  11. IRC Proceedings: Saturday, November 27, 2021

    IRC logs for Saturday, November 27, 2021



  12. Links 27/11/2021: Nvidia’s DLSS Hype and Why GNU/Linux Matters

    Links for the day



  13. [Meme] Linus Gabriel Sebastian Takes GNU/Linux for a (Tail)'Spin'

    If you’re trying to prove that GNU/Linux is NOT Windows, then “haha! Well done…”



  14. GNU/Linux is for Freedom and It'll Gain Many Users When (or Where) People Understand What Software (or Computing) Freedom Means

    Software that respects people's freedom (and by extension privacy as well) is an alluring proposition; those who choose to try GNU/Linux for the wrong reasons are likely the wrong target audience for advocates



  15. Amid Reports of Microsoft's Competition Crimes in Europe...

    European companies are complaining, but they seem to overlook the principal aspect of an imperialistic system with bottomless pockets (almost 30 trillion dollars in debt already; US national debt soared again last month); Microsoft is shielded by a political system with military (“defence”) as bailout budget to help cushion international expansion for data grab and technical leverage, as we've seen in the case of EPO (this is all political, not technical, and should thus be treated as a political/corruption issue)



  16. Is Linus Trolling the GNU/Linux Community?

    This new video responds to what many sites have been provoked into amplifying



  17. Links 27/11/2021: Tux Paint 0.9.27 and SeaMonkey 1.1.19 in EasyOS

    Links for the day



  18. [Meme] Keeping Our Distance From Microsoft

    The OSI is the dagger, the Linux Foundation is the knife, and many others are the sword by which Microsoft tries to get into the very heart of GNU/Linux and extinguish the Free software movement



  19. Microsoft Edge Encourages Indebted Americans to Guilt-spend Just in Time for Christmas

    Guest post by Ryan, reprinted with permission



  20. IRC Proceedings: Friday, November 26, 2021

    IRC logs for Friday, November 26, 2021



  21. 38+ Years of GNU and 19+ Years of FSF Associate Membership

    “On November 25, 2002,” Wikipedia notes, “the FSF launched the FSF Associate Membership program for individuals.” As the above video points out, it all started almost 40 years ago.



  22. Gemini as a Platform for Gamers

    Contrary to what people often assume (or are led to assume), even without client-side scripting Gemini can accomplish a great deal; early adopters, many of whom are technical, test the limits of the very minimalistic (by design and intention) specification



  23. Improved Workflows: Achievement Unlocked

    Today we've completed a bunch of small projects that can make us more efficient (e.g. more Daily Links per day, more articles); the above video was recorded many hours ago to accompany the outline below



  24. Links 26/11/2021: New Complaint About Microsoft Competition Crimes in Europe, EuroLinux 8.5, GhostBSD 21.11.24, and Kiwi TCMS 10.5 Released

    Links for the day



  25. Links 26/11/2021: F35 Elections, Whonix 16.0.3.7, OSMC's November Refresh With Kodi 19.3

    Links for the day



  26. IRC Proceedings: Thursday, November 25, 2021

    IRC logs for Thursday, November 25, 2021



  27. IRC Proceedings: Wednesday, November 24, 2021

    IRC logs for Wednesday, November 24, 2021



  28. Links 25/11/2021: PHP 8.1.0 Released and Linux 5.15.5

    Links for the day



  29. IBM as Master of Hypocrisy

    Free software projects and Free software developers have long been humiliated by corporations of Western misogynists, falsely claiming that the Free software community isn’t inclusive enough (these are shameless projection tactics; as a matter of public record, the exact opposite is true) and even the eradication of supposedly offensive language isn’t something IBM takes seriously



  30. Links 25/11/2021: LibreOffice 7.2.3 and Mesa 21.2.6 Released

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts