Comments

• Balrog

  2009-04-09 17:29:27

  > The U.S. electrical grid is not a corporation. As for Microsoft, please explain why > it says “our products just aren’t engineered for security.”
  
  Looks like InfoWorld broke the link. See http://web.archive.org/web/20080209124930/http://www.infoworld.com/articles/hn/xml/02/09/05/020905hnmssecure.html for the article.

• Charles Oliver

  2009-04-10 00:57:42

  Thanks for the link Balrog.
  
  One of the stand out quotes from that page was this:
  
  "Microsoft has also been employing new tools developed by Microsoft Research that are designed to detect errors in code during the development process, Valentine said."
  
  I remember reading (possibly on el reg) about MS big upping another bug hunting tool just recently. It seems they've had a lot of these. I wonder why they don't seem to help?

• Roy Schestowitz

  2009-04-10 01:11:43

  They tend to release prematurely; Apple does the same thing by the way. Even Wozniak ranted about it.

• Charles Oliver

  2009-04-10 02:21:57

  Kind of release early, release infrequently.

• Yggdrasil

  2009-04-09 16:39:01

  You stole my tag line, but what's worse, you misused it to smear Microsoft. "Security through obscurity" is generally only applicable to the operating system. It explains why Linux doesn't make a good target because there are so few installations from which to run malicious code. It is however entirely possible to code a program that would stay hidden on a Linux machine and send out Spam or do other nasty things without the user taking notice. NOTHING in the design of Unix or any of it's clones can prevent this from happening. It is also possible to set a program to run at boot without administrator privileges using some methods linked below this paragraph. This of course assumes there is not an inbound/outbound firewall in use on the machine and the user in question doesn't routinely inspect their own system to see which of 90+ processes running on a Linux system do not belong.
  
  http://www.geekzone.co.nz/foobar/6229
  
  The articles you link make a few things clear that you did not mention. Many of these bot net machines were infected by users who either opened email attachments or were using outdated software that had been patched sometimes years in advance. Even the security vulnerability in the US power grid software was made public in May of last year:
  
  http://www.coresecurity.com/content/wonderware
  
  You would expect us to believe that if Wonderware were to open source (there fore not obscure, but in awareness, not numbers) it's own software, then the operators of these power plants would have taken the time to read through the entire source code themselves and find the vulnerability long before it ever become a problem. You simply expect too much in a world where even when others take the time to find and make patches available, the end users sit on their backside. The only alternative would be to apply forced updates, but then your run into larger problems with people paranoid about their systems doing things they did not approve of. Computers security as as much a human problem as it is a software problem, but it's so much easier to simply blame one large "evil" corporation.

• Roy Schestowitz

  2009-04-09 17:15:26

  You stole my tag line, but what’s worse, you misused it to smear Microsoft.

  
  
  Not only Microsoft is mentioned here.
  
  

  “Security through obscurity” is generally only applicable to the operating system.

  
  
  I disagree. An operating system is a very large program or a combination of many.
  
  

  It explains why Linux doesn’t make a good target because there are so few installations from which to run malicious code.

  
  
  Really?
  
  “Forty percent of servers run Windows, 60 percent run Linux...”

  --Steve Ballmer (September 2008)

  
  
  

  It is however entirely possible to code a program that would stay hidden on a Linux machine and send out Spam or do other nasty things without the user taking notice. NOTHING in the design of Unix or any of it’s clones can prevent this from happening. It is also possible to set a program to run at boot without administrator privileges using some methods linked below this paragraph. This of course assumes there is not an inbound/outbound firewall in use on the machine and the user in question doesn’t routinely inspect their own system to see which of 90+ processes running on a Linux system do not belong.
  
  http://www.geekzone.co.nz/foobar/6229

  
  
  There were rebuttals to it. With secure Linux installations there are also sandboxes and it's hard to compromise entire machines.
  
  

  The articles you link make a few things clear that you did not mention. Many of these bot net machines were infected by users who either opened email attachments or were using outdated software that had been patched sometimes years in advance.

  
  
  What about PowerPoint users right now (still unpatchable)? Or many unpatched flaws that required no user intervention? Where are attachments dispatched from in the first place? Windows botnets maybe?
  
  

  Even the security vulnerability in the US power grid software was made public in May of last year:
  
  http://www.coresecurity.com/content/wonderware

  
  
  Yes, already noted in my post.
  
  

  You would expect us to believe that if Wonderware were to open source (there fore not obscure, but in awareness, not numbers) it’s own software, then the operators of these power plants would have taken the time to read through the entire source code themselves and find the vulnerability long before it ever become a problem.

  
  
  This misses the core of the argument. Non-free software procrastinates fixes due to lack of a sense of urgency. The code is not visible.
  
  

  You simply expect too much in a world where even when others take the time to find and make patches available, the end users sit on their backside. The only alternative would be to apply forced updates, but then your run into larger problems with people paranoid about their systems doing things they did not approve of. Computers security as as much a human problem as it is a software problem, but it’s so much easier to simply blame one large “evil” corporation.

  
  
  The U.S. electrical grid is not a corporation. As for Microsoft, please explain why it says "our products just aren't engineered for security."
  
  Court exhibits show that this was never designed to be secure.

• Yggdrasil

  2009-04-11 08:08:00

  Again, you don't look at the full picture, on purpose. 60 percent of servers run Linux? For that sake of argument, let's assume that number is accurate. OK, great..... but as I've had to explain to you before, that's a SMALL percentage of the TOTAL NUMBER of machines in use around the world. Servers normally don't have people sitting in front of them shopping on eBay or playing Half-Life. The security issues that face servers are different than those that face home users. Can you grasp that? Can you get a handle on the numbers? As I stated:
  
  "Linux doesn’t make a good target because there are so few installations from which to run malicious code."
  
  Is it accurate for me to say "so few"? Yes, Roy, because "60% of servers" is only impressive until you realize that servers make up a small percentage of ALL computers. Users outnumber servers, plain and simple. As unpleasant as it may be for you, the fact is that Linux is not a good target for botnets or malware because there are so few targets to choose from. There are security issues in Linux that will never need to be addressed because it will not achieve a majority market share.
  
  By the way, the last 2 links in your reply are broken. I'm sure you have a catalog of every anti-Microsoft article in existence, but it might be update it and get some fresh material. The quote you reference is from a 2002 article that referenced Windows 2000, but lacked any real technical specifics.