Bonum Certa Men Certa

Despite Security Lies and Security Failures, Microsoft Instructs Worldwide Cybersecurity Summit

Protect your money
Billions or trillions of dollars are lost or saved based on one's security



Summary: Microsoft is telling lies about the number of flaws in its software, it admits failing to secure its software (statistics indicate exacerbation), and yet, Scott 'Windows zombie tax' Charney gets to tell participants of the Worldwide Cybersecurity Summit what to do next

IN OUR most recent post about Windows insecurity news we showed that nothing is improving at Microsoft when it comes to security. It's only the messages (engagements with the public) that seemingly change. Last week we wrote about Microsoft pretending that it supports standards, which is an utter lie only PR can buy. Here is part of the PR where Microsoft joins Apple [1, 2, 3, 4, 5] in its attack on Flash, not just its attack on Theora, which we covered in:





Microsoft -- like Apple -- is being denounced for the hypocrite that it is:

MS criticises Adobe over security and performance. Physician, heal thyself!


Let's not forget that Microsoft does exactly the same thing as Adobe (only with limited platform support) whenever it markets Silver Lie. Microsoft went further than that when .NET toys got secretly injected into Firefox without permission, thus creating security and performance issues without users' consent.

Microsoft is also being somewhat hypocritical when it makes some statements as covered in the article "Adapt or die, Microsoft warns business".

Microsoft has failed to adapt to a connected world and a world of computing mobility. Now it has debt to repay.

Addressing the subject of security, Microsoft spreads lies with its secret patches, which probably mean that there are fake figures in this latest 'security' report where Microsoft is conveniently blaming "ISVs" for security problems in Windows. The 'Microsoft press' plays along with this talking point and other publications are trying to make it an excuse for expensive Microsoft "upgrades", which Microsoft urges/advocates using withdrawal of support. How ruthless and deceiving. Here is an example of Microsoft's tactics:

The bottom line comes down to this: if your company plans to stay with XP well into 2011 and you're still using IE6, you've got to upgrade that browser. Knowing that IE9 won't support XP, you can safely move to IE8 knowing it's the end of the line for IE on XP. Or, you can move to Firefox, Chrome, Safari, or Opera -- but a company that's still stuck on IE6 isn't likely to be that adventurous. The web developers of the world will be happy with anything that gets you off IE6.


It is a "bait and switch" manoeuvre in a sense. Microsoft did the same thing to Windows 2000 users some years ago, for no practical reasons except the profit motive.

Going back to the hidden patches scam, can anyone believe that Microsoft is patching with just two "critical" bulletins? For several years Microsoft has been hiding its flaws and patching them silently for vanity purposes.

Microsoft on Tuesday will issue two critical bulletins that will fix vulnerabilities in Windows and Office, which if exploited successfully, could allow a remote attacker to take control of the computer, the company said Thursday.


There were also some broken patches which needed to be re-released.

Let's consider this news in light of last week's reports, such as:



The allegations are so serious that Microsoft could not afford to keep quiet without a carefully-crafted piece of spin. Here are the latest excuses from Microsoft (it's the psychology of lying without technically lying):

Note that a policy such as this implies that Microsoft will not patch known, internally-discovered vulnerabilities if an externally-sourced vulnerability of the same or lesser severity is not available for the silent patch to piggyback on. They'll sit on it, and we won't know for how long because they don't document it.


Utter spin. Groklaw has just found this new article which nicely explains Microsoft's lies in this case:

#3 Tell the truth, misleadingly. The hardest lies to catch are those which aren't actually lies. You're telling the truth, but in a way that leaves a false impression. Technically, it's only a prevarication - about half a sin. A 1990 study of pathological liars in New York City found that those who could avoid follow-up questions were significantly more successful at their deceptions.


Microsoft has also added a formal statement to The Register's article on the subject (silent patching) because it received a lot of attention. Apologists of Microsoft also left comments trying to defend what Microsoft did there. It means it's extremely damaging.

“Microsoft's security record continues to be poor simply because Microsoft does not handle security issues properly, having for example ignored known flaws for 5 months until a disaster came.”In other insecurity news, SharePoint 2007 has a 0-day vulnerability (meaning that it's already under attack). Microsoft has confirmed this [1, 2] and only issued a "workaround" rather than a solution [1, 2, 3]. As this one blogger puts it, there is "no SharePoint fix" and it says nothing about Microsoft's hiding of patches and flaws (clustering them is possible if one wants to crunch the numbers). How many flaws does Microsoft patch in SharePoint silently? In this case, Microsoft had no choice but to publicise it (someone beat Microsoft to it).

Microsoft's security record continues to be poor simply because Microsoft does not handle security issues properly, having for example ignored known flaws for 5 months until a disaster came [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]. That's just negligence [1, 2, 3].

As a result of such negligence, IDG reports that "Conficker found on 25% of enterprise Windows PCs," according to Microsoft.

Conficker was far and away the most prevalent threat found on Windows machines in the second half of 2009 in the enterprise, Microsoft says. The company's security tools cleaned the Conficker worm from one quarter of enterprise Windows machines.


"25% of enterprise Windows PCs" is a lot of computers. But then again, for several years now we have known that hundreds of millions of Windows zombies were out there waiting to be commandeered. Google says that fake antivirus software is 15 percent of all malware. That's what happens when Windows refuses to implement repositories like GNU/Linux does. GNU/Linux has had that for ages and it keeps it more bulletproof.

Going back to Microsoft's own figures, even Microsoft admits that it's getting worse for Windows in practical terms:

Microsoft Sees Infected PC Numbers Climbing



[...]

The numbers of PCs cleaned by Microsoft's anti-malware software worldwide during the second half of 2009 continued to trend upward, suggesting that more PCs are getting infected in total, according to the company's latest Security Intelligence Report (SIR).


More here.

It's interesting that even Microsoft admits that it's failing to tackle the problem it created (or helped create).

Microsoft's Charney, the former government (ish) person who wants charge Mac and GNU/Linux users for Microsoft to clean up its own mess [1, 2, 3, 4, 5, 6, 7] is now intervening in international affairs, based on this AP report:

"Lots of times, there's confusion in these treaty negotiations because of lack of clarity about which problems they're trying to solve," said Scott Charney, vice president of Microsoft Corp.'s Trustworthy Computing Group, before a speech at the Worldwide Cybersecurity Summit.

[...]

Charney, of Microsoft, believes cyber threats should be better differentiated. He proposes four categories: conventional computer crimes, military espionage, economic espionage and cyberwarfare. That approach, he argues, would make it easier to craft defenses and to discuss international solutions to each problem.


What is Microsoft doing in a Worldwide Cybersecurity Summit? And why does it tell the world how to address these issues that it itself helped create? Microsoft cannot even issue disclosures of its own flaws (because it lies pathologically), so why should anyone believe Charney and maybe implement his outrageous idea of taxing all computer/Internet users for damage caused by Windows botnets? Microsoft should be held liable for knowingly refusing to patch known flaws.

Comments

Recent Techrights' Posts

Will Brett Wilson LLP Handle Its Own Winding Up Petition or be Struck Off for Overt Abuse of Process?
Today we sue not only the first Microsofter
Ubuntu Becomes Microsoft GitHub, Based on Decision Made by British Army Officer
You're hopeless, Canonical
Sharing Code and Recipes
It helps explain the triviality of software freedom
How Many Women Has Microsoft's Alex Balabhadra Graveley Already Strangled and Where Does That End?
If you too are a victim of this man and wish to share information, contact us
"We Might Save Somebody's Life"
I follow the example of my father
Gemini Links 16/07/2025: Tmux and OCC25 Working TLS
Links for the day
 
Brett Wilson LLP Has Track Record in Scam Coin Cases (e.g. Craig Wright and More), Now It Works for 'Crypto' Scam Purveyors
But wait, it gets worse
Exclusive: corruption in Tribunals, Greffiers, from protection rackets to cat whisperers
Reprinted with permission from Daniel Pocock
Under the Guise of "MIT Technology Review Insights" the Site MIT Technology Review Posts Corporate Spam as 'Articles'
Some of the articles aren't even articles but 'hit pieces' against Free software and some are paid advertisements
Links 16/07/2025: Chip Bans and Microsoft’s “Digital Escort” Program
Links for the day
Revolving Doors: One Day You're a Judge, the Next Day You're an Attorney Paying Public Officials and Working for Violent and Dangerous Microsoft Employees
how the US justice system works
Slopwatch: Noise, Plagiarism and Even Fear, Uncertainty, Doubt/Fear-mongering/Dramatisation
What are we meant to do to prevent a false association or misleading connotations? Game the LLMs? No. Boycott slopfarms.
Gemini Links 16/07/2025: BaseLibre Numerical System and Simple Web Browsing with TLS
Links for the day
Links 16/07/2025: Fascist Slop Takes "Intelligence" Clothing, New Criminal Case Against MElon
Links for the day
Why I am Suing the Serial Strangler From Microsoft, Alex Balabhadra Graveley, in the UK High Court This Week
Out of respect to the process and to the Court, I shall not share any pertinent details about the case
Links 16/07/2025: China’s Economy Grows Steadily, France Takes Action Regarding Harm to Children by GAFAM and Fentanylware (TikTok)
Links for the day
It is Not About Politics
Beware the people who try to make this about politics
Good Journalism Saves Lives
a shocking number of women die or get seriously hurt every day due to violence from a partner
Recognition of Women's Contributions to Free Software
Being passive is not an option when bad things are happening
Slopfarms Are Going to Perish Because Public Opinion is Changing
Many slopfarms will simply go offline
19 Years of Standing Up for Justice, Equality, and Truth
This week we shall take it up a notch
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 15, 2025
IRC logs for Tuesday, July 15, 2025
Links 15/07/2025: LLM Pollution and Pushback in Ukraine
Links for the day
Gemini Links 15/07/2025: xkcd, New Cert, and Alhena Gemlog
Links for the day
Links 15/07/2025: Press Freedom at Risk and New Facebook Blunders
Links for the day
Reboots Should Never be Necessary
"BUT WHAT ABOUT SECURITY!!"
There's Still Hope for the World Wide Web
Let's hope that the trajectory of the Web won't be leading us to over-reliance on Google, nor will it reward worthless slopfarms
Gemini Links 15/07/2025: Smolweb and Alhena 5.1.7
Links for the day
The Danes Want GNU/Linux
David Heinemeier Hansson recently moved to GNU/Linux
Cory Doctorow Explains Why Software Freedom Matters, Whereas "Open Source" Misses the Point and Helps Monopolies
It's a very long article
BillPR (EpsteinGate-Bribed NPR) is Turning Into a Partial Slopfarm that Promotes Slop
"I went on a date with a chatbot!"
Two Weeks Passed Since Latest Large Wave of Microsoft Layoffs, More Expected Next Month
Blaming the debt on "AI" is just self-serving storytelling
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 14, 2025
IRC logs for Monday, July 14, 2025
Gemini Links 15/07/2025: Gemini "Style Sheets" and Switching From Microsoft GitHub to Codeberg
Links for the day
Coming Soon: Another OSI Scandal, This One Implicating Molly de Blanc
OSI has been fairly quiet lately
Outreachy & Debian pregnancy cluster, Meike Reichle evidence
Reprinted with permission from Daniel Pocock
Again, "Lunduke is Actually Sending His Audience to Attack People"
Microsoft Lunduke is not trying to "protect" Linux
XBox is Rapidly Turned Into a Slopfarm by Microsoft
Slop isn't about efficiency and saving money
One of the Most Hilarious Things About the Microsoft SLAPPs
It's so ridiculous
Financial Support for the Free Software Foundation or the GNU Project
The FSF has extended until Friday its fund-raising campaign
Illegally Hiding (or Demanding Secrecy Around) Illegal Requests or Attempts at Extortion
unlawful communications like threats
Microsoft's Halloween Documents and systemd, Wayland, Etc.
Maybe one day Wayland will be widespread. Or maybe not.
Gemini Links 14/07/2025: BOFH Archive, Updating Old Palm PDAS, and Nginx vs Slop Bots
Links for the day
Ubuntu is Becoming GAFAM-Like
What does that say about Canonical and Ubuntu?
Slopfarms Which Take Real Articles About GNU/Linux and Turn Them Into Copycats Which Are False
Even before the LLM hype those were quite common
The Firm That Picks on Techrights is Accustomed to Working With Criminals
Techrights never did anything illegal. So why is it being picked on by people who work with criminals?
Microsoft Said the Mass Layoffs Were for "Investment" in "AI", But It's Also Laying Off the "AI" and "Copilot" Staff
Months ago we showed many so-called "AI" people were getting the boot and this time it's the same
DryDeadFish is Dead, Long Live DryDeadFish
We kept checking, hoping it can recover from some temporary technical issue
For Quite Some Time Already Microsoft Attracts Crackpots, Scams, and More
Occasionally we talk about the situation at IBM as there are many parallels
Links 14/07/2025: Chatbots Broken Again, McHire LLM Shows Limits of the Hype
Links for the day
Changing One's Name Won't Change One's Past
People who have earned a bad reputation are not magically "entitled" to reset
People Who Assault Women Are Not Victims of "Distress"
It seems like an American tradition. In a country with almost 50 presidents, not even one was a female.
Slashdot Media Turned Linux Journal Into a Slopfarm and Now Slashdot Actively Promotes Anti-Linux Slopfarms
Yes, "no-nonsense" apparently means actual nonsense
Adoption of Gemini Protocol Still Growing
Gemini Protocol is being obscured by the media - it doesn't help that Google 'hijacked' the word "Gemini" - but people still manage to find out about it, download a client, and use it
Links 14/07/2025: Arresting Photographers, Threats to Revoke US Citizenship Over Criticism
Links for the day
More EPO Leaks on the Way
We hope that Mr. Rowan will actually try to refute what we say and show, not merely point the finger at the messengers
Decommodification is a Corporate Strategy Against Communities
systemd is led by Microsoft and hosted by Microsoft
copyleft.org 'Hijacked' by the People Who Attack the Person Who Created Copyleft
So far there's nothing "tasteless" in copyleft.org, but that can change at any time in the future
Asking People to Take Down Articles and Videos Only Makes These More Popular and "Viral"
If you do something bad, one of the worst things you can possibly do it try to silence those who speak about it
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 13, 2025
IRC logs for Sunday, July 13, 2025
Two-Thirds Towards FSF Goal, Richard Stallman to Give Talks in Europe
There are 67 left before reaching the target
Brett Wilson LLP "Takes it Personal" (Character Assassination, Not Professionalism). Everybody Can See That.
On behalf of violent men
Gemini Links 14/07/2025: Politicised Tech and "Leaving GitHub"
Links for the day