05.15.11

Gemini version available ♊︎

Negligence at Microsoft, Not ‘Market Share’, Causes Major Technical Problems

Posted in Deception, Microsoft, Security, Windows at 11:51 am by Dr. Roy Schestowitz

Not a victim of “success”

Swing

Summary: Microsoft’s vanity about market share is being used as a distractor in face of allegations that its software is inherently shoddy

THE MONOPOLIST (poor Microsoft) loves blaming its illegally-earned market share on the desktop for security problems, but as we explained yesterday, this is a nonsensical argument and it is negligence [1, 2, 3] — not installed base — which makes software vulnerable. Vista 7 is not secure and even Microsoft’s fanbase is willing to admit this. And in Windows, the “latest hole will soon be patched after a decade of vulnerability,” says a blogger. It is not the first such example of belated patching. If Microsoft’s installed base is the reason exploitable errors can be found, why has it taken a decade? The matter of fact is, less auditing of code lowers the quality of the code. Developers can get away with terrible programming practices and security is assumed to be assured by secrecy, not peer review that requires full transparency. This explains not only why Microsoft software is not secure but also why it is of such low quality (which makes the coders embarrassed to show it). As mentioned briefly in the daily links, Microsoft Fog Computing turns out to be as unreliable as its desktop-side software:

Customers on BPOS in the US and worldwide were kicked off their hosted Exchange email systems, being unable to read, write, or access their messages. All users were affected – from down in the cubicle farm all the way up to the CEO’s corner office. The outages started Tuesday and came after weeks of the service slowly degrading.

In conclusion, secret code is shoddy code. Free code is high-quality code. The more a stack uses components like Linux and Apache, the more solid it is likely to be. Every day I write software that will be freely shared; the visibility of the code comes with a burden — the burden that the code should actually be decent and well tested, not “spaghetti” as Vista’s codebase was once referred to as.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

2 Comments

  1. Needs Sunlight said,

    May 16, 2011 at 2:51 am

    Gravatar

    Incompetence as much as negligence is likely to blame.

  2. TemporalBeing said,

    May 19, 2011 at 12:15 pm

    Gravatar

    Microsoft has several problems on the security front:

    1. They don’t have a very good patch management system, likely due to their source code management practices. The big problems result in one patch fixing an issue, and another unfixing it; this then goes round and round over years.

    2. Win32 by design is insecure and cannot be fixed. The basic interface for applications with the Windows API is a system that utilizes and object called a HANDLE. Applications are suppose to use the HANDLE to do something, and then clean it up when they’re done. However, there is not protection against one application getting a HANDLE for an object of another application. Furthermore, a HANDLE is merely a _pointer_ into one of several different tables (which one depends on the use of the HANDLE) inside kernel space, and by the way there is no method to authenticate the validity of a HANDLE – at least from the application layer.

    What this means is that Win32 by design allows other applications to put bugs into your application. here’s one very valid example:

    Your application creates a text box that is suppose to only be 256 characters long. You specify this on the creation of the text box. You properly use the text box to get the 256 characters.

    However, your friend BillB writes another application that accesses your text box and changes it to be 64536 bytes long, and inserts a lot of extra text into it to use up the entire space. Windows updates your text box to be the size BillB’s application said it is, but its YOUR text box, not BillB’s. Your application is now subject to a buffer overflow attack through no fault of your own. (Your application properly used the text box.)

    That is just one attack vector – and it applies to any use of a HANDLE to do something – whether it is a text box or a lock; yes, Locks use HANDLES – so BillB’s application could access one of your locks and cause your application to go into a Deadlock situation -or worse, unlock something at the wrong time. There are simply no protections and no method of protecting against those kinds of attacks – it’s the design of the Win32 API.

DecorWhat Else is New


  1. IRC Proceedings: Wednesday, October 27, 2021

    IRC logs for Wednesday, October 27, 2021



  2. [Meme] False Choices and False Dichotomy Designed for Self-Harm

    The self-serving EPO surveys, which Benoît Battistelli and António Campinos design to justify their own policies, have severe flaws in them



  3. Links 27/10/2021: XOrg Server 21.1 and Makulu Shift Ubuntu Variant Released

    Links for the day



  4. Links 27/10/2021: Murena for /e/ and Red Hat Condemned for Its Nationalism/Racism

    Links for the day



  5. [Meme] EPO Presidential Surveys

    The 'social democracy' of Benoît Battistelli and António Campinos as demonstrated by a controlled survey (controlled by the subject of the survey, EPO governance)



  6. 'Shaping the New Normal' Survey at the EPO Got 5,554 EPO Staff to Participate, But It Was Controlled by Liars With an Agenda

    Last year’s EPO ‘study’ (hogwash about “quality” and other unscientific junk) was likely biased by virtue of autocrats controlling it and exploiting it for nefarious agenda and brainwashing of national delegates. The Staff Union of the EPO (SUEPO) has a new survey in the making.



  7. Many of the National Delegations (or Delegates) in the EPO's Administrative Council Have No Understanding of What They Vote on

    One must consider the possibility that ignorance or gullibility (which lack of qualifications may entail) possibly became a contributing factor — malice and bribery aside — in systemic failure of the EPO’s governance



  8. The EPO’s Overseer/Overseen Collusion — Part XXV: The Balkan League - Fresh Blood or Same Old, Same Old?

    We take stock of "captured states" that voted in favour of unlawful "Strike Regulations"



  9. IRC Proceedings: Tuesday, October 26, 2021

    IRC logs for Tuesday, October 26, 2021



  10. Beatriz Busaniche Speaks Up in Defense of Richard Stallman

    Beatriz Busaniche sent us this comment in July 2021. She wrote it originally in Spanish. Here are both the original text and our translation to English.



  11. Links 26/10/2021: SUSE Linux Enterprise Micro 5.1 and Multi-Distro Benchmarks

    Links for the day



  12. Links 26/10/2021: Vulkan 1.1 Conformance for Raspberry Pi 4 and Tor Browser 10.5.10

    Links for the day



  13. [Meme] Sounds Legit

    When not cheating on the wife, the EPO‘s “doyen” cheats in the exams and makes it into the epi Council, in effect working “[t]owards a common understanding [sic] of quality” with “patent attorneys nominated as “assessors” by the EPO, epi and BusinessEurope” (notorious lobbyists for dictators, litigation, and monopolies, neither business nor science)



  14. [Meme] Mayoral Patent Office Chief

    As it turns out, political 'double-dipping' isn't just a thing in North Macedonia, Austria, and EPOnia



  15. Romania's Patent Office (OSIM): Nine Different Chiefs in Just Eight Years

    The Romanian State Office for Inventions and Trademarks (OSIM), being the equivalent of the U.S. Patent and Trademark Office (USPTO) in the sense that it covers both patents and trademarks, is a very flaky institution with no shortage of scandals; for our English-reading audiences we now have a summary of a decade’s worth of blunders and leadership changes



  16. The EPO’s Overseer/Overseen Collusion — Part XXIV: The Balkan League - Romania

    Romania’s patent office has been in flux this past decade, occasionally led by people with no relevant experience, but rather political connections (like EPO President António Campinos) and sometimes forged documents and fake degrees



  17. IRC Proceedings: Monday, October 25, 2021

    IRC logs for Monday, October 25, 2021



  18. [Meme] “Social Democracy” at the EPO

    Some comments on the current situation at the European Patent Office from Goran Gerasimovski, the new EPO Administrative Council delegate for North Macedonia and Social Democratic candidate for mayor of Centar (a municipality of Skopje)



  19. [Meme] António Campinos Visits the OSIM

    António Campinos visits OSIM Director-General Ionel Muscalu in February 2014



  20. [Meme] [Teaser] Meet the President

    Later today we shall see what Romania did for Battistelli



  21. Links 26/10/2021: Latte Dock 0.10.3 and Linux 5.15 RC7

    Links for the day



  22. Gemini Protocol's Originator: “I Continue to Care About This Project and I Care About the Community That Has Formed Around It.”

    'Solderpunk' is back from a long hiatus; this bodes well for Geminispace, which grew fast in spite of the conspicuous absence



  23. Bulgarian Like Bavarian Serfdom

    Bulgarian politics seem to have played a big role in selecting chiefs and delegates who backed Benoît Battistelli‘s unlawful proposals, which treat workers almost like slaves and ordinary citizens as disposable ‘collaterals’



  24. The EPO’s Overseer/Overseen Collusion — Part XXIII: The Balkan League - Bulgaria

    Today we examine the role of Bulgaria in Benoît Battistelli‘s liberticidal regime at the EPO (as well as under António Campinos, from 2018 to present) with particular focus on political machinations



  25. Links 25/10/2021: New Slackware64-current and a Look at Ubuntu Budgie

    Links for the day



  26. Links 25/10/2021: pg_statement_rollback 1.3 and Lots of Patent Catchup

    Links for the day



  27. Microsoft GitHub Exposé — Part III — A Story of Plagiarism and Likely Securities Fraud

    Today we tread slowly and take another step ahead, revealing the nature of only some among many problems that GitHub and Microsoft are hiding from the general public (to the point of spiking media reports)



  28. [Meme] [Teaser] Oligarchs-Controlled Patent Offices With Media Connections That Cover Up Corruption

    As we shall see later today, the ‘underworld’ in Bulgaria played a role or pulled the strings of politically-appointed administrators who guarded Benoît Battistelli‘s liberticidal regime at the EPO



  29. IRC Proceedings: Sunday, October 24, 2021

    IRC logs for Sunday, October 24, 2021



  30. Links 25/10/2021: EasyOS 3.1 and Bareflank 3.0

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts