Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software Windows

MS Security Guy Wants Vista Bugs Rated Down 167

Posted by CmdrTaco from the grass-is-greener-on-his-side dept.
jcatcw writes "Gregg Keizer reports that Michael Howard, an MS senior security program manager, says that the Microsoft Security Response Center (MSRC) is being too conservative in its Vista vulnerability rating plans. Microsoft's own bug hunters should cut Windows Vista some slack and rate its vulnerabilities differently because of the operating system's new, baked-in defenses."
This discussion has been archived. No new comments can be posted.

MS Security Guy Wants Vista Bugs Rated Down More

MS Security Guy Wants Vista Bugs Rated Down

Comments Filter:

  • Hmmmm. . . (Score:5, Funny)

    by bplipschitz ( 265300 ) on Sunday March 18, 2007 @08:10AM (#18393653)
    Sounds a little like Michael Howard might be "baked in". . .

  • Isn't that ..... (Score:5, Funny)

    by edwardpickman ( 965122 ) on Sunday March 18, 2007 @08:11AM (#18393659)
    rate its vulnerabilities differently because of the operating system's new, baked-in defenses."

    ...half baked?

    • Re:Isn't that ..... (Score:4, Funny)

      by Anonymous Coward on Sunday March 18, 2007 @08:24AM (#18393705)
      No, I believe Michael Howard is totally and utterly baked. He clearly needs to stop hitting that bong.

    • Re:Isn't that ..... (Score:5, Insightful)

      by numbski ( 515011 ) * <numbski@hksPASCA ... t minus language> on Sunday March 18, 2007 @09:39AM (#18394067) Homepage Journal
      You'd have to be smoking some pretty good weed to go along with this. :P

      Let's say on *nix there's a vulnerability that allows for remote ssh access. You can only get in as an unprivileged user, heck, you may even get /dev/null as your shell, but it lets you in. Do you rate down the remote access flaw because of *nix's "baked in " defenses? No! You fix the bug and update.

      Just because your system is overall more secure doesn't mean that you don't blow the whistle on the flaws just as hard. It's called VIGILANCE.

      • Re:Isn't that ..... (Score:5, Funny)

        by ericlondaits ( 32714 ) on Sunday March 18, 2007 @10:20AM (#18394261) Homepage

        Just because your system is overall more secure doesn't mean that you don't blow the whistle on the flaws just as hard. It's called VIGILANCE.


        Mmmm... while it's true that the price of freedom is eternal VIGILANCE, remember that you can get Vista Ultimate for as little as $399.95.

        • Re: (Score:2)

          by ozbird ( 127571 )
          remember that you can get Vista Ultimate for as little as $399.95.

          "You keep using that word. I do not think it means what you think it means."

        • Re: (Score:2, Funny)

          by lanzz ( 83456 )

          while it's true that the price of freedom is eternal VIGILANCE, remember that you can get Vista Ultimate for as little as $399.95.
          perhaps they should release a new edition, Vista Vigilante?
        • I can not help but think that,"Vista Ultimate", should be viewed as a "Warning Label".

          "...And I should know..." - Doritos Advertisement

        • ...while it's true that the price of freedom is eternal VIGILANCE, remember that you can get Vista Ultimate for as little as $399.95.
          Underscoring the point that Vista and Freedom have very little to do with each other...

      • Re: (Score:3, Informative)

        by Gnavpot ( 708731 )

        Do you rate down the remote access flaw because of *nix's "baked in " defenses? No! You fix the bug and update.

        Did you intend those two scenarios to be mutally exclusive?

        Rating a bug low does not necessarily mean that it is fixed slower.

        • Re:Isn't that ..... (Score:5, Insightful)

          by tdelaney ( 458893 ) on Sunday March 18, 2007 @04:19PM (#18396471)
          There's a difference between severity and priority.

          A bug may be high severity (e.g. remote access) but low priority (e.g. because it's believed that other factors mitigate the remote access).

          Another bug may be low severity (e.g. a user interface quirk) but high priority (e.g. because reviewers have seen it and are talking down your product because of it).

          Severities should be based on how much damage may be caused to the *users* of the program. Priorities are usually determined by how much damage the bug causes to the *developers* of the program ...

      • Re: (Score:2, Insightful)

        by Hierarch ( 466609 )

        Let's say on *nix there's a vulnerability that allows for remote ssh access. You can only get in as an unprivileged user, heck, you may even get /dev/null as your shell, but it lets you in. Do you rate down the remote access flaw because of *nix's "baked in " defenses? No! You fix the bug and update.

        Well, actually, you do rate it down. This is basic risk assessment, and if it comes to a prioritization of resources — which bug should we fix next? — I want that priority set according to the impac

        • Re:Isn't that ..... (Score:5, Informative)

          by VertigoAce ( 257771 ) on Sunday March 18, 2007 @04:40PM (#18396621)

          Either way, it shouldn't be driven by an outsider, although he can and should make the suggestion to them that certain criteria should be revisited.



          To give some context to who Michael Howard is, he is one of the head security guys at Microsoft. One of his roles is to improve the development process across Microsoft to improve security. So the MSRC responds to actual security vulnerabilities, while Michael looks at why the development team missed the bug and how to avoid it in future products.

          If you read what Michael actually said the issue becomes more apparent. A security bug that affect Vista and XP will usually be given the same rating, even if Vista has defense mechanisms that it make it extremely unlikely that it can be exploited. In the security alert they will list any defense mechanisms that make it harder to exploit the bug, but they don't change the rating.

    • Re: (Score:2)

      by Locutus ( 9039 )
      It sure sounds like "the most secure Windows ever" has been over cooked.

      LoB

      • Re: (Score:2, Funny)

        by Seumas ( 6865 )
        Nothing says security like naming your flagship product after the part of a house that is made of thin glass and can be broken with a small rock, stick or an elbow and allows everyone outside to see everything going on inside.

  • Hal Howard (Score:2, Interesting)

    by Anonymous Coward
    I work at Microsoft, I can get Vista for practically free but I refuse to even touch Vista with a bargepole and dont recommend it to others. They dont need it anyway even if it was "finished" and secure.

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      I work at Microsoft, I can get Vista for practically free but I refuse to even touch Vista with a bargepole and dont recommend it to others. They dont need it anyway even if it was "finished" and secure.

      You sound like a contractor that is bitter you didn't get hired on. Those of us are employees of MS want to make certain that we get the remaining bugs fixed. That isn't going to happen if we point fingers and play the blame game.

      I work on embedded devices at MS and we won't have Vista support ready for a

      • Re: (Score:2)

        by smash ( 1351 )

        The new kernel is modular and agile

        If this is really true, then why the hell do you need 1-2gb of ram for acceptable performance?

        Sure, it will boot with 512mb, but it's like watching paint dry trying to actually do anything with it.

      • Once we strip out the shell, the graphics, and most of the managed code we will have a nice version that will run on a fraction of the resources required on the desktop.


        And at that point, you'll have a kernal that's almost half as fast as XP instead of the current one third as fast.

      • When anybody asks me whether they should run Vista I tell them to at least wait till SP1 and preferrably SP2. And that is the only sane advice you can give them. Heck, I personally find XP to be the best windows so far and even that took till SP2 to be halfway usable (and secure). Running Vista now is like running linux 2.6.21. It might be cool, but it will probably just blow up in your face and you get to keep the pieces.

    • Re: (Score:2)

      by smash ( 1351 )
      How about this: I *don't* work for microsoft. I have a copy of Vista's Ultimate Edition ISO and a timer-stop crack. I have a PC that will run it quite happily (2gig, p4-d 3.0, nvidia 7600, ~ 0.7tb of disk with about 300gb free).

      I haven't installed it, and don't plan on it any time soon, because there is no incentive for me to do so.

  • A rough translation to human speech... (Score:5, Insightful)

    by dyfet ( 154716 ) on Sunday March 18, 2007 @08:14AM (#18393669) Homepage
    "Your making us look bad, cant you lie a little, we do all the time..."

    This was a public service translation, for those who have trouble understanding Microspeak...

  • Its about the bug, not the environment (Score:5, Insightful)

    by Anonymous Coward on Sunday March 18, 2007 @08:19AM (#18393691)
    This guy is IMO a narrow minded fool. Sure, Vista may have extra security features which can limit the extend of damage which a certain bug can do. But does this mean that these features have any impact on the severity of those bugs? Lets "translate" this to Linux:

    Say a new local SSH exploit has been found allowing attackers to gain root privileges. Does the fact that you'd need user accounts which are actually useable by people make any difference on the severity of the exploit? "Gee, cut the homeuser some slack since they won't have any real user accounts to begin with. So stop scaring them and rate the bug as it really is?" ? But... The bug really is what it says to be. In my example its a critical issue, in the case of a Vista bug its Important.

    Just because you may benefit from the extra security enhancements doesn't imply everyone else does. So please; cut out the idiocy and the desperate attempts to push Vista forward by focussing on all good points and ignoring the bad points, and simply keep calling things what they are. I for one now question the professionality of this guy.

    • Re:Its about the bug, not the environment (Score:5, Informative)

      by NearlyHeadless ( 110901 ) on Sunday March 18, 2007 @09:19AM (#18393929)
      If you've read Michael Howard's writings, he's certainly not a "narrow minded fool". On his blog, he talked about security features in the compiler and linker such as /GS and /SafeSEH. With these in place--and OS-based onese, such as Address Space Layout Randomization and Data Execution Prevention-- buffer overflows still exist, but are much harder to effectively exploit. Yes, the process will abort, so you could still have a denial of service attack, but you've greatly reduced the chance of a more serious remote code execution.

      Note that OpenBSD is also adopting similar defense-in-depth strategies, including SSP and N^X. Adoption is much more haphazard on Linux Distros, so you may be at much more risk running an application such as SSH on Linux than on OpenBSD even when it is compiled from the same source code.

      • Re:Its about the bug, not the environment (Score:4, Informative)

        by OmegaBlac ( 752432 ) on Sunday March 18, 2007 @10:33AM (#18394349)

        Adoption is much more haphazard on Linux Distros, so you may be at much more risk running an application such as SSH on Linux than on OpenBSD even when it is compiled from the same source code.
        SSP is included with recent versions of GCC 4.1 and above. If your specific distro is using GCC 4.1 or newer, then they are compiling with SSP already.

        http://gcc.gnu.org/gcc-4.1/changes.html [gnu.org]
        • Add to this that the memory randomisation and data NX support has been in the linux kernel for years...

          Yes the point still remains. The bug severity must be in some way comparable to other operating systems and Vista's security features are no better than Linux's

      • Re:Its about the bug, not the environment (Score:5, Insightful)

        by hxnwix ( 652290 ) on Sunday March 18, 2007 @11:35AM (#18394673) Journal
        Right, and that's why OpenBSD pretends that remote exploits are warm & fuzzy happy ponies. Because of their "baked in defenses." ...
        Errr, NO , this guy promulgating deceptive doublespeek. But perhaps he knows better - perhaps he's just a dishonest jackass and not a retarded jackass. What was your point again?

      • Re:Its about the bug, not the environment (Score:5, Insightful)

        by driftwolf ( 843548 ) on Sunday March 18, 2007 @12:03PM (#18394849)
        If Vista is so much more "secure", then any flaw should be much MORE serious, not less. After all, aren't they supposed to have worked so long and hard to reduce the flaws in this one? If one advertises a secure system, then any breach is, by definition, important. MS Vista is being pushed as a highly secure system to many businesses. Hence, security issues are that much more important, as they were used to sell the system in the first place.

        As we've heard that much (some?) of their vaunted security is actually just optional smoke and mirrors (several of the user security features for instance), I don't think MS Vista should be given any easier ride than any other operating system. Let it be judged independently, on its own merits, and not through re-definition of what is critical or not for political (and of course publicity and monetary) purposes.

        Any system that defines itself as "secure", but isn't, deserves to be ranked accordingly. Microsoft (and it isn't alone by a long shot) has a very long history of selling one thing and delivering another. Changing the criteria based on what they are selling isn't warranted until what they deliver matches that in every respect. So far, they aren't doing that with MS Vista either.

      • Re:Its about the bug, not the environment (Score:5, Informative)

        by kscguru ( 551278 ) on Sunday March 18, 2007 @12:46PM (#18395105)
        His security features are /GS, /SafeSEH, layout randomization and an execute bit? Okay, he really is full of it.

        • /GS. In theory works fine. In practice, you MUST (1) get the software publisher to compile with the switch, (2) cannot use inline assembly (/GS bails out on such code), and (3) must be willing to sacrifice a small bit of performance. In other words, a fair amount of real-world code can't use this. And oh by the way, this doesn't protect against all buffer overflows - it only protects against the easiest category. It's still quite possible to corrupt data with a buffer overflow, and maybe use that data to gain control.
        • /SafeSEH. Right ... how many common languages don't have good exception handling? You said C only, right? And how often do you use Windows exceptions in C? Not much, you say? When I've seen SEH code, it's almost always very narrowly scoped and thus easy to get right - in real code, Windows SEH is just a trampoline to get into another exception mechanism. Making it "safer" adds no value.
        • ASLR. This one makes generating a sucessful exploit a little more difficult - moves it from medium-easy to medium, because it's harder to hit a "target buffer". Of course, for compatibility reasons, a fair number of apps turn this off (they have assumptions about where code lives, and/or need the wasted address space). It helps - statistically. But a lucky guess is still going to succeed, and I don't trust luck for security.
        • DEP. A two-pronged technology, which (1) uses the NX bit and (2) disallows syscalls from data segments. Oh but wait, (1) requires having a fairly recent processor and (2) is fine for some apps, but breaks for anything that does dynamic code (e.g. a Java runtime), so it's also disallowed for many, if not most, apps.
        So what do we find out from this list? You get defense-in-depth - IF you are running the latest hardware, IF you use only software built with MSFT's favorite options (some of which are opt-in), and IF you only run apps that embrace all these strategies. How many Joe Consumers fit into those ifs? Datacenters might be closer, but I'll bet even they can't generally say all these hold true.

        I'm glad open-source is adopting some of these measures. But let's be realistic - all any of these technologies do is make a sieve less leaky by putting a second sieve underneath. Something is nice, but we would be fools to treat any of these security "features" as more than a speed bump.

        • Re: (Score:3, Interesting)

          by LO0G ( 606364 )
          Has he EVER refered to those as "security features"? I'd be surprised, Michael Howard doesn't usually make those kinds of mistakes.

          Usually those are described as mitigations, since there are no security guarantees associated with them (since they can be bypassed, they're not security features.
  • I do not think that the word "security" means what you think it means.

    Or, you're a FUD-peddler whose job it is to convince Gartner that you don't suck... I'm not sure.

  • New rating for new system? (Score:4, Insightful)

    by Jimbitz ( 1060548 ) on Sunday March 18, 2007 @08:30AM (#18393725)
    I can't believe someone known as microsoft security guru would make a statement like that.
    An exploit is still an exploit. It doesn't matter if it's found in a brand new OS or the predecessor.

    Thank god there are people who doesn't agree with him.

    • Re: (Score:2, Insightful)

      by GIL_Dude ( 850471 )
      Well, I think the point would be something more like this:

      A buffer overflow is found in lsasrv.exe. It's remotely exploitable on Win2k3 server and Windows XP and can run arbitrary code and doesn't require an account on the system (remote wormable). It's only locally exploitable on Vista, requires a local (even if low privileged) account to be logged on an run the code (possibly via social engineering - click here for SomeStarNaked.exe).

      He's talking about the rating - a rating should be in relation to so
      • As I understand, what he's really talking about are all the new memory protection features Vista boasts which do indeed reduce the possibility of successfully exploiting something like a buffer overflow. So. in theory, a buffer overflow in IIS on Vista is potentially less dangerous than a buffer overflow in Apache on Linux.

      • Re: (Score:2)

        by julesh ( 229690 )

        Well, I think the point would be something more like this:

        A buffer overflow is found in lsasrv.exe. It's remotely exploitable on Win2k3 server and Windows XP and can run arbitrary code and doesn't require an account on the system (remote wormable). It's only locally exploitable on Vista, requires a local (even if low privileged) account to be logged on an run the code (possibly via social engineering - click here for SomeStarNaked.exe).

        To be fair, that's not the point. That would currently be rated Critica

    • Re:New rating for new system? (Score:5, Funny)

      by rbochan ( 827946 ) on Sunday March 18, 2007 @09:57AM (#18394151) Homepage
      Yeah, threat rating: "waaah... security is hard!"

  • This is not wise (Score:5, Insightful)

    by EXMSFT ( 935404 ) on Sunday March 18, 2007 @08:35AM (#18393743)
    Don't challenge the hackers. It's great that Windows Vista has some built in low-level security protections. It's also great to see that Michael is discounting the significance of UAC. And he should - most people will wind up turning it off. But I think that attempting to say that Vista is fire retardant is most likely going to serve as a method to encourage hackers and script kiddies to try and set fire to it. Saying "because it's Vista means the exploit isn't as bad" is a horrible argument. It's an OS, and an exploit is an exploit.

    In short I don't think Michael should assume. When you assume, well, you know.

    • In short I don't think Michael should assume. When you assume, well, you know.
      Yes, we know. Assumption is the mother of all fuck-ups.
    • Don't challenge the hackers.

      Yeah, like how Apple made those "Get a Mac" ads about how OS X has less malware in the wild than Windows, but then when hackers heard about it...

      *Crickets chirping*

      Well, now the crickets are loud as hell. I assume we can blame this on the hackers somehow.

  • stop whinning and just.... (Score:4, Insightful)

    by 3seas ( 184403 ) on Sunday March 18, 2007 @08:36AM (#18393747) Homepage Journal
    ...fix the bugs.

    • Re:stop whinning and just.... (Score:5, Insightful)

      by rucs_hack ( 784150 ) on Sunday March 18, 2007 @08:55AM (#18393805)
      They can't

      Not because of anything so simple as crap coders or Microsoft being shit (lame reasons when there are so many others that can be justified with examples) . They can't because it's too complex, subject to too many attack vectors, and closed from peer review of code.

      Time was this refusal to allow external entities to search for and fix bugs in their code was acceptable as normal business practice. Since Linux got more popular, people have started to see that peer review of code is superior when it comes to finding and fixing errors.

      I'd be willing to bet that if Linux was closed source it would be as defective as Windows is. That it isn't testifies to the usefulness of open source/bsd style approaches.

      • Re: (Score:2, Insightful)

        by tuzzer ( 617754 )

        I'd be willing to bet that if Linux was closed source it would be as defective as Windows is. That it isn't testifies to the usefulness of open source/bsd style approaches.
        Something being closed source doesn't mean it can't be peer reviewed. We use peer reviews at my job all the time. The rule is you don't check your own code, others do. It helps. A lot.

        • Re: (Score:3, Informative)

          by HiThere ( 15173 )
          It does, however, meean that those who review it will be few in number, and will have a similar perspective. These are both strong indications that the peer-review is weak.

          P.S.: Note that OpenSource programs with few developers interested in the code run into this same problem. Good peer review takes lots of eyes in multiple environments over an extended period of time. A structured code walkthrough just isn't the same thing. It helps, but it's not the same.
        • Oh I agree. However I mean Microsoft don't put the code out there for others outside of Microsoft to review. Well they can't, it's 'proprietary', so this is kind of obvious.
          That's their business model, it can't be helped.

        • We use peer reviews at my job all the time

          yes, typically all development shops do. the difference, i believe, is 20 eyes vs 20,000 eyes. which would you prefer to make sure your code is bug free?
      • What are you talking about? Other companies than Microsoft DO have access to Windows source code. Most governments, as an example. Just because YOU can't get at the code, you can't claim that it can't be peer reviewed. With that attitude, the Windows users should feel fortunate that you don't have access to their source code.
        • Other people who pay lots and lots of money or are required by law get access, but it is not for peer review and assistance with bug hunting, it's for customising aspects to work with their own applications, or tailoring applications to work with the existing code base.

          Availability of code under these conditions is not comparable to an open peer review process.
    • What? Do you know how much money it costs to fix the bugs? Wait until next year when they release the Vista SP1 update. The bugs are a low priority because they still have Vista Server to bring out.

  • Missing the point (Score:4, Insightful)

    by UnknowingFool ( 672806 ) on Sunday March 18, 2007 @08:36AM (#18393749)
    Why is it that MS always misses this point: Secure is relative. Advocating that MS can be more lax in its procedures because Vista is more secure is like saying you don't need to train anymore because you didn't finish last in a race. Microsoft may have better security than its predecessors; however, that remains yet to be seen whether or not it is adedquately secure. Given the companies history of boasting about security and then failing to deliver, it would be best if they were conservative when it comes to security. Wasn't there a recent slashdot article on how OpenBSD had an its second security issue in a decade? Compared to that, Microsoft security is a joke.

  • Tired article on a stupid statement. (Score:4, Insightful)

    by lancejjj ( 924211 ) on Sunday March 18, 2007 @08:37AM (#18393751) Homepage

    Microsoft's own bug hunters should cut Windows Vista some slack and rate its vulnerabilities differently because of the operating system's new, baked-in defenses, according to [Michael Howard, a senior security program manager in Microsoft's security engineering group] who is often the public persona of the company's Security Development Lifecycle (SDL) process.
    Microsoft shouldn't have this guy as the "public persona" of security if he isn't 100% within both the security & public communications loops at Microsoft. "Vista" is supposed to be all about security. Why are they having this guy "chat" about it when he isn't a communications expert and when he isn't representing Microsoft's corporate opinion?

    I'm sure we've all said a few things that were externalized "thought experiment" instead of "well thought out conclusions". And I think I can see how his line of thinking was going, although I disagree with his statement. And I wouldn't be surprised that in hindsight he disagrees with his own statement.

    Microsoft has inadvertently set this guy up as a fall guy by anointing him as a semi-official spokesperson. Hopefully he won't find himself on the street due to what is a failure of his management.

  • Obligatory (Score:5, Funny)

    by dkleinsc ( 563838 ) on Sunday March 18, 2007 @08:56AM (#18393807) Homepage
    You are trying to cover your own ass. Cancel or Allow?
  • Lets see, Microsoft has been selling crap all these years and now wants to be cut some slack? Yea, right.

  • A little late for that... (Score:5, Insightful)

    by Jasin Natael ( 14968 ) on Sunday March 18, 2007 @09:10AM (#18393883)

    By this logic, then, shouldn't most of the bugs for Linux and OSX have been rated as "relatively unsafe", while the Windows bugs were almost universally labeled "Über-pWnz0r3d"?

    It seems like he wants this just so he can compare turds to turds, boosting the sales of Vista by saying the Windows 98 and 2000/XP bugs of yesteryear were worse because the same bug is arguably less severe under Vista. It may be true, but he should hope that if anyone takes him seriously, they don't start rating severity relative to similar bugs in competing products.

    Be careful what you wish for...

  • softer... (Score:3, Funny)

    by beando ( 1074553 ) on Sunday March 18, 2007 @09:18AM (#18393925)
    Vista making microsoft became microsofter...

  • It would seem.. (Score:4, Funny)

    by ChePibe ( 882378 ) on Sunday March 18, 2007 @09:23AM (#18393963)
    That Mr. Howard has yet to come to the sad realization [apple.com] that the rest of the Vista-using world has...
  • Comment removed based on user account deletion

  • Awww (Score:2, Insightful)

    by Centurix ( 249778 )
    They're hurting your feelings, come here and rest on my man boobs. There there, that's better isn't it mr security person. What, they're not as soft and comfortable as your moms boobs? Excuse me, I'd like you to rate my boobs better than that, after all, I am a MAN!
  • At least this will let bears retake their proper spot at #1.
  • For some reason, this guy reminds me of one of the "Three Stooges".

    "Calling Dr Howard, Dr Fine, Dr Howard"...

    Maybe it's because he needs a brain transplant. ;-)

    LoB
  • That's like buying a new model car and the dealer saying, "Sorry it just keeps stalling on you, but it's a newer model and were still working out all the bugs. In the mean time, here's a coupon for a free oil change, just don't complain to loudly."

  • Of course! (Score:4, Funny)

    by RMingin ( 985478 ) on Sunday March 18, 2007 @10:30AM (#18394321) Homepage
    Obviously any Vista security bugs should be rated less severe... I mean, nobody's running that OS, right? Minimal impact!

  • An interesting response (Score:5, Interesting)

    by Trelane ( 16124 ) on Sunday March 18, 2007 @10:35AM (#18394359) Journal
    From a Red Hat hacker [awe.com]

  • baked in? (Score:5, Interesting)

    by DragonTHC ( 208439 ) <{Dragon} {at} {gamerslastwill.com}> on Sunday March 18, 2007 @11:31AM (#18394647) Homepage Journal
    in Linux and Unix and Mac's BSD, what's higher than root?

    in Microsoft Vista, what's higher than administrator?
        root
              superroot
                    supersuperroot

    that's right, there are three privilege layers above administrator in Vista.

    users cannot access those, but software can.
    "Oh, you're a process, here's the keys!"
    "Oh you're a user? You want to access your computer, confirm or deny?"

  • OS bakers poem (Score:4, Funny)

    by bl8n8r ( 649187 ) on Sunday March 18, 2007 @11:49AM (#18394773)
    wake-n-bake lets all take
    a look at microsoft half-baked
    hit the bong and sing this song
    windows got security wrong
    Around we go with disclosure fud
    Michael Howard please pass the bud

  • I think MS needs to talk to a lawyer (Score:3, Insightful)

    by SmallFurryCreature ( 593017 ) on Sunday March 18, 2007 @12:37PM (#18395039) Journal

    Simple send each and every person who works for the company in anyway to a lawyer and tell the obey the first rule.

    SHUT THE FUCK UP

    Just stop talking, do NOT say anything, remain silent.

    MS just can't do that and keeps blurting out things that make it seem extremely silly indeed.

    This latest claim is like saying that a grease fire in your kitchen isn't dangerous if you live near a firestation. That getting shot through the chest isn't as much a of a hassle and shouldn't count as an attempt on your life because you happen to be in a emergency room.

    A bug, is a bug, a security hole is a security hole. That they are even rated is already bad enough. They should have just one variable "fixed" wich is a boolean.

    Claiming that a so called critical bug isn't as severe because the unproven untested OS it runs on has some safety measures, which by the way have been programmed by the same people who programmed the bug, is not exactly raising my opinion of MS.

    Had they simply listened to the lawyer they would have kept their mouth shut and not dropped another notch in my estimation.

    Perhaps it is all part of a cunning plan with them hoping that humans like computers suffer from wrap around and if they lower my opinion far enough it would wrap around to positive again.

    or they are stupid.

    But I liked the end, unless Vista picks up it will receive the same non-attention as OS-X, now that gotta smart.

  • The first thing Microsoft needs to do to get ANY credibility at all where security is involved is to take immediate and rapid steps to eliminate the role of the HTML control as an element of the security system.

    That means getting rid of "Security zones". All documents displayed by the HTML control must be considered "untrusted".

    To do this, start by getting rid of the ability for documents viewed in the HTML control to request the use of ActiveX objects, since no documents are considered trusted, ActiveX can't be used anyway.

    At the same time, provide a mechanism like IO Slaves for applications to install controls... a mechanism that can not be requested by a document.

    Modify Windows Explorer and Software Update to use this application-controlled mechanism to install components into the HTML control.

    Create an IE shell that installs an "ActiveX IO Slave" to restore the existing behaviour. This shell will display windows with some visual indication that they are untrustable and dangerous. Users who acually require this functionality during the transition can run the "Insecure IE" shell.

    In the next major release of Windows, remove that component.
  • BTW, this is the guy who lectures MS devs on security and likes to point out how insecure Linux is compared to W2K3. He's living in a bubble, which is fine by him as long as he gets a paycheck. To be fair, most of what I heard him say was sound advice, if overly verbose. I wish he wouldn't degrade himself to a bullshit robot when talking about Linux and Vista, though.

  • Conservative? (Score:3, Insightful)

    by julesh ( 229690 ) on Sunday March 18, 2007 @02:59PM (#18395913)
    "The MSRC folks are, understandably, very conservative and would rather err on the side of people deploying updates rather than trying to downgrade bug severity"

    Err, right. So if they're so conservative, how come they'll rate a remote code execution bug as "moderate" if the code is run in a restricted context (see, e.g. http://www.microsoft.com/technet/security/Bulletin /MS06-013.mspx [microsoft.com] - particularly the DHTML bug)?
  • you no longer get a good grade for trying.

    RESULTS are all that matters in the real world. I don't care how hard you're trying to make my fries, if you stil burn them, you SUCK.
  • Vista is going nowhere, so now they trot out some bozo to say that Vista security problems won't be as bad as XP's.

    Then they also had some Microsoft bozo post on his blog that he was going to compare vulnerabilities - actually, not even vulnerabilities but FIXES - between OS's - using the same discredited methodologies they've been using since forever. Naturally Windows came out ahead. He even tried to head off criticism by admitting he was a Microsoft bozo. Naturally, that didn't work.

    In other words, Microsoft is trying to spin Vista's failure to be a "Windows security cureall" - especially since OneCare has been a PR nightmare by failing antivirus checks and then deleting users Outlook email files.

    It's just another pathetic Microsoft pack of lies.

    Remember, folks: ANYBODY authorized by Microsoft to talk to the public is a LIAR.

    Microsoft does NOT sell software. It sells LIES.

  • "The limited pickup of Vista installs [means that] until Vista is more popular, it will enjoy the same limited attention from hackers as OS X"

    He should know by now that its not the install base of OS X, its that the hacker bullies only pick on those that cry.
  • On one level, this makes sense. A vulnerability should be judged by the risk it poses to the system, and security tools and settings can, in some cases, mitigate the risk and should be factored in. So on the surface, rating cross-Microsoft-platform vulnerabilities differently for Vista than XP makes sense, if Vista's security measures in their default or most common configuration are a truly effective mitigation for the vulnerability.

    The crux of the matter is determining if the security measure is effective

Slashdot Top Deals

To thine own self be true. (If not that, at least make some money.)

Close