Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security

Cryptogram Judges MS Security 204

Posted by CmdrTaco from the who-do-you-trust dept.
johnfoobar writes "The latest issue of Bruce Schneier's Cryptogram has a section entitled 'Judging Microsoft' which aims to "provide a list of measurable recommendations, so that the community can judge Microsoft's sincerity." Required reading if you use Microsoft products." Update: 02/15 18:15 GMT by M : A better link is Schneier's first essay this month, which is about Microsoft's "Trustworthy Computing" initiative.
This discussion has been archived. No new comments can be posted.

Cryptogram Judges MS Security More

Cryptogram Judges MS Security

Comments Filter:

  • here goes... (Score:2, Insightful)

    by Em Emalb ( 452530 )
    I think one major thing that will be lost in all the flaming about how MS sucks and is so unsecure is this:

    They are making an effort now. I firmly believe that this is a good thing. Of course, there will be the usual rebuttals:

    what took them so long
    why are they caring about security now, etc.

    Hey who cares why or how, just consider this a good thing that they are more involved in security now. Btw, remember the last time MS went after something with a vengeance? I do.

    *shudder*
    • the more important thing is: Whether they will actually do anything.

      How is this security going to be achieved, fix a few wholes and be a little more careful in the future, then throw the rest of the budget at a multi million dollar ad campaign saying Win XP is the most secure ever?

    • Re:here goes... (Score:4, Insightful)

      by swagr ( 244747 ) on Friday February 15, 2002 @02:13PM (#3014325) Homepage
      what took them so long
      why are they caring about security now, etc.

      Hey who cares why or how

      Microsoft cares about security becouse Microsoft cares about profit. When lack of security and stability meant lower profits, Microsoft cared.

      Recall when Microsoft went after Java (the language, not the platform). Didn't work. And how's their VM compatability with 1.4 now? If "security" doesn't work out for them, what makes you think they won't switch gears and worry more about drop shadows?
      • Excuse me.

        They never went after the language, only the platform. Who restricted them from including a VM? Why exactly did they make J++? Why did they 'embrace and extend' the platform with COM specific stuff?

        Why are they so keen on providing Java support for .NET?

        And how's YOUR compatibility with 1.4 now??
      • Microsoft cares about security becouse Microsoft cares about profit.


        What does that have to do with anything? Do you judge products on the motivations of the creator, or on their actual merit?

        • What does that have to do with anything? Do you judge products on the motivations of the creator, or on their actual merit?
          From what I see in the post [slashdot.org], Swagr seems to judge the company, not the product per se. This means that as soon as secutity is not a buzz-word of the month, Microsoft will probably no longer care about it as much as it cares now. I think it is quite reasonable.
        • RedHat might be more secure than OpenBSD, but that's pretty long odds.
          Without testing everything against all possible combinations, the reputation of the vendor is probably the best and maybe the only reasonable guide to future performance.

    • Microsoft hasn't changed (Score:3, Informative)

      by JoeBuck ( 7947 )
      See this story in the San Jose Mercury [bayarea.com]. Even now, Microsoft is still treating security as a public relations problem. Their response to the discovery of security holes in their products is still, in too many cases, to deny it.
      • That is the core of the problem. If Microsoft was serious about security then they would separate IE from the OS. Separate services so that people can control then individually. But do they do that? No because they want to control the monopoly. So how do they handle security? As was mentioned already a public relations problem!!!

        But that is ok since that will be their undoing. And twenty years down the road we will say "Microsoft who?". Just like Unisys, Wang and most likely XEROX. Companies that do not address the real issues die off. IBM learned those lessons!
      • "We must lead the industry to a whole new level of Trustworthiness in computing." --Bill Gates internal memo, 15 January 2002.
        Well, he didn't say it would be a better level.
        Since there are already such as OpenBSD, TrustedSolaris(sp?), VMS, MVS, you have to wonder just what this whole new level really is. Scary.

    • Re:here goes... (Score:3, Insightful)

      by Sj0 ( 472011 )
      How do we know they are really going to make an effort? Microsoft PR has been full of shit since the first press release. From the Windows 1.0 release "just two months away"(when it was really a full 18 month development cycle from completion), MS PR makes promises it doesn't intend to keep, and often lies outright ("Windows ME is the fastest, most reliable Windows 9x ever!").

      Btw, remember the last time MS went after something with a vengeance? I do.


      Yeah, it was on slashdot yesterday. Bribing politicians with a vengence. Too bad they can't do the same thing to their customers (think "Windows is more stable...and here's your kickback to prove it!")

    • Re:here goes... (Score:2, Informative)

      by iiii ( 541004 )
      They are making an effort now.

      That is the question. Certainly it would be a very good thing if they are making the effort, but are they? Schneier said it better than I could:

      "...I hope he's right when he says that Microsoft is committed to that challenge. I don't know for sure, though. I can't tell if the Gates memo represents a real change in Microsoft, or just another marketing tactic. Microsoft has made so many empty claims about their security processes -- and the security of their processes -- that when I hear another one I can't help believing it's more of the same flim-flam. "

    • Re:here goes... (Score:3, Interesting)

      by shut_up_man ( 450725 )
      The last time they went after something with a vengeance (the net) it was just another matter of shovelling internet features into all their products, in the gonzo MS style. Like Bruce says, security *cannot* be reached using this method. It requires a radical turnaround in attitude, method and implementation, something that might be beyond the company... simply because it's contrary to their core ethos. Securing products costs money, it slows you down, and it doesn't score points with the feature-hungry consumers.

    • Re:here goes... (Score:3, Insightful)

      by Ixohoxi ( 170656 )
      "Remember the last time MS went after something with a vengeance?"

      There's a big difference between putting Company ABC out of business and producing highly secure software. The former can be accomplished by the book, or by crook. The latter can only be accomplished by the book. It remains to be seen how willing Microsoft will be to do things this way, considering how unconventional they have become.

      I think Microsoft has realized that their own software needs to be addressed first and foremost if they are to win the war against Linux. Of course, like in "War Games", the game can't be "won" per se. The only victory is NOT to play. Thus, the sooner Microsoft stops trying to "beat" Linux, the better for everyone.

      Some consider it irrelevant that until recently, Microsoft could have cared less about security. They have hidden behind UCITA and their monolithic EULAs, all the while reducing security by increasing programmability. Their oversimplification, while giving developers more control, also gave hackers more control.

      Choose to ignore facts if you wish, but your own credibility is at stake. To say what happened a year ago doesn't matter this year is just as dumb as saying this year doesn't matter once it's over. Responding to a "usual rebuttal" with an equally "usual rebuttal" isn't the best way to discredit them... or is it? You make the call.
    • and they do dominate the market.I'm with ya, the only thing stopping M$ from owning the world is their products have some severe problems. If they actually get up and do some credible coding, put out a good product what then will we have to BIATCH about ?

      I really dislike their business practices but if they make a good product...someday they might...
    • No, they say they're going to focus on security. Given the kind of BS they've spouted off in the past along these lines, why should we take them at face value now?

      Until they actually prove themselves with a fairly secure product, I'm going to be wary of any company that employs a 'Security Assurance Director'.

  • trust (Score:5, Insightful)

    by ryusen ( 245792 ) on Friday February 15, 2002 @02:07PM (#3014295) Homepage
    a friend of mine once said, "trust is a funny thing. you never really know if you can trust someone, till you find out you can't."
    microsoft, right now, is in that stage. people have just started discovering that they can't trust microsoft. wheather they can or not is not the issue, but the perception of trust is ruined. it will take a long period of dilligence and commitment to prove themselves worthy of trust again. on the other hand, i kind of wish many other companies would make an honest attempt to regain our trust

    • Re:trust (Score:3, Insightful)

      by RazzleFrog ( 537054 )
      The question is - has the average user actually lost trust in Microsoft? I know so many average (and below-average) users who know next to nothing about the security problems. At work all the patches are delivered invisibly to them and at home they have dial up connections and don't stay on long enough to be a real target. The few people who have fallen victim to the Outlook viruses feel more embarassed at their own stupidity than they feel angry at Microsoft.

      The public conception of Microsoft is very far from that of the average Slashdot reader. I overheard on the subway the other day a woman raving about how much she loves Windows XP. She was telling this other woman that she added memory and upgraded to XP and it is like having a brand new machine. I felt like asking her if she downloaded the UPnP patch but I try to avoid talking to people on the subway. I also work with hundreds of people who love Windows 2000.

      So there in lies part of the problem. The public doesn't really know and for the most part doesn't care about the problems. Try going to an average user and explaining all of this to them and see if you don't get the look. We have to seriously root for Microsoft to fix the security holes not because they need to improve their image but because the average user doesn't care.

      • Re:trust (Score:3, Insightful)

        by ryusen ( 245792 )
        you've got a very good point, but i was talking about the computing public.... those that are more aware of the issues... if you take the general populace i doubt many could tell you who the last 3 vice presidents of the us were (this is of course speaking about americans).
        even at my job i see a greater decreating confidence in microsoft amonst the technically inclined. there seems to be two camps.
        1. those that use ms product implicitly (even though many of them have countless problems). this camp graduated from the "no one ever got fired for buying IBM" school.
        2. those who preffer to use non-ms products when ever possible. this is a slow, but apparently growing minority
        atleast where i work that's the two camps...

        • Re:trust (Score:3, Insightful)

          by RazzleFrog ( 537054 )
          I agree that in the computing public, even those pro-Microsoft, have lost a lot of faith in them. Unfortunately, at least where I work, we have to cater to the users. Just the upgrade from NT4 to 2000 was a political nightmare even though it went without a hitch. People are paranoid as all hell about any changes.

          By the way, the last 3 VP's is not that difficult for most people because they are pretty humurous. Dick Cheney's safe location, Al Gore's internet, and Dan Quayle's potatoe [sic].
  • The story points back to a story previously on slashdot [slashdot.org]

  • Anti-innovation (Score:3, Insightful)

    by October_30th ( 531777 ) on Friday February 15, 2002 @02:11PM (#3014315) Homepage Journal
    Nothing in the article addresses the problem that you MUST have a feature-over-security attitude to make a killer application.

    Nobody wants to have a secure product in which you have to manually enable all the great features because of which you bought it in the first place! Secondly, no-one has time to keep up with all the security alerts. That's why an automatic patch system is absolutely necessary.

    Microsoft is being realistic. The author of this article is not.

    • Public nuisance (Score:3, Insightful)

      by coyote-san ( 38515 )
      If your application gets labeled a "public nuisance," it doesn't matter how much the users like those features. Not if they want to interoperate with others.

      This may seem like a harsh judgement, but the cost of Outlook and IIS bugs is rapidly getting to the point where a lot of admins are ready to take drastic measures to protect their own networks. That's why many sites are stripping executable attachments - and the crap like that "begin" bug discussed a few weeks ago are pushing some sites to outright Outlook bans because it's proving too costly to try to work around Microsoft's ongoing indifference to security.

    • Re:Anti-innovation (Score:3, Insightful)

      by c_chimelis ( 120443 )

      Nothing in the article addresses the problem that you MUST have a feature-over-security attitude to make a killer application.

      I disagree with this. To develop a commercial application, there should be a good balance of both features and security. It's true that you may compromise on that third security code audit that you were planning to get the thing out of the door and onto a palette, but it's irresponsible (and could constitute negligence legally) to knowingly develop an insecure product just because you want to add more features.

      Also, keep in mind that the marketroids always want you, the end-user/customer, to believe that they're acting in your best interest by releasing a buggy product Right Now(TM), so of course they're going to try to convince you not only how much you really need those new features (which will go unused in somewhere around 80% of the install base), but also to imply that you would've had to wait an inordinate amount of time to receive the product if they had gone back over it with the proverbial "fine-toothed comb" known as a security audit. In reality, however, security audits should definitely NOT be the afterbirth of development...proper security programming practices should be enforced during development so that the code can be as secure as possible from the day the code is first written. Using C functions like gets() without doing overflow checking, for example, is just asking for trouble in most cases, and every competant programmer knows it...the question is, why should it be ok to not write the overflow check or to use a different call that's safer instead? I don't see the difference in time between typing gets() and typing fgets() with a few more arguments when the code is first written? Sure, you could argue that, after thousands of development hours, the few extra seconds adds up, but if it saves you millions in PR and legal expenses, why wouldn't you change your development practices?

      Up until recently, Microsoft has enjoyed an era without being held accountable for the bugs in their products (security and otherwise). That is changing now, however, and they really need to treat this as more than just a PR issue (it's becoming more of a legal issue as well). Let's face it, Microsoft is taking heat about this not because of their market position or pervasiveness...not even because their products are compiled from millions of lines of code...it's because they don't stress a proper security-oriented (read: sane) development process.

      Don't be brainwashed by them saying that security is the killer of timely/rapid innovation or release schedules because it simply isn't true unless they're development practices say that security is an afterthought rather than an integral part of their programming practices.

      • Using C functions like gets() without doing overflow checking, for example, is just asking for trouble in most cases, ... I don't see the difference in time between typing gets() and typing fgets() with a few more arguments when the code is first written?

        In my experience, five minutes spent on overflow checks initially will save an hour in debugging. Unless you get _unlucky_ and the flaw isn't discovered in debugging. But then, I take bugs more seriously than an MS coder has to. When I release a program, I wrote it all by myself for internal company use. I'm going to get yanked out of my office to _look_ at any bugs that pop up, and have three senior managers breathing down my neck while I fix it. Microsoft programmers are insulated from that by sheer organizational size -- tech support gets the bug calls, not the programmers, and tech support probably won't be able to track down the lazy bastard responsible for the bug and make him fix it himself. Beyond that, MS shuffles most tech support off to the OEM's...
    • Nobody wants to have a secure product in which you have to manually enable all the great features because of which you bought it in the first place!

      Microsoft itself would now supposedly disagree with that point. As part of their new security effort, they are reviewing all parts of their code, including default configurations.

      As part of the security initiative, every manager has to justify not only the group's programming decisions, but how the software is configured as a component of Windows.

      Program managers are being asked, "Are 90 percent of your users using this feature? If not, then you better have a good reason for enabling that feature by default," Howard said.

      The goal is to make an everyday user's computer secure by default, he said. "Not everyone needs IIS (Microsoft's Web server) by default," he said. "Not everyone uses Index Server by default. So today, those features are turned off by default."

      Quoted from this article [com.com].

      • Except IIS isn't installed by default. Not on a users (i.e. non-server version)

  • MS02-005 cumulative patch (Score:4, Flamebait)

    by jamie ( 78724 ) <jamie@slashdot.org> on Friday February 15, 2002 @02:12PM (#3014318) Journal
    Bruce Schneier wrote in this month's Crypto-Gram, sent out this morning sometime:

    "Anyone remember Scott Culp ... touting how fast Microsoft was at patching problems? There's a new vulnerability in IE that Microsoft is busy ignoring."

    This was the first I'd heard of it, though I've gone to microsoft.com and asked to be put on Microsoft's mailing list for security alerts. About three hours later, the email finally arrived from Microsoft, four days late:

    To: jamie@mccarthy.vg
    Subject: Microsoft Security Bulletin MS02-005
    Date: Fri, 15 Feb 2002 07:33:02 -0800

    Title: 11 February 2002 Cumulative Patch for Internet Explorer
    Date: 11 February 2002
    Software: Internet Explorer
    Impact: Run Code of Attacker's Choice
    Max Risk: Critical
    Bulletin: MS02-005

    This is a cumulative patch that, when installed, eliminates all previously discussed security vulnerabilities affecting IE 5.01, 5.5 and IE 6. In addition, it eliminates the following six newly discovered vulnerabilities...

    What Microsoft didn't mention was that, before I got its security alert, someone had posted to bugtraq this assessment of their patch:

    From: Thor Larholm <Thor @ (no spam) jubii . dk>
    To: "'bugtraq@securityfocus.com'" Subject: Update on the MS02-005 patch, holes still remain
    Date: Tue, 12 Feb 2002 15:25:11 +0100

    ...2 critical vulnerabilities are still remaining.

    1. codebase localpath
    Allows execution of arbitrary commands.
    Publicly known since January 10th 2002.
    Severity: Critical.

    2. XMLHTTP
    Allows reading of local files.
    Publicly known since December 15th 2001.
    Severity: Critical for homeusers.

  • 'Trustworth Computing' and Microsoft in the same sentece is an oxymoron.

    That said it is much easier to innovate wihtout regard to security even at a basic level, MS has been doing just this for quite sometime, and it looks like it may finally be catching up to bite em in the ass.

    MS has made great strides in interface usablitiy, and some disasters, some minor security annoyance, and some bungles of a scale unseen before. Quantity, not Quality has been the MS creed for a long while, blowind the doors off their prior interface and capablities of 3.1 to win95 was a major leap, and they ran like a thief with it.

    Its easy to innovate and produce LOTS of stuff fast if security isnt a concer, unfortunatley for MS that mindset became standard at MS, Bill's Memo is proof in itself,
    • You saying that they code the way you spell?

      I remember when we said the same thing about their commitment to the web. "But IE 2 sux!, they'll never be serious about it!" When MS decides something is Important, watch out.

      • Knowing Microsoft, the approach they will take to "get serious" about security will mirror their previous approaches when they decide they need some new technology. It will likely play out as follows:

        1) Purchase a technology leader in security. (Maybe RSA. Hey, maybe Schneier's outfit!)

        2) Cannibalize their product and incorporate it into Windows.

        3) Screw it up royally.

  • Text only e-mail (Score:2, Insightful)

    by Anonymous Coward
    From the article :
    "Originally, e-mail was text only, and e-mail viruses were impossible. Microsoft changed that by having its mail clients automatically execute commands embedded in e-mail. This paved the way for e-mail viruses, like Melissa and LoveBug, that automatically spread to people in the victims' address books. Microsoft must reverse the security damage by removing this functionality from its e-mail clients and many other of its products. "

    Amen. Give me pine anyday and get rid of the crappy HTML formatted e-mails with pics and crud, If I want to see that send me a link to a web page and I'll look at it if I feel like it. Don't send me huge bloated e-mails that look like shite when I read em on pine.

    • Re:Text only e-mail (Score:2, Insightful)

      by xtstrike ( 538546 )
      here here - im all for that, RTF is the way to go, I cant stand it when i get an e-mail and have to spend 20 seconds opening it because its SPAM and is downloading most of its advertisement from the internet. Ive not once had a piece of useful html e-mail and I doubt I ever will!!
    • "Originally, e-mail was text only, and e-mail viruses were impossible."

      shame it's not true
      Buffer overflow in MS Outlook & Outlook Express Email clients (Date parsing) [iss.net]
    • Pine can view html natively these days... sorry to burst your bubble :[

    • Re:Text only e-mail (Score:4, Interesting)

      by MarkusQ ( 450076 ) on Friday February 15, 2002 @04:35PM (#3015012) Journal
      "Originally, e-mail was text only, and e-mail viruses were impossible."... Amen. Give me pine anyday

      Back in the text-only e-mail days I was quite confident in telling to my users "text e-mail can't hurt you"...until a friend at a neighboring site (uucp) showed me what they'd found: An e-mail that ended with embedded escape sequences to program a key with a long string of commands, clear the screen, and then the something like "Mail file corrupted--press (whatever the key was) to continue."

      The commands, which went back to the mail reader (or would have, if the user had followed the directions) would then 1) write the body of the message to a file, 2) exit the mail reader, 3) compile the source code it just saved, and 4) run the program.

      There were a few bugs in the creature, so it hadn't worked as intended, but from then on I wasn't so sure about things being safe just because I couldn't see how to exploit them.

      -- MarkusQ

      • An e-mail that ended with embedded escape sequences to program a key with a long string of commands, clear the screen, and then the something like "Mail file corrupted--press (whatever the key was) to continue."

        The commands, which went back to the mail reader (or would have, if the user had followed the directions) would then 1) write the body of the message to a file, 2) exit the mail reader, 3) compile the source code it just saved, and 4) run the program.

        Then the e-mail reader was not treating the e-mail as plain text. If the only escape sequences it recognizes are end of message and start of attachment, the only thing that can hurt you is the attachment -- if you are dumb enough to run an executable attachment.
        • Then the e-mail reader was not treating the e-mail as plain text. If the only escape sequences it recognizes are end of message and start of attachment, the only thing that can hurt you is the attachment -- if you are dumb enough to run an executable attachment.

          That had been roughly my thinking as well. But the point is that the e-mail reader (either pine or elm, IIRC) was just treating the body as plain text, and happily dumping it (escapes and all) to the terminal.

          The terminal (VT100 or some such [databeast.com]) was seeing the escape sequence and obligingly reprogramming the specified key to do the dastardly deed. Then it would just as obligingly clear the screen, so that all the user saw was the message telling them to hit the booby-trapped key.

          The mail reader was oblivious to all of this.

          -- MarkusQ

          • This was known as an "ANSI bomb". It could only happen if the user had ANSI loaded in DOS, and IIRC then only a version of ANSI that allowed itself to be reset by such sequences (such as the default ANSI.SYS that shipped with M$DOS). Which is why a lot of people used 3rd party versions of ANSI.COM/.SYS, such as ZANSI, NANSI, etc. which were not vulnerable to this trick.

            I still use a textmode email program that dates back to the BBS-messaging era, and it's immune because it doesn't do ANSI at all. (It says it does, but it doesn't.) It sees ESC sequences as raw text, so does nothing.

            Telnet apps that grok ANSI may still be vulnerable to this trick -- dunno for sure, but it's a thought.
            • Ummm... So Microsoft built vulnerabilities into DOS too...
            • This was known as an "ANSI bomb". It could only happen if the user had ANSI loaded in DOS, and IIRC then only a version of ANSI that allowed itself to be reset by such sequences (such as the default ANSI.SYS that shipped with M$DOS).

              How odd. *smile* Given all her talk about VT-xxx terminals, pine/elm, and scads of users on each box, I would never have guessed that my friend's site was running MsDos.

              -- MarkusQ

              • [laughing]

                [Walter Brennan] You young'uns just ain't old enough to remember BBSing. Terminal apps emulating VT-xxx, textmode mail, and scads of users on every box. [/Walter Brennan]

                But AFAIK there's no rule that the same basic principle couldn't be applied to ANY vulnerable system that speaks ESC sequences, which I gather come from way back in prehistoric times when we carved our PCs out of wood. :)

                • MQR: How odd. *smile* Given all her talk about VT-xxx terminals, pine/elm, and scads of users on each box, I would never have guessed that my friend's site was running MsDos.

                  Reziac::ARealMcCoy: You young'uns just ain't old enough to remember BBSing. Terminal apps emulating VT-xxx, textmode mail, and scads of users on every box.

                  *laugh* Ah, now you'd be talking about my site. But I don't think I ever had more than a half dozen or so users on a PC at once (dial up that is--on site we had about thirty, but each had their own PC & pooled "connections" for file transfer).

                  BTW, thanks; I haven't been called a "young'un" for...well let's just say it's been quite some time. Our first dial-up box was a NorthStar Advantage that could only support two remote users at a time (plus one sitting at it).

                  -- MarkusQ

                  • Funny you should mention that -- I'd swear I saw a Northstar manual go by when I was reshelving the media-and-paper part of The Infamous Computer Closet (where old computer stuff goes to die :)

                    [goes to look] I did, I did, I DID see a NorthStar System Software Manual, revision 2.1, copyright 1979, 1980. Calls the OS "Northstar DOS v2" tho it looks more like interpreted BASIC to me. Used a whopping 3.25kb of RAM. Such bloat!

                    Now where did I stash the punch cards from my high school's IBM-1620? :)

  • It sounds like (Score:2, Insightful)

    by JonWan ( 456212 )
    he's asking Microsoft to undo most of their desktop / system intergration. Isn't all that intergration what the general public likes about Windows(tm)? I don't see this happening, they will just patch around or disable by default all / most of the problem areas.

  • very good read (Score:2, Interesting)

    by RembrandtX ( 240864 )
    The trick is, as the author points out ... how honest are they being ? Is this a dog & pony show ? or do they REALLY mean to change the way they work.

    Almost all the concepts presented were ones I learned in college [I graduated a few years before windows 95 came out .. and almost all my programming experience was on a mainframe.] It was considered a basic concept of design to keep your data abstract from your code ..

    of course .. it wasn't as simple as clicking 'view source' back then either *grin*

    As much as I love *NIX for a server environmet, I have to say .. M$ is still got everyone [cept apple .. but i dont have one] beat in the 'average american' user market.

    I always use the "My Mom" theory when determining if something is easy to use. My mom is almost 80 years old .. and cant program her VCR .. but if she can figure out how to use AOLIM for instance, then its probally safe to say its easy.

    Windows passes the My Mom test .. and that would be great .. if it wasn't so easy to break. every time it breaks .. the 3rd tier tech support guru's at microsoft tell her to re-install the software. Not exactly instilling confidence that they know what the hell they are talking about.

    If M$ can get actually accomplish even these seven steps, they honestly ..will become a much better product.

    The real telling point would be , if they had to evolve far enough to MAKE these changes, would they grow up as a company ?

  • what we're forgetting... (Score:2, Interesting)

    by Hooya ( 518216 )
    is that MS is a corporation. in the business for making money. and anything that doesn't make money is a loss. for the longest time security was something behind the scenes and never a 'feature' that would generate any money. that hasn't changed. what has changed is that with more and more bad press MS has been getting for insecure software, 'security' has started to cost them money. people use MS software but rarely trust it. that's the only reason why they're interested in 'security'. for people to buy into .NET in all it's different interpretations people need to be able to trust it with their personal info (passport comes to mind.) without this trust, .NET would == .NOT. notice the careful use of the word 'trustworthy computing' by mister gates -- not 'secure software' or 'bulletproof agains all eveldoers' but 'trustworthy computing'. what he is doing is lining up a PR campaign to promote .NET. nothing more nothing less. it has nothing to do with a secure operating system. it has to do with a 'trustworthy computing' ala .NET.
    • is that MS is a corporation. in the business for making money

      I think most of us do realize this. But really, M$ is a very greedy and childish entity that has, to this date, followed through on only a very few of their promises, no matter how bad it may be for them. The Cryptogram article outlines a few things they'll have to do to become more 'Trustworthy', points out that many of them are fundamentally against the grain of M$'s behavior thus far, and then proceeds to ask, "Will they actually do this?". Placing release dates ahead of product completion, creeping featuritis, claiming that their bugs are their own concern and the world had better shut up about them. These are all things that they have continually done in the past and are well known to be extremely naughty, yet despite the multitude of spotlights on their actions and the sheer dependence of so many people on their software, they ignored all suggestions to do otherwise. Will they start using some well proven secure programming techniques or instead try to 'Embrace and Extend' them, blazing a bold new Public Relations trail into the world of security, in the process dooming themselves and the precious data of millions before they are given up as a bad job?

      Stay tuned, updates at eleven...

  • Analysis Is Good (Score:3, Interesting)

    by EXTomar ( 78739 ) on Friday February 15, 2002 @02:26PM (#3014388)
    Everything in the article is sounds advice for security minded software and not just for Microsoft. Seperation of "data" and "code". Seperation of "package" and "protocol". Extra software is bad. Etc.etc.etc.etc.

    The overwhelming point is that this stuff is often contrary to what MS has in mind for its future software development. If they are really serious about putting security 1st in .Net then they have the embrace the possibility they'll have to delay releasing it. How many are willing to believe MS will do this?

    When it comes to business vs design decisions, MS has always gone for biz.

    • Re:Analysis Is Good (Score:2, Insightful)

      by makapuf ( 412290 )
      except that Code is SOME form of data : either through a security hole or a kindof scripting function.

      API access from untrusted code is maybe a more useful thing to be taken care about (read : animated gifs ARE code, but limited to ... uh ... displaying images at a certain time)

    • Re:Analysis Is Good (Score:3, Interesting)

      by astrashe ( 7452 )
      "When it comes to business vs design decisions, MS has always gone for biz."

      That's true, and I think that a lot of these security holes are a direct result of MS making bad design decisions for technical reasons.

      They're not stupid -- they know that "leveraging" one product by including hooks for another creates security problems, but they know it also creates business opportunities. That's they they did it.

      But I also think we're seeing a realization from MS that they're going to take some hits on the business side if they don't address security concerns.

      The question that Schnier rasies, implicitly, is this:

      How much disruption of their current business strategies is MS willing to tolerate for the sake of security?

      In the end, I suspect it will come down to a cost benefit analysis. Let's hope the numbers come down on the side of security.

  • Where to start. (Score:5, Insightful)

    by Matey-O ( 518004 ) <michaeljohnmiller@mSPAMsSPAMnSPAM.com> on Friday February 15, 2002 @02:35PM (#3014432) Homepage Journal

    Hoo boy, this is a good article, but these guys are spending waaay too much time in a vacuum.

    Microsoft is already moving towards signing code files. While we recommend that Microsoft continue this practice, we also recommend that Microsoft not rely on code signing for security. Signed code does not equal trustworthy code, something the security community graphically demonstrated through the many ActiveX vulnerabilities. Microsoft should drop the code-signing security paradigm in favor of the sandbox paradigm.

    While that's nice and all, it's hard for an operating system to do operating system things from within a sandbox, and with the single exception of a guy getting a Verisign key with the name Microsoft on it (nominally a Verisign problem, not a Microsoft Problem) I haven't seen a problem lately with microsoft signed code.

    All other Microsoft features should be evaluated for resilience. Those that are too risky should be removed until they can be rewritten and secured.

    The NonM$ loving folks will LOVE that soundbite, unfortunately, it's got all the likelihood of happening as having everybody shift from IIS to Apache. In any production environment, security is balanced havily with cost of implementation. NO company with any amount of entrenched custom code is going to pitch it because a security guy say they oughta. The fact that you cannot overwrite a system DLL in XP seems to be ignored. (There's a Key library, a backup directory of DLL's and the DLL in the system folder, if any of those are mucked with, the OS reacts trying to restore a safe version of the DLL, if a safe version isn't available, it prompts for a CD.)

    We recommend that Microsoft add strong auditing capabilities to all products, both operating systems and applications software. We recommend that Microsoft provide configuration tools along with its operating system, as well as tools for an IT department to manage the configurations of its computers.

    Granular auditing exists now! The problem with enhanced auditing is the storage requirements for that auditing. I get 'the application log is full' messages NOW, what happens when every bit written generates five bits of log? Are YOU going to have a Terabyte server to store 200 mb of data and 800 mb of granular logs?

    We recommend that all protocols and interfaces used in Microsoft software be immediately published, and a one-year moratorium be placed on all non-security modifications to those protocols. We also recommend that Microsoft publish any new protocols or interfaces at least one year before implementing them in products.

    Microsoft's been in bed for YEARS with the W3C. The protocols are generated there, and Microsoft is often the first to market to implement them. Asking them to hold off a year before using a new protocol is business suicide and not something they'll be willing to do.

    • Re:Where to start. (Score:2, Insightful)

      by alecto ( 42429 )
      And do we really want our operating systems to refuse to run code not signed by Microsoft or an "approved" vendor?

      How could this train not eventually lead to that?

    • Re:Where to start. (Score:2, Interesting)

      by Rydia ( 556444 )
      You forget that MS is saying they want to up security. The author is just providing a list of what they need to do. "Oh no, they won't like that because it would cost money!" is stupid, because if they're serious about making security top priority, they're should expect to take the profit cuts associated with making secure software. And MS in bed with W3C, MS came in and told them that they were going to do things MS's way, and made thier own standard. W3C got fucked over by MS.
      • Ah, but the standard was Documented.

        In retrospect, I also don't think the big issue is with the OS...it's pretty secure. When needs to be changed are the things that software is allowed to do with the OS. (Like inserting itself in the RunOnce and OnStart registry keys.)

    • Re:Where to start. (Score:5, Interesting)

      by ILikeRed ( 141848 ) on Friday February 15, 2002 @03:31PM (#3014712) Journal
      Matey-O:
      I haven't seen a problem lately with microsoft signed code.

      Lately is a poor excuse to keep a bad idea....

      The NonM$ loving folks will LOVE that soundbite, unfortunately, it's got all the likelihood of happening as having everybody shift from IIS to Apache. In any production environment, security is balanced havily with cost of implementation. NO company with any amount of entrenched custom code is going to pitch it because a security guy say they oughta.

      No, but with Gartner telling them to pitch IIS also, it seems MicroSoft was worried enough to at least make a press release....

      Granular auditing exists now! The problem with enhanced auditing is the storage requirements for that auditing. I get 'the application log is full' messages NOW, what happens when every bit written generates five bits of log? Are YOU going to have a Terabyte server to store 200 mb of data and 800 mb of granular logs?

      You REALLY don't understand granular auditing do you? You only turn it on when investigating a problem, or preforming an audit... it seems to work really well in *NIX systems. And since when does 200mb + 800mb equal a Terabyte. What kind of systems do you think people put Linux on????

      Microsoft's been in bed for YEARS with the W3C. The protocols are generated there, and Microsoft is often the first to market to implement them. Asking them to hold off a year before using a new protocol is business suicide and not something they'll be willing to do.

      The author was speaking of more than just internet protocols, but you did sum up the article pretty well in your last sentence. MicroSoft has made a public commitment for security. To follow thru will take more of a financial commitment then just offering employee bonuses, and it seems that both you and the author agree that it is highly unlikely that MicroSoft will follow thru on their pledge.

  • Be careful what you ask for (Score:5, Insightful)

    by sulli ( 195030 ) on Friday February 15, 2002 @02:46PM (#3014482) Journal
    Also give credit to the increasingly loud calls for software liability. More and more experts and industry groups and advisory panels are supporting the notion that software be held to the same liability rules as any other consumer product. It makes no sense that Firestone can produce a tire with a systemic flaw and be liable, while Microsoft can produce an operating system with a new systemic flaw discovered every week and not be liable. I think Gates sees this liability juggernaut on the horizon, and is doing his best to dodge it.

    Software liability would be a disaster for free software, right? Okay, everyone wants Microsoft to have to pay for Nimda/CodeRed/Melissa/ILOVEYOU, but I don't suspect that the authors of Sourceforge (for example) would want to be liable for someone losing his code due to a buffer overflow. Schneier is right on many things, but he is 100% wrong on this one.

    • If it'll make you feel better, everyone on sourceforge can offer a money-back guarrantee. :)

      I think that's the most you'll ever see in terms of liability. "If this software doesn't do what it's supposed to, can I return it and get a full refund?"

      You think that the makers of space heaters are getting sued? After all, place a space heater near some curtains and you'll burn down your house.

      Of course not.. they slap a warning sticker on the box and they've covered their ass. Slap a warning sticker on software... "This software is presented AS-IS", and you're fine (yes, even Microsoft)

      But money-back guarrantees if the software fails to perform as advertised could be a more common occurrance (even if the company doesn't provide a money back guarrantee, you may be entitled to one in the future).
      • if the software fails to perform as advertised
        Most OSS performs better than advertised. Even without recourse to the sources.
        Typing redhat.com/errata in my browser (IE on NT) takes me where I want to go. I'm sure a bunch of other guesses would also work. Other than something willful and malicious, which would be rather hard to escape notice and a very fast fix, I'd say they were off the hook for whatever the system would do. The've done more than just take reasonable precautions. Anything that surfaces later is readily accessable to someone who doesn't really even know where to start.

    • There's a sort of implicit warranty whenever you sell something: namely, you're warranting that it's useful for a particular purpose (said purpose being one that you, the seller, reasonably believe the buyer intends). If I sell you a car and I neglect to tell you that it'll blow up spectacularly if you happen to turn the engine over before fastening your seatbelt, well, that car's not fit to drive--hence, I (the seller) am in a whole stewpot full of trouble.

      When you purchase software, there's an automatic warranty involved. Namely, that the software doesn't suck. That it's not going to be an open invitation to haX0rs. That using it isn't going to expose you to enormous risk, unless the seller has first advised you of specific enormous risk and you choose to buy it anyway.

      When you license software... well, that's not a sale, is it? And hence, the legal protections that you get when you buy things don't apply to you. I can count on one hand and have fingers leftover all the times I've seen shoddy software be held accountable in court.

      So this push to software-liability law is more of a push to make software a sold good, not a licensed one. The theory being, if I plunk down $200 for Windows XP, it shouldn't have a UPnP back-door in it. Software-liability laws would permit affected users to sue manufacturers to recover lost damages.

      However, common law says that if you pay a nickel for something and it breaks, you can't make twenty million bucks off a lawsuit over it. Twenty bucks, maybe, twenty million, no way. There is an implicit limitation on the assumption of risk, and this implicit limitation is related to the price paid.

      If I pay Red Hat $50 for Red Hat Linux and there's a horrible bug that makes my Linux box an inviting target for 1337 haX0rz, then Red Hat's liability is a factor of the $50 I paid them.

      If I pay you $0 for a piece of GPLed software you wrote, and there's a horrible bug, your liability is a factor of the $0 I paid you.

      Err... wait. I didn't pay you. I got something for nothing--I literally received a good at no price whatsoever above the price of media. The courts would not look favorably upon me suing you for $20 million because you gave me something, for free, out of the goodness of your heart, and made it clear to me that it was a work in progress and might not work as I expect it to.
  • One would think that wanted to put solid security into a product would not be an act of "marketing spin" or " profit ", but as an act of "pride". It make me wonder if M$ has lost that important development value... Maybe that is what keeps opensource alive...the ideal of creating something truly useful and something of a high quality...

    just some thoughts..

    --rpr

  • Wait a minute.... (Score:3, Interesting)

    by pos ( 59949 ) on Friday February 15, 2002 @02:47PM (#3014492)
    Microsoft is going to have to say things like: "We're going to put the entire .NET initiative on hold, probably for years, while we work the security problems out."

    First of all.... Microsoft said they were going to prioritize security. That doesn't necessarily mean put all new features on hold until they are 100% secure. You can make security a priority without doing the OpenBSD nothing but security route.

    Analysts like Gartner have recommended that enterprises switch away from Microsoft IIS and delay installing Windows XP, both because of security concerns.

    I would like to point out that the precipitating reason they changed their recommendation was due to MS's new licensing policy. Security problems are just more fuel to the fire.

    MS's security policies annoys the hell out of me but lets at least hold our points to realistic ones.

    -pos

  • Security through Monopoly (Score:5, Insightful)

    by stevenj ( 9583 ) <stevenj@@@alum...mit...edu> on Friday February 15, 2002 @02:51PM (#3014512) Homepage
    A point that doesn't seem to be raised much, but which I think requires the vigilance of consumers, is that Microsoft may use "security" as an excuse to further entrench its monopoly.
    • Want to install a non-Microsoft program?
    • Send an attachment in an open format (as opposed to MS Office)?
    • Buy something from a website that doesn't use Passport?

    You'll get:

    Warning: this program/file/site is INSECURE and may contain a virus. We recommend consulting two programmers, a lawyer, and a priest before opening it.

    Of course, Microsoft won't make it too hard to have third-party software (as long as it doesn't compete with Office). You'll just have to pay a small fee for a MS-certified crypto signature. (Oops, free software can't pay the fee? Gee.)

  • New OS (Score:2, Interesting)

    by whovian ( 107062 )
    REDMOND, WA - Today in a press conference Microsoft Corp. unveiled the
    latest version of its Windows operating system, Windows(R)
    XPSecure(TM) "It is the easiest to use and most secure version of
    Windows ever to be released," touted the former chairman Bill Gates.
    At the press conference the company performed a live installation of
    XPSecure(TM) to demonstrate the simplicity of installation. "Our
    customers have let us know that security is a foremost concern," said
    Gates. "We have listened to their concerns, and we have designed our
    software to fully and securely reinstall their favorite operating
    system." Windows(R) XPSecure(TM) also features a Secure Live
    Update(TM) option that will automatically connect customers' computers
    to the internet to download late-breaking security updates. "We
    realize there is much confusion out there about which security
    features are truly secure. We have taken care of that with our
    customers in mind," Gates continued. Windows(R) XPSecure(TM) is
    scheduled to retail at $249.99 and is expected to begin to ship to
    vendors in North America as early as next week. "We highly recommend
    that customers of any previous version of Microsoft(R) Windows(R)
    install this version to obtain an unprecedented level of user
    experience in performance and reliability."

  • Oracle's "Unbreakable" Database (Score:4, Interesting)

    by Punchinello ( 303093 ) on Friday February 15, 2002 @03:10PM (#3014607)
    Semi-off-topic?

    An equally interesting article in Mr. Schneier's newsletter this month concerns Oracle's "Unbreakable" Database.

    It seems Oracle put forth a good faith (albeit flawed) effort to secure Oracle9i. They enlisted the services of TCSEC, ITSEC, Common Criteria, Russian Criteria, and FIPS
    140-1 to test for security holes. None of them detected a simple buffer overflow problem.

    These security companies are a sham (or at least should be ashamed).
  • MS is in a very hard position.

    They've already gotten a reputation for putting security and stability last. New features, fluff always come first. Virtually everyone knows that MS lives by marketing, marketing, marketing.

    Now MS realizes that Security is becoming "the issue." "It's the security stupid."

    Now consider the difficulites.

    MS has an enormous codebase to now fix - after the fact. Adding in security is WAY hard after the fact. Things break, testing must be redone etc. It's a whole lot easier to put in anything if it was part of the origional design. Super costly and painful afterward.

    MS has "integrated" all of its' products. So, now they have to not only test the separate products, but also in every combination. Ouch!

    From Firewalls and Internet Security (the God book of security IMHO)
    - All programs are bugy
    - Large programs are even buggier than their size would indicate.
    - If you do not run a program, it does not matter whether or not it is buggy.
    - Exposed machines should run as few programs as possible; the ones that are run should be as small as possible.

    Now MS has what most would consider code bloat, and not only that integration. That's going to be an ugly task (securing the code)

    MS has always fudged the truth before. Marketing before substance. So people will be very skeptical about MS's claims about anything.

    MS's stance about security was always lax. Combine this with the prior point, and we have skeptical^2.

    MS can't really use this as a marketing tool - or at least not until they can prove they've done something significant. This will be hampered by points 1 + 2, and continuing security lapses, when trying to secure that code and missing things.

    MS can't really make money off security - again, at least not until it has serious results to show. Thus this will become a massive cost center without any revenue. Ouch^2. That will have the bean-counters breathing down the throats of the development/QA people to keep costs down. You're not producing new products, and thus revenue - salary will suffer etc.

    Lastly, it will be a unglamorous job, and project. It will be hard work. You'll be unappreciated. You'll be expected to be a miricle worker, and double quick too. When you miss something, you'll get lots of heat, and few kudo's (Provided this _really_ _is_ somthing MS is _really_ serious about - if not the heat won't be there, but that's the point.)

    Thus, to summarize.

    - MS has a MASSIVE task to fix - both in size and complexity.

    - MS has integrated all these things together. I would bet that the mutual distrust model between different modules/products hasn't been used, adding to the difficulty/complexity.

    - MS has a reputation for producing fluffy software with lots of features, but not much security - it's always an afterthought. Ship early fix bugs later.

    - MS has never been known for its' honesty and plain talk, thus making the credibiltiy of its' proclaimation that much more doubtful.

    - This strategy won't be done quick, or cheap. The task will be difficult both technically and politically.

    - MS won't be able to milk this decision for extra revenue anytime soon.

    - The very fact that this effort exists, tends to point out a problem in the first place.

    My conclusions are these.
    MS may really intend to do this. I don't really believe it, but I'll give them the benefit of the doubt. But even if they are committed, how long will they remain committed. They won't be able to show results for some time. They will certainly have failures. These will undermine the confidence of both internal staff, and the public they're "selling" it to. It will cost a massive amount. It won't generate revenue.

    It's going to be really easy to just splash it out there, and crow about it. Later, when the trench warfare sets in, it's going to be tempting to forget about it. It's out of the limelight, and we can just let it go quietly into the night.

    We'll see - I don't doubt that MS _could_ do it. I just don't think they will for many reasons. And there will be _so many reasons_ no to.

    Cheers!

  • no need to rewrite everything (Score:3, Informative)

    by AdamBa ( 64128 ) on Friday February 15, 2002 @04:13PM (#3014899) Homepage
    Schneier writes:

    "Security works best when it's designed into the system from the beginning, so a lot of what they've already done is going to have to be rewritten."

    This is false. XP, based on NT, has security built in. The vulnerabilities discovered so far basically seem to be in two camps:

    1) Buffer overflows left in the code -- rewriting won't help these, it will likely just introduce more. They just need to be found and fixed. Microsoft is in fact going over all its code line-by-line, but I can't imagine that glassy-eyed developers spending a month doing that is actually going to find all the overflows.

    2) Bad design, in particular allowing foreign code to execute. I.e. the various Outlook email viruses. These need to be removed, which is a basic change in how Microsoft thinks (security over nifty features) but again you don't need to rewrite Outlook to stop if from executing scripts by default.

    Methinks Schneier might be fantasizing a bit about Microsoft *having* to do this, of saying, as he puts it, "We're going to put the entire .NET initiative on hold, probably for years, while we work the security problems out." It seems like he would like to see Microsoft fall behind in the market because they have to throw all their current code away. Plus he hates SOAP (since it sneaks past firewalls inside HTTP), which is one of the technologies .NET is based on.

    Personally I think this is basically more marketing hype from Microsoft. Because they are still not going to penalize developers who write insecure code (something that was bandied about but not adopted) -- it will still be, "Oops, we did it again". So with no real connection between good code and stock options, developers at Microsoft won't change.

    - adam

    • This is false. XP, based on NT, has security built in.

      Eh, not quite. Did you read all of the article?

      One of the big issues I have with Windoze is that it's not easy to disable and remove the parts I don't want, which is what Bruce talks about.

      On a server connected to the Internet, I'd want to remove anything that's not strictly needed for running the application, like the web browser. Microsoft's attitude is: "Opps, sorry, that's part of the OS now, live with it." However, with other operating systems, I do have a choice.

      Sure, you can argue that I'm being paranoid, and what possible harm could come from having some extra software installed. Maybe you're right. And maybe some dumbass junior admin (that I didn't get a chance to interview) needs to surf the web to look up an answer while he's putzing with the server. Maybe because there's a browser (which can't be gotten rid of) on the red-zone server, and he uses that, rather than the one on his desktop computer. Maybe the security permissions are still the default (lax), and he downloads a virus or worm. Maybe it infects the system, because he was logged in as Administrator.

      And if there's no browser on the red-zone server, he'd haul his lazy ass back to his desk to look up the answer, thus preventing, or at least containing, a whole host of problems.

      As for SOAP, from a network administrator's point of view, it's easy to hate it, seeing as how it was expressly designed to evade the firewall. If someone's got a new RMI protocol, I should damn well be able to easily block it, if that's the policy.

      Now with SOAP, instead of simply blocking a port, which just about any stupid firewall can do, you need a firewall that can look inside HTTP requests to see which ones are from browsers, and which ones are SOAP requests. More processing power, and therefore less throughput on the firewall. And probably a more expensive firewall to boot.

      Wearing my enterprise application developer hat, I think SOAP is pretty cool. Wearing my network administrator hat, I would like to kick in the nuts of whoever thought it up.

      Yes, I realize that I'm paranoid, it comes with the job. If you don't believe me now, check back with me in 5 years. If you last that long.

  • Propally mentioned before but this site is still up. Go to www.trustworthycomputing.com [trustworthycomputing.com] and you get redirected to a google search results listing the thousands of articles on Microsft's history of security breaches.

    Mean while, Microsoft has started a public marketing campagn and even plans to have .net set to secure by default [theregister.co.uk] but it will be an uphill battle for them. Today at the same time as secure by default came out there was another story about another vulnerability in Outlook Express [theregister.co.uk]
  • If Microsoft truly means what they say, and that they really are going to try to develop products and services that are "available, reliable, and secure", then this is a Good Thing. But, in order for them to achieve "Trustworthy Computing" (something that various other people already do, IMHO), it seems to me that Microsoft needs to do two things:
    *) develop trustworthy products and services
    *) become a trustworthy company

    And that will be no easy task. I agree that security in their products is something that they need to improve, but I think becoming trustworthy will require much more than that. If I were to describe all of the things that I think Microsoft needs to do to accomplish these things, I'd be here all day. So, I'll describe only a few examples not related to security.

    1) Improve the quality of their products. In my current job, I have the singular pleasure of developing applications in MS Access 2000. Unfortunately, the documentation provided with the software is poorly indexed, incomplete and (in some cases) inaccurate. For example, in one place in the documentation, it claims that the maximum number of levels of nested forms allowed is 3. Elsewhere it claims the limit is 10. Both are wrong. It's difficult to trust software when its own documentation is incorrect. This doesn't mean that their products have to be perfect. But right now, it often feels like they're not even trying.

    2) Abandon the new licensing strategy [slashdot.org], which essentially dictates when companies need to upgrade their software. Having to go through a massive upgrade because of licensing is no different than having to go through a massive upgrade because of a bug or security vulnerability. The end result is the same, and I do not consider such software to be "available" or "reliable".

    3) Adopt more ethical business practices. A number of the comments posted here speculate on what Microsoft true motives are. Given MS's history of Machiavellian business practices, it's not surprising that people don't believe Microsoft, even if they are telling the truth. And I'm one of those people. I tend to believe the adage that you can't build a straight house with crooked boards. So, if Microsoft really wants to promote trustworthy computing, then they must become a trustworthy company first.

    Some folk have noted that the General Public's view of MS is much different than the average /.er, and possibly the average techie in general. However, I don't believe that this changes what MS needs to do to be trustworthy. On the other hand, if MS is only interested in looking trustworthy (rather than being trustworthy), then that's a different story.

    Anyway, if MS is serious about this new directive, then good for them (and it's about time!). But I'll believe it when I see it (and maybe not even then).

    </soapbox>

    -- D

Slashdot Top Deals

The hardest part of climbing the ladder of success is getting through the crowd at the bottom.

Close