Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Microsoft Security

Ballmer Touts Focus on Security 322

Posted by michael from the read-his-lips-no-new-remote-root-holes dept.
kevinvee writes "Microsoft's Steve Ballmer announced a renewed focus on security at the Worldwide Partner Conference yesterday. He recognizes the fatal user flaw of not applying patches and introduced an educational plan to help correct this. Also included in his statement was a response about computer researchers who publish flaws in Microsoft products, 'I wish those people just would be quiet.' The end of the article gives unbiased coverage of some people's opinions about the latest announcement."
This discussion has been archived. No new comments can be posted.

Ballmer Touts Focus on Security More

Ballmer Touts Focus on Security

Comments Filter:
  • Then they wouldn't have to spend so much time fighting security holes!

    • "I wish those people just would be quiet," he said of computer researchers who publish vulnerabilities in Microsoft's products. "It would be best for the world. That's not going to happen, so we have to work in the right fashion with these security researchers."

      They want to educate people but do not want the people who really know to talk about it? This seems a bit paternalistic even for microsoft. They want to be the ones who work with people to make updates but do not want anybody else to have a voi

    • I wish they would not have to talk that much
    • "Microsoft sent me a patch in my email yesterday, and after I installed it it ate my antivirus and made my whole computer work bad."
      ---My mother-in-law, after meeting our friend Swen.

      Oh yea, what a good idea. Lets get people used to clicking on things that say patch. How about just teaching them to be responsible users instead of feeding them this crap that if only they install all patches, everything will be fine.
    • "One is frightened of what's around the next corner with Microsoft," he said. "You wake up the next day and suddenly something isn't working."

      Hahahaha!

  • we'll focus on security .. this time we mean it! (Score:5, Insightful)

    by Anonymous Coward on Friday October 10, 2003 @04:45PM (#7185776)

    He recognizes the fatal user flaw of not applying patches and introduced an educational plan to help correct this. Also included in his statement was a response about computer researchers who publish flaws in Microsoft products, 'I wish those people just would be quiet.' The end of the article gives unbiased coverage of some people's opinions about the latest announcement."

    Yeah, and we wish that this gigantic wealthy company would just FIX THEIR SOFTWARE. But it ain't gonna happen.

    I still can't figure out why a company with Microsoft's resources has such mediocre security. They should be blowing Linux and BSD and Mac out of the water with tight default firewalls, statistical intrusion detection, distributed monitoring, sandboxed executables, no executable mail attachments, modular software, and anything else short of palladium. Yet they don't. Why? Because they know if legislation is passed, they will be able to afford it and nobody else will? Because they know they have such a huge lock-in, managers will grumble but renew licenses anyway? What's the deal MS?

    It bugs the hell out of me that they have the audacity to lock us into their products (which work okay most of the time, I'll give you that) yet can't give us the common courtesy to solve these problems. I really don't give a shit if Office 2003 is based on XML or EBCDIC, I just need the computer to be "Secretary-Proof" for at least a week or two after it's turned on. Monthly security updates? Good grief!! How about getting it right the first time!

    Microsoft needs to snap into action ASAP. They need to fix the bugs, do whatever it takes, cut performance by 3/4 and run everything in a virtual machine, I don't care. They need to send out CD's to every single customer who ever made the mistake of buying their product, which looks more like a beta version than a finished program.

    Or.. or.. well, okay you got me. We can't afford to switch from Windows. But it seems we can't afford to stay with it either!

    • Re:we'll focus on security .. this time we mean it (Score:5, Funny)

      by 00420 ( 706558 ) on Friday October 10, 2003 @05:13PM (#7185927)
      We can't afford to switch from Windows

      I know. If only Linux weren't so damn expensive.
      • COMMENT: We can't afford to switch from Windows
        RESPONSE: I know. If only Linux weren't so damn expensive.

        But he mentioned the cost of switching from Windows. Switching to Linux CAN be pretty damn expensive, even if the cost of the OS itself is free.

        'Switching to Linux' is a project, not a product.
    • I still can't figure out why a company with Microsoft's resources has such mediocre security. They should be blowing Linux and BSD and Mac out of the water with tight default firewalls, statistical intrusion detection, distributed monitoring, sandboxed executables, no executable mail attachments, modular software, and anything else short of palladium. Yet they don't. Why?

      There's an analogy in the article which explains this perfectly: "Computer security is almost like car insurance. Nobody wants it unti

      • Besides, how do you explain "statistical intrusion detection" to the average home user who just wants to read e-mail and surf the Web?

        Probably about the same way you explain TCP/IP to the average home user who just wants to read e-mail and surf the web. You don't. That doesn't mean it can't be of use to the user even if he or she doesn't understand it--or probably even knows it exists.

      • Besides, how do you explain "statistical intrusion detection" to the average home user who just wants to read e-mail and surf the Web?

        Dunno. How did they explain to all their users that they had to have anti-virus software running at all times without explaining why? Considering the way people pay for BestBuy extended warranties, Microsoft should have no problem selling security. Hey, they could even charge more for the XP-Secure version.

    • The reason is simple really. Microsoft is a consumer grade software company (trying to outgrow that, with rather iffy results so far)and is thus naturally market driven; and market driving.

      "Consumer demand" (or what they can force the consumer into "demanding")is king. They aren't a technology company at all and claims they make of such are simply part of the marketing.

      Security has no meaning to them other than as an advertisable "feature."

      As such they have made certain decisions regarding the architectu
    • Yeah, and we wish that this gigantic wealthy company would just FIX THEIR SOFTWARE. But it ain't gonna happen Seems to me that their marketshare shows most people find their software acceptable. Not only that, but speaking as a professional expert on MS products, I dont see anything "broke" with it. It is perfectly secure? No. Is anything? No.

      Maybe before you start running your habitually complaining, slashdot party line spewing mouth, you should get your REAL facts straight.

      In fact, yesterday there

    • Re:we'll focus on security .. this time we mean it (Score:4, Insightful)

      by poot_rootbeer ( 188613 ) on Friday October 10, 2003 @06:30PM (#7186375)
      [...] tight default firewalls, statistical intrusion detection, distributed monitoring, sandboxed executables, no executable mail attachments, modular software, and anything else short of palladium. Yet they don't. Why?

      Would implementing any of those things make Microsoft more money than not implementing them? It's all about profit margins. Proactive development cuts into profitability, as does the practice of hiring experienced developers instead of fresh-faced children just out of engineering school who are willing to work twice as hard (although not twice as smart) in exchange for a free mountain bike and occasional use of the game room.

      do whatever it takes, cut performance by 3/4 and run everything in a virtual machine, I don't care.

      You may not, but all the rest of Microsoft's customers do. "Fast but wonky" is all too often perceived as preferable to "slow but bulletproof."

      How about getting it right the first time!
      Microsoft needs to snap into action ASAP.

      You just have all the answers, don't you? Maybe Microsoft should hire a fresh new voice like you to oversee their development efforts.

      Are you willing to work 60hr weeks for $55k and all the free Mountain Dew you can drink?
  • And I would have gotten away with it too, if it weren't for you meddling kids!!!
  • Automatically updated distributed netfilter rules allows systems to automatically block exploitation attempts without requiring any user intervention or a reboot. While this is only a stopgap measure until patches can actually be applied, it virtually eliminates the exploitability of input validation vulnerabilities as soon as they are discovered. Hats off to Microsoft for being the first to truly promote this approach. Let's hope we see others like Sun step up and attempt to do the same.

    • BINGO! (Score:2)

      by gclef ( 96311 )
      Hey, Dave,
      I just won security buzzword Bingo with the parent post. You owe me $20.
    • Automatically updated...

      'Automatically updated' is a fundamentally flawed security hole in itself. What is also flawed is how the MS operating system will execute any file if the name ends with .exe, .bat, or .com.

      • 'Automatically updated' is a fundamentally flawed security hole in itself.

        Obviously the filter rules would be cryptographically signed, so crafting malicious ones would require that you compromise Microsoft's physical security and obtain their private DSA key, or that you compromise the DSA itself. Neither of these are particularly realistic possibilities...

        • Three things Gentoo needs IMHO.
          1. "cryptographically signed" updates, not simple MD5s.
          2. A better way than their silly etc-update script for updating files
          3. A "default", a "security", and a "bugfix" update tag, so I could choose to only have to update ebuilds on my machine when there was a security or bugfix related issue. I mean, if App v2 has a problem until 2.22.53, then I need to update it if I am running anything less, right? If it's just a newer version, I don't want to know about it.
    • Wonderful idea - until a filter rule that "accidently" blocks all access to AOL is distributed.

      If you want to allow MS to take over the internet just let them give everybody a packet filter (as in XP) and then provide automated patches to be applied without user intervention. On that day MS controls access to the internet for 90% of PC users.

  • Its not the computer researchers fault (Score:5, Insightful)

    by samsmithnz ( 702471 ) on Friday October 10, 2003 @04:47PM (#7185789) Homepage
    Its not that the computer researchers who publish the flaws thats a problem, its the fact that the only way they can get Microsofts attention is to publish them!!! How many stories have we read about a 'researcher' finding an issue, and then spending 2 months trying to contact MS, before giving up and posting it in places like this!
    • I agree, things have to be published, unfortunately, for certain companies to get off their asses. Then there's microsoft, who whines and bitches about having to fix published flaws, yet at the same time manages to ignore others. Such as 31 in IE alone [216.239.57.104].

      J

  • Quiet eh.... (Score:2, Interesting)

    by Grey Fox LSU ( 630480 )
    You wish people would not point out your flaws. No one ever likes their flaws being exposed, but it all a part of getting better. As a user, I want to know how insecure my important data is, and what I can do to fix it. MS and SunnComm both need a reality check. It goes something like this: If you fuck up and try to hide, when people notice, there will be hell to pay.

    Next your going to say you dont want people pointing out your obvious personal flaws, just because it might hurt your feeling.

    I swear, i
  • every few weeks one of the execs from Microsoft renews their focus on security...as if it should even expire? i dont feel like digging through old stories but there have been at least 3 in recent memory (
    actions speak louder than words.

  • Interesting Wording (Score:3, Insightful)

    by 31415926535897 ( 702314 ) on Friday October 10, 2003 @04:50PM (#7185806) Journal
    Notice Balmer's statement, 'I wish those people just would be quiet.'

    He's not saying, "Please don't release the findings so that blackhats can't use the exploits."

    He's not even saying, "Please delay telling the public about your findings so that we have a chance to fix the flaws."

    He's saying, "I wish they would be quiet so that we don't have to spend the time/money/manpower to plug our holes. It's not our fault people are exploiting the holes, it's the people who release security reports."

    I know, you're saying that it's obvious a company would want to help it's bottom line, but he didn't even have the decency to make his statement very cryptically.

  • "I really wish they would just shut up." (Score:5, Insightful)

    by Saint Aardvark ( 159009 ) * on Friday October 10, 2003 @04:51PM (#7185811) Homepage Journal
    I wish they didn't have anything to talk about.

  • Me Too... (Score:5, Funny)

    by Fapestniegd ( 34586 ) <{gro.etihwsemaj} {ta} {semaj}> on Friday October 10, 2003 @04:51PM (#7185819) Homepage
    'I wish those people just would be quiet.'

    I wish they would too. There is nothing worse than finding an exploit that gives me total access to any network I want, and then when some other chucklehead finds it, blabs all over the net, and then Network Administrators start locking down the ports I use to run willy-nilly through their network. I would have about another month to own their network before the patch comes out. But noooo, some jerkhead has to cut me off a month early. And I have to find an unknown exploit all over again.

    Maybe I should post anonymously, nah to hell with it.

  • Renewal of another renewal? (Score:3, Interesting)

    by 47Ronin ( 39566 ) <.glenn. .at. .47ronin.com.> on Friday October 10, 2003 @04:52PM (#7185822) Homepage
    Yes this is deja vu.. How many times does Microsoft have to announce that they're refocusing on security. Either they repeatedly forget that security is important (seemingly every other month) or this is typical PR stunt to get critics off their back.

    Sure they'll announce more security measures this month. The PHBs will get comfortable and clueless people will back off. Next month there will be another exploit (guaranteed). Businesses go down, networks get destroyed. PC-using schools are shut down, and Mac/Linux-using schools who aren't affected are ignored by the press. MS puts on the spin that hackers should be treated as terrorists. Clueless journalists blame it all on Windows popularity, rather than lack of a focus on security.

    Then MS annouces once again a renewal on its focus on security.

    Rinse. Repeat.

  • In other news ... (Score:5, Funny)

    by Kombat ( 93720 ) <kevin@swanweddingphotography.com> on Friday October 10, 2003 @04:52PM (#7185824)
    Inside sources at Microsoft have revealed that as part of their effort to focus more on security, the next release of Windows, "Longhorn," will feature a handy "My Viruses" folder, to accompany the popular and mature "My Documents," "My Pictures," and "My Music" folders. Also, the OfficeXP assistant, Clippy, has been enhanced. Users of the next-generation leading desktop OS can look forward to Clippy popping his helpful head up from the corner and exclaiming,

    "It looks like you're writing a virus. Would you like to:
    • Initiate a DDoS attack?
    • Publish a Trojan horse?
    • Install a backdoor?"
  • From the article: Mike Nash...added that employees from across the company had been pulled to work on security efforts. -snip-

    Now is this in addition to the employees pulled from across the company for last year's Secure Windows Initiative? Looks like that didn't work very well. I have equal expectations for this charade.

    ==============

  • 'I wish those people just would be quiet.'


    What you don't know can't hurt you! NOT

  • Let's Compare (Score:2, Interesting)

    by rudy_wayne ( 414635 )
    Windows XP was released a little over 2 years ago.

    Since that time, browsers like Mozilla and Opera have put out many new releases of their programs, each one containing many bug fixes and new features.

    Microsft has released no new versions of Internet Explorer. No new features. No bug fixes.

    The only "improvement" has been a haphazard series of patches, each one only released several months after somebody discovers a major security hole.

    I wish Steve Ballmer would just be quiet.

    • Re:Let's Compare (Score:2, Insightful)

      by los furtive ( 232491 )

      No bug fixes? You ever heard of service packs?

      No new realeases? What about Windows 2003?

      I'm not a big Microsoft fan (hell as I write this reply I'm loading Mandrake 9.1 on my subnotebook), but your comment is patently false.

      • Windows 2003 is a server OS used by few people.

        What version of MSIE ships with Windows 2000 (I don't know). Is it MSIE 7.x or 6.x? Please list some of the new features that are found in the version of MSIE that ships with Windows 2003.

        Not counting patches to fix security holes, please list some of the new features that have been introduced in MSIE -- AFTER the initial release of Windows XP.

      • No bug fixes? You ever heard of service packs?

        No new realeases? What about Windows 2003?

        I'm not a big Microsoft fan (hell as I write this reply I'm loading Mandrake 9.1 on my subnotebook), but your comment is patently false.

        Patently false? Most folks, when keeping up a software product, do a rewrite every once in a while to incorporate those bugfixes and patches. The OP says that since IE has been released, it's gone from what, version 3.1 to 4.0 to 4.1 to 5.0 to 5.5 to 6.0 to 6.1 to 6.1+SP1 or what

  • Because we all know how effective security through obscurity is. If noone publicises the problems, then they don't get fixed, but if one person has found the flaw, you can bet someone else has too, who doesn't have such good intentions.

    Oh, and is Slashdot getting /.ed or is Verisign showing them who's boss?
  • ..is, did Steve Ballmer jump around like a fricking idiot this time screaming "Developers, developers!" while announcing it?

    If not... I don't buy his sincerity...
  • How many times is MS going to announce a "new focus" on security, or something of the sort?

    This is news?
    • How many times is MS going to announce a "new focus" on security, or something of the sort?

      Yes, this is a refreshing change from their trustworthy computing initiative of 2001 which sharply brought security into focus. MS is clearly tackling a new issue now that computers are trustworthy.
  • He recognizes the fatal user flaw of not applying patches and introduced an educational plan to help correct this

    So you're saying you can DIE from this?
  • Wonder how the announcement went... ?

    SECURITY, SECURITY, SECURITY, SECURITY!

    I... Love... This... Company, YEAH!

  • Whatever happened to MicroSoft shutting down all new development, and focusing entirely on security for a month? Didn't they get all the problems fixed them?

    Is this just MicroSoft part II: security refocused? Will the sequel be as good as the original?

    • Whatever happened to MicroSoft shutting down all new development, and focusing entirely on security for a month? Didn't they get all the problems fixed them?

      That was for all the existing code. It's 19 years until the next code review.

  • Ballmer on the defensive as ever, more vaporware developments at Microsoft. If they're so serious about security they would secure existing products through service packs instead of adding these new features to forthcoming products.
  • "Microsoft's Steve Ballmer announced a renewed focus on security at the Worldwide Partner Conference yesterday."

    I always wonder when the higher-up corporate people say things like this.....are they really laughing inside? Or do they honestly BELIEVE it? I mean....god.....it just boggles the mind how he could keep a straight face while saying this.

    Brain.......heating......critical temperature...........WARNING WARNING WARNING......*BOOM*

  • Meanwhile... (Score:3, Informative)

    by An Anonymous Hero ( 443895 ) on Friday October 10, 2003 @05:00PM (#7185870)

    Gartner echoes concerns on Microsoft reliance [com.com]

    A copy of the Gartner research note seen by CNET News.com mirrors the conclusions of seven prominent security researchers, who released a paper stating that Microsoft's dominance in software could have serious consequences for national cybersecurity [com.com]. The Gartner report is scheduled to be published Friday.

    (The point is not what they are saying, it who's saying it.)

  • They still don't get it (Score:3, Informative)

    by evenprime ( 324363 ) on Friday October 10, 2003 @05:01PM (#7185880) Homepage Journal
    Back in 2001, Microsoft's Steve Lipner said that code "Review is boring and time consuming, and it's hard," [securityfocus.com]. They don't seem to understand that many people get a lot of satisfaction in doing that. Many people look for things to post to bugtraq because doing so is *fun* for them.

    Steve Balmer's recent statement about vulnerability researchers - 'I wish those people just would be quiet' [yahoo.com] - is downright silly. They are the biggest company on the block right now, and there's always going to be someone who wants to make the big corporation look silly. Microsoft needs to wake up to the fact that there will *always* be someone who is a) bored, and b) wants to make them look bad.
  • ...is that they produce code that is only just good enough to provide the desired capability, without any regards to security. That code then becomes v1.0, is rushed to market, and then the inevitable security and functionality bugs are found due to what seems to be a lack of QA, and they get beat up (rightfully so) by us techies for continuing to release binaries based on sloppy code.

    Of course, they could do one other thing which is to change coding practices so that code is built robustly and securely t
  • Should really be called....

    Yet Another Secure Security program

    Sort of Like yacc. Anyone remember yacc? (Yet Another Compiler Compiler)

    Great for building compiler parsers, or any sort of parser, because you had to build them so often.

    Sort of like Microsoft, it has to build Yet Another Secure Security program.

    yass anyone?

    Maybe Microsoft should make something like yacc, that way it can turn out a new yass every year with minimal effort. :-)

    Damn. I would hate to see the state machine for that puppy.

    A
  • ... the captain of the Titanic bragging about it's unsinkability?

  • How about automatically removing foreign malware? (Score:3, Informative)

    by Bingo Foo ( 179380 ) on Friday October 10, 2003 @05:04PM (#7185894)
    I spent a good deal of time last weekend disinfecting my cousin's computer from all sorts of disgusting junk. Yes, I had to apply about fifteen "critical updates" but I also had to remove (or attempt to remove) about ten different apps that appear to have the sole purpose of hijacking the browser to go to dozens of popup havens. These programs:
    1. Often had official sounding names in the add/remove programs list like "MS Explorer update Q3395"
    2. Popped up five or six windows every time a link was clicked in IE, and inevitably one of the popups was for a service or program that claimed to "stop those annoying popups."
    For these reasons (trademark infringement, extortion), it would be completely within Microsoft's rights (and perhaps duties) to check for and remove such software as part of the normal update process.

    If they don't do this already, Microsoft should set up a room full of computers with people just dredging the sleazier parts of the web and installing whatever the latest malicious spawn of Bonzi Buddy and Gator, etc. happen to be. They would have to have non-MS IP numbers, because that would be too easy to check for in one's malware.

    Of course, I had a talk with my cousin about clicking "OK" to install every little thing that comes down the pipe, but it felt like trying to talk about genital warts or something.

    • Yeah, you're right...in fact, if the app isn't signed by MS, then they should remove it, because you never know, it might be doing something "bad".

      Problem is, you'd be screaming just as much about this "solution" as you are right now about the popups, etc. And you'd be perfectly justified in doing so.

      If a MS OS is going to have the ability to run arbitrary executables (arguably the OS's most important job), then it can't be responsbile for what those apps do.

      I'm not sure what the solution is, but one pos
      • I didn't say that MS should be able to uninstall anything just because they feel like it, I specifically said because of the trademark infringement and attempted extortion that these programs are designed for, they are just as legitimate a target for removal as "viruses" are.
        • Ah, didn't realize you were keying on a trademark issue. I understand that sentiment, but then the "bad guys" would just change the installed names of their apps to things like "Internet Connector" or "Web Site Accelerator" or whatever. That'd get them around MS and they'd sound just as important to the average user.
    • Your cousin is visiting adult sites. Check for hairy palms.
    • it felt like trying to talk about genital warts or something.

      That's what we need. Education. Public service ads that ask kids "Have you talked to your parents about viruses? Don't you think you should?" and say things like "Adults *want* internet boundries. Be a responsible teenager and punish them when they install malware."
    • For these reasons (trademark infringement, extortion), it would be completely within Microsoft's rights (and perhaps duties) to check for and remove such software as part of the normal update process.

      Please no! I already run into plenty of situations where updates cause problems of their own so the last thing I want is for MS to start making their updates more complex.

  • Patches (Score:4, Interesting)

    by Via_Patrino ( 702161 ) on Friday October 10, 2003 @05:06PM (#7185901)
    recognizes the fatal user flaw of not applying patches


    I think the major problem is how patches are structured, i have no idea of how many and which patches i need to install because microsoft site is very confuse and there is always a new bug on the news


    Another is the way microsoft sells their OS, the version i bought on store is the same of one year ago. So just after install i need to download and install tons of patches, this is a problem while handling several machines (or several installs on the same one :). If i could download the latest version (which all patches included) and install it it wouldn't have that much problem


    And there is another one ( i think that's the one i don't update :): A lot of security patches include a lot of unuseful (read heavy) stuff. I just want a patch to my system, i don't want more animations or a lot of tools that i won't use and will just bloath the code.

    Examples are: MS WindowsMediaPlayer 6.x vs 7 and up, MSIexplorer 5.5 vs 6.x. I can't patch them, i need to install a new one (often the installing process says it's a patch but is just a install of a newer version).

    • Re:Patches (Score:3, Interesting)

      by dirk ( 87083 )
      I think the major problem is how patches are structured, i have no idea of how many and which patches i need to install because microsoft site is very confuse and there is always a new bug on the news.

      How is Windows Update hard to understand? It scans your computer for you and tells you which patches you need to install. Security patches are listed as critical, other patches are listed under the "Windows" heading, and drivers by themselves. I can't think of a way to make it easier without removing the

  • Ballmer ... said the Redmond, Wash., company will issue security updates on a monthly schedule, except in "emergency" situations, to make it easier for users to keep their personal computers up to date.

    What kind of security updates aren't emergency situations? This sounds like they'll be prioritizing these things -- in effect, determining on my behalf which security hole is more important.

    As Schneier said later in the article, "Announcements never secured anything." This particular announcement, ho

  • Steve Ballmer? (Score:3, Funny)

    by worm eater ( 697149 ) on Friday October 10, 2003 @05:10PM (#7185918) Homepage
    This man has no ideas. He doesn't even have hair! [spiegel.de]

    Let's not listen.
  • while microsoft focuses on security, they want all bug reports to silently go away.

    somehow, i see steve ballmer walking around like elmer fudd, saying "shhhhh, be vewy vewy quiet, we're hunting bugs" -- with as much success as elmer has.

    if they've been unable to find the bugs so far, and attempt to take the pressure off from those publicising the bugs, they run the risk of further, undetected, breakins. this is dangerous, and stupid.

    but what else would you expect from a cartoon company?

  • Microsoft's New Security Initiative (Score:3, Funny)

    by ENOENT ( 25325 ) on Friday October 10, 2003 @05:23PM (#7185977) Homepage Journal
    Every time someone discovers a security hole, Steve Ballmer will be dispatched to bellow, "SECURITY, SECURITY, SECURITY!!!" and get drops of perspiration all over any reporters who show up to cover the story.

  • "Unbiased coverage" (Score:3, Interesting)

    by mackstann ( 586043 ) on Friday October 10, 2003 @05:32PM (#7186017) Homepage
    I guess the submitter's idea of "unbiased coverage" is "comments from people who have lots of reasons to dislike Microsoft."

    It's almost impossible to avoid bias in anything, but this one is plain as day!

    • Microsoft makes the same empty promises, and the usual suspects respond with the same empty sound bites. 'Round and 'round the roundabout, and back where we began.

      But if the submitter hadn't made that "unbiased coverage" remark, it wouldn't be trollworthy enough for Mikey to accept it. Wouldn't want him to break the pattern by simply reporting, now, would we?

  • Gee whiz Gomer, Barney from Microsoft says that it's the users fault for not patching their systems. (Partially agree)

    Barney from MS says that security companies shouldn't tell anyone about MS software problems. (Disagree)

    Barney from MS says that they're really, really going to focus on security this time. (Vehemently Disbelieve)

    Head of MS security, Gomer, reiterates that security is number one at MS. (Denying urge to vomit)

    Smart people from around the world say "Bullshit, MS hasn't done shi
  • Let's see... the story has the M$ BillBorg, the Tech/IT mobo, security, and business icons - but where's the Python foot for humor??
  • Is he touting the 31 unfixed security holes in IE?
  • Comment removed based on user account deletion

  • Same song, different year (Score:3, Funny)

    by GSloop ( 165220 ) <networkguru@sloo ... minus physicist> on Friday October 10, 2003 @05:42PM (#7186072) Homepage
    MS did this last year.

    Was there a dramatic decline in Remote root exploits? Sure didn't look like it to me.

    Explain to me again, why we should believe in it this time?

    MS is a day late and a dollar short. Security hasn't been a marketable feature, according to MS. Thus, they haven't done much with it.

    Now it's too late. MS is known as a broken dick dog on security. They are not going to lose that reputation for years.

    Good luck Steve. Your company sucks.

    Cheers,
    Greg
  • What bothered me about Ballmer:

    Steve is Uncle Fester [yahoo.com]

    Dun-nuh-nuh-nuh
    Snap, snap

    Dun-nuh-nuh-nuh
    Snap, snap

    Dun-nuh-nuh-nuh
    Dun-nuh-nuh-nuh
    Dun-nuh-nuh-nu h
    Snap, snap
  • Write secure software? Where's the profit in that? If the software is secure nobody will pay for upgrades.

    It's worrying to note that the book Writing Secure Code published by Microsoft Press is out of print [amazon.co.uk].

  • Fatal "user" flaw? (Score:5, Interesting)

    by Graymalkin ( 13732 ) * on Friday October 10, 2003 @05:55PM (#7186173)
    Having just helped someone put WindowsXP on a laptop last night I easily say the flaw is not on the user end. There's a hojillion security vulnerabilities in WindowsXP. Most people do not have broadband. Lacking broadband makes it really damn difficult to keep up with patches. The fresh WindowsXP install that went on the laptop couldn't even connect to the internet for five minutes without being hit by MSBlaster. Five minutes. That's ridiculous. The user is not at fault in a situation like that, Microsoft is.

    Ballmer can blame users all he wants. It comes down to Microsoft having a crappy security model and poor development practices. Having a bunch of temporary employees programming black boxes gets them into a lot of trouble. So does having DCOM services a majority of users will never need or use enabled by default. A WindowsXP Pro system shouldn't be listening to RPCs from the internet.

    Ballmer needs to have his developers look more closely at how they are designing their systems. Windows shouldn't have a broadband connection as part of the damn system requirements. Even with an automagic updater people without fast persistant connections will still run around without the proper patches. Maybe Microsoft needs an ounce of prevention to release more secure and robust systems in the future.
  • You mean they had one to begin with?!!!

    He recognizes the fatal user flaw of not applying patches and introduced an educational plan to help correct this.

    Well, that should fix THEIR own boxes. But what about the rest of us?

    ...a response about computer researchers who publish flaws in Microsoft products, 'I wish those people just would be quiet.'

    Oh I get it! You'll fix your boxes and the hell with the rest of us!

    Jeese! You just gotta love that kind of business plan! Well heck! Crap to you too!

  • OK, THIS time we're REALLY serious! (Score:3, Funny)

    by switcha ( 551514 ) on Friday October 10, 2003 @06:01PM (#7186216)
    Rinse. Blather. Repeat.

  • Summary (Score:2)

    by jd ( 1658 )
    "We'll focus on security... ...provided you don't look closely, or tell anyone what you see."


    Microsoft's attitude towards security merits either a feature on the comedy channel, or a visit from Homeland Security. Exposing 99.8% of the desktops in the world to malicious data thieves must surely be a violation of the Patriot Act. (Everything else is!)

  • Edit XPSP1 so it doesn't require a valid (or hacked) registration code. You may not care about machines running pirated copies of Windows, but your customers care about the viruses and spam they shed once they've been taken over.
  • I posted this on another web forum, but I figured I'd re-post it here, too. I admit that I wasn't 100% open minded to this presentation, but I was willing to give the MS guy a break. However, I walked away from this presentation being very disenchanted, and I feel very uneasy about the whole MS-Security-Drumbeating festival that is going on these days.

    Anayways, enjoy:

    Thought I would pass on this story, as I found it a bit amusing. Today I went to a presentation at my school called "Security: Just Plain

Slashdot Top Deals

The biggest difference between time and space is that you can't reuse time. -- Merrick Furst

Close