Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Microsoft Operating Systems Software Windows

Microsoft Drops Next-Generation Security Project [updated] 385

Posted by timothy from the drawing-board dept.
grooveFX points to this CRN article which starts "After a year of tackling the Windows security nightmare, Microsoft has killed its Next-Generation Secure Computing Base (NGSCB) project and later this year plans to detail a revised security plan for Longhorn, the next major version of Windows, company executives said..." grooveFX writes "Glad to see they actually listen to the gripes from the media and users." Update: 05/05 19:13 GMT by T : phil reed writes "Oops. According to this article on Microsoft Watch, Microsoft really isn't giving up on NGSCB (aka 'Palladium') after all. Microsoft spent much of Day 2 of its Windows Hardware Engineering Conference (WinHEC) here refuting a published report claiming the company has axed its Next Generation Secure Computing Base (NGSCB) security technology."
This discussion has been archived. No new comments can be posted.

Microsoft Drops Next-Generation Security Project [updated] More

Microsoft Drops Next-Generation Security Project [updated]

Comments Filter:

  • Next goal for Microsoft (Score:5, Funny)

    by Neil Blender ( 555885 ) <neilblender@gmail.com> on Wednesday May 05, 2004 @01:22PM (#9065332)
    If this goes well, they plan to cancel all security projects.

    • What? (Score:4, Funny)

      by baudilus ( 665036 ) on Wednesday May 05, 2004 @01:26PM (#9065379)
      Microsoft has security projects?
    • > If this goes well, they plan to cancel all security projects.

      How would anyone notice?

    • NGSCB NOT a security project. (Score:5, Informative)

      by Hobbex ( 41473 ) on Wednesday May 05, 2004 @01:38PM (#9065523)

      Please stop making the mistake of thinking that NGSCB was ever a security project. It is simply the newer name for "Palladium", Microsoft's total lockdown and DRM system to create a "trusted" (by the music industry, not by you) computer.

      Microsoft dropping this is good in every way, except that it's ghost will return in other forms for sure...

      • Re:NGSCB NOT a security project. (Score:5, Insightful)

        by cain ( 14472 ) on Wednesday May 05, 2004 @02:34PM (#9066134) Journal
        Microsoft dropping this is good in every way, except that it's ghost will return in other forms for sure...

        People always forget that this is just a tool. It can be used for good or ill. Hospitals could've used it to secure your medical records. You could have used it to secure and authenticate your tax returns before you sent it to the IRS. People who use the GPL could've used it to enforce the GPL! No more guessing if someone has stolen your GPL'd code - you'd know. NGSCB is just a tool. Both NGSCB and Palladium are security projects, it's just that the DRM/RIAA/MPAA use of the tool is objectionable. IT does not mean that the technology is worthless or "evil".

        --
        Cain.

        • Enforce GPL? (Score:4, Insightful)

          by ratboy666 ( 104074 ) <<moc.liamtoh> <ta> <legiew_derf>> on Wednesday May 05, 2004 @03:42PM (#9066819) Journal
          I call bullshit.

          *How* can NGSCB and Palladium be used to enforce the GPL?

          Oh, by tying the source code to a key, which makes it impossible to change the source code and use the same key... but the verification is against the key. By tying the binary to a key, and making it impossible to modify the binary? So, rebuild the binary, and key use is lost.

          In other words, these measures *can't* be used to enforce GPL. So much for this tool.

          Now, is Palladium a security project? Well, yes, but not for the end user. Indeed, the end user can run the same old trojans, etc. as before. Palladium *will* prevent the trojan from accessing data that has bee "protected", by kicking out the unsuitable software.

          It was NEVER meant to secure YOUR stuff -- if you want that, go use GPG, etc. I assume that even MS Outlook must have some integration with GPG! (all of my emails are digitally signed).

          Ratboy.

          • Re:Enforce GPL? (Score:3, Insightful)

            by cain ( 14472 )
            Oh, by tying the source code to a key, which makes it impossible to change the source code and use the same key... but the verification is against the key. By tying the binary to a key, and making it impossible to modify the binary? So, rebuild the binary, and key use is lost.

            Hmmm. To be honest, I hadn't thought through the entire chain of events. The idea from a high level though it this: imagine the worst possible nightmare scenario for music distribution. Now music is just data and source code is just

        • Re:NGSCB NOT a security project. (Score:4, Insightful)

          by Alsee ( 515537 ) on Thursday May 06, 2004 @03:39AM (#9071357) Homepage
          People always forget that this is just a tool. It can be used for good or ill.

          Yeah, but when someone is designing and building a tool it is appropriate to look at the intentions of the builder and the design goal.

          The central design goal of of the system is that it be secure against the owner. Specificly, it is the owner is forbidden to know his own key or to have full control of his own key. If you read the engineering specs of the Trusted Platform Module (also known as TPM or TCPA chip or Fritz chip) it extensively and repeatedly states that it must be secure against the owner. Entire sections are devoted to what the owner is to be forbidden to be able to do. It explicitly states that if the chip dies then it MUST be impossible for the owner to be able to recover his data.

          The system was designed with malicious intent, therefore the system itself is malicious (or evil).

          You claim this is a tool that can be used "for good or ill". In fact there do not exist ANY ways this could benefit an owner that that you can't accomplish just as well with an nearly identical and non-malicious system.

          All you need to do is give the owner a printed copy of his key. Such a system could have identical hardware. And with identical hardware your computer has precisely the same capabilites to protect you. There is no possible way that merely knowing your key can reduce your computers ability to protect or help you.

          The only difference is that if you know your own key then you have actual control over your own computer. You can unlock anything on your computer if you choose to do so. That means it is impossible for someone hijack your computer against you to lock you into something. It means it is impossible for someone hijack your computer against you to lock you out of your own files. You computer can no longer enforce DRM against you and against perfectly legal and legitimate uses.

          With one trivial change the owner can get EVERY claimed benefit of trusted Computing and you can eliminate EVERY possible abuse of the system.

          They refuse to sell beneficial systems such as I described because their motivation is precicely to impose abuses against owners. To impose lock in and lock out and to deny owners control of their own propery. If you know your key then your computer is no longer "Trusted" to act against you.

          Hospitals could've used it to secure your medical records.

          They could do that with the alternate system I described. Hospitals (or any company for that matter) could get just as much security from computers that came with copies of their keys. They could lock those keys in a safety deposit box, or that could simply burn the keys without even looking at them.

          You could have used it to secure and authenticate your tax returns before you sent it to the IRS.

          Identical hardware where you know your key is just as secure against viruses and trojans and hackers.

          I have no idea what it means to "authenticate" a tax form you just filled out before sending it in to the IRS, nut I guarantee that you don't need a Trusted Computer to do it.

          People who use the GPL could've used it to enforce the GPL!

          hat is impossible. As others have already posed. Trusted Computing is inherently incompatible with the GPL. Hell, Trusted Computing (and any DRM system) is inherently incompatible with copyright itself. Using DRM means abandoning any refference to what is legal and what is not legal and simply substituting the DRM capabilities/restrictions in place of the law.

          Not only is Trusted Computing malicious, it is also worthless. Your computer is your property, the Trust chip inside is your property, your key hidden inside your chip in your computer is your property. You have every right to rip open your computer and read your key out with a microscope. They can make it a pain in the ass to do, but they can never prevent you from doing so. The moment you read out your key

      • Re:NGSCB NOT a security project. (Score:5, Informative)

        by blowdart ( 31458 ) on Wednesday May 05, 2004 @02:42PM (#9066193) Homepage

        Except it's NOT being dropped according to a WinHEQ talk.

        Microsoft-Watch [microsoft-watch.com] has details,

        Microsoft spent much of Day 2 of its Windows Hardware Engineering Conference (WinHEC) here refuting a published report claiming the company has axed its Next Generation Secure Computing Base (NGSCB) security technology. "NGSCB is alive and kicking," said Mario Juarez, a product manager in Microsoft's security and technology business unit.

        Who to believe?

    • no, MS security plans have now leaked (Score:5, Funny)

      by swschrad ( 312009 ) on Wednesday May 05, 2004 @02:07PM (#9065858) Homepage Journal
      they plan to provide DRM kits to script kiddies so all viruses are signed, and thus acceptable to Windows.

    • Re:Next goal for Microsoft (Score:5, Funny)

      by MarkGriz ( 520778 ) on Wednesday May 05, 2004 @02:16PM (#9065949)
      Great. Perhaps now they can focus on *this generation* security projects.

  • Ahead of its time (Score:4, Interesting)

    by l33t-gu3lph1t3 ( 567059 ) <arch_angel16.hotmail@com> on Wednesday May 05, 2004 @01:24PM (#9065350) Homepage
    Palladium was too ambitious. It's nice that they're atleast going with memory page protection.
    • Is this the same memory page protection that was supposed to be incorporated into Windows 2000? I can remember being *excited* about Windows 2000 (reading the specs) ... as I removed Windows 98se at home and started using Linux there full time.

      I still run Linux. :)
      • No, not the same. IIRC hardware memory protection used to be a thing that only highend big iron utilized, and AMD's Opteron is the first x86 chip to have it.
        • IIRC, Intel will only execute from the Code Segment. This has been true since the 8086. It's hard to fault Intel if certain OS's (Linux, and the current incarnations of Windows) map code, data, and stack to the same segment. :-)

  • Security != Trusted Computing? (Score:3, Interesting)

    by rburgess3 ( 682428 ) <.moc.oohay. .ta. .3ssegrubr.> on Wednesday May 05, 2004 @01:24PM (#9065351)
    So, what does this mean for 'Trusted Computing'?

    • Definition of trusted computing (Score:5, Funny)

      by AtariAmarok ( 451306 ) on Wednesday May 05, 2004 @01:27PM (#9065398)
      From dictionary.com definition of trust: "A combination of firms or corporations for the purpose of reducing competition and controlling prices throughout a business or an industry."

      Trusted computing, therefore, facilitates reduction of competition.

      • "Trusted computing, therefore, facilitates reduction of competition. "

        Informative? Funny maybe, but informative? Is it informative if I paste one definition of open as in open source?

        "Not yet decided; subject to further thought: an open question."

        There's a few people out there that'd see that as an accurate / informative definition.
    • They changed their logo. Now it's just 'Computing'.
    • It means that tin-foil-hat crowd who were posting as recently as yesterday about how microsoft was conspiring to bring about "the end of computing as we know it" and intended to somehow create laws to make untrusted operating systems unable to load on any legal hardware, etc., etc., were complete idiots. As most of us already knew.

    • This would have been useful forVoting systems (Score:4, Insightful)

      by goombah99 ( 560566 ) on Wednesday May 05, 2004 @02:19PM (#9065973)
      Actually I'm sorry to see it go. The project had some orwellian implications to be sure. But I think those could have been dealt with. It would have had so many possibilities. One of them would have been its application in trusted systems for Voting machines, Hospital machinery and all sorts of things where one must comptomise between ubiquitous network access and trust.

      It also would have opened up new markets. It's interesting to note that all of the great innovative periods in human history have been carried on the backs of breaktrhoughs in travel,commerce and communications. Even the lowly canoe can be credited for the rapid westward puch in canada and the US. (Shame about the beaver however). The invention of "coin of the realm" and accounting practices allowed goods to be passed over huge distances even the marco polo trail carried "mail-order" goods.

      At present we dont have ways in place for people to watch digital movies and othe rprotected content in ways the the owners are willing to produce or share thier content for. Let's not get into an RIAA riff here. The point is that lots of people do want to "rent" content and watch it and without a secure communication channel they cant.

      likewise things like internet voting and commerce trasnactions are held back by the lack of ubiquitous secure channels.

      thus while I disliked the implications of NGSC for having control over my machine I would have liked to have had one in myhouse. I'd have two computers. one for my own uses and one for the cases where security outweighed the other issues.

  • Palladium (Score:5, Interesting)

    by Nexum ( 516661 ) on Wednesday May 05, 2004 @01:24PM (#9065352)
    Isn't NGSCB Palladium?

    Surely this is pretty good news and indicates that MS might not be so able to force these kind of security measures on their custimers.

    Although I imagine knowing Microsoft, the problems were at least as much technical than political, and they just gave up considering it to be "too hard and we can't be arsed", just like WinFS.

    • Re:Palladium (Score:4, Interesting)

      by VivianC ( 206472 ) <internet_update@y a h o o.com> on Wednesday May 05, 2004 @01:28PM (#9065415) Homepage Journal
      Isn't NGSCB Palladium?

      Yes it was. Bye bye Palladium! Can we all say thanks to Microsoft for getting rid of (or at least delaying and renaming) this crazy project? This could be the start of "Say something nice about Microsoft day!"

    • YES (Score:5, Insightful)

      by Hobbex ( 41473 ) on Wednesday May 05, 2004 @01:35PM (#9065493)

      Can we please get this modded past all the responses that seem to think that NGSCB has something to do with security. NGSCB aka Palladium is/was Microsoft's locked down "trusted" computer project, meant to facilitate DRM. It never had anything to with security save for in name and spin.

      This is a good thing of course, but I seriously doubt it means that that Microsoft won't find other ways of sneaking locked down computer on us in the future...

    • Uh...just like WinFS? (Score:3, Informative)

      by bonch ( 38532 )
      Although I imagine knowing Microsoft, the problems were at least as much technical than political, and they just gave up considering it to be "too hard and we can't be arsed", just like WinFS.

      This is why people complain about Slashdot's misreporting and falsehoods.

      They never "gave up" on WinFS. WinFS is alive and well. All the MS blogs were making fun of the reporting on this--all that changed with WinFS was that some network things were taken out of it, extraneous features not required for it to work

  • A few suggestions (Score:4, Insightful)

    by Ckwop ( 707653 ) * on Wednesday May 05, 2004 @01:24PM (#9065357) Homepage

    I've got a three suggestions for Microsoft on the issue of security:


    1. 1. Dump lots of features. While beta testing and what not irons out the performance bugs.. catching security bugs is another problem all together. The more code you have the intractable secuirty becomes
    2. 2. Stop using languages/tools that allow you have buffer overflows in code. That'll cut out 90% of critical updates in one swoop.
    3. 3. Stop having 20 ways of doing the same thing. A simple case in point is .NET and the Win32 API. Even if .NET wraps the Win32API.. that's another layer a security bug can leak into.


    Like the airlines think Saftey, Saftey, Saftey - Microsoft need to adopt the slogan.. Security Security Security



    Simon

    • Re:A few suggestions (Score:5, Funny)

      by sunwukong ( 412560 ) on Wednesday May 05, 2004 @01:28PM (#9065414)
      Like the airlines think Saftey, Saftey, Saftey - Microsoft need to adopt the slogan.. Security Security Security

      And some sort of chant -- maybe a dance ...

    • Re:A few suggestions (Score:5, Funny)

      by Soko ( 17987 ) on Wednesday May 05, 2004 @01:30PM (#9065433) Homepage
      Like the airlines think Saftey, Saftey, Saftey - Microsoft need to adopt the slogan.. Security Security Security

      Let's hope they get past "developers developers developers"...

      Soko

    • Re:A few suggestions (Score:5, Funny)

      by Anonymous Coward on Wednesday May 05, 2004 @01:31PM (#9065447)
      Handy Travel Hint: avoid flying on any airline whose motto is "Saftey, Saftey, Saftey"

    • Re:A few suggestions (Score:5, Insightful)

      by HeghmoH ( 13204 ) on Wednesday May 05, 2004 @01:34PM (#9065471) Homepage Journal
      Linux breaks all three of your suggestions and it still seems pretty secure.

    • Re:A few suggestions (Score:5, Interesting)

      by NanoGator ( 522640 ) on Wednesday May 05, 2004 @01:34PM (#9065473) Homepage Journal
      "1. Dump lots of features. While beta testing and what not irons out the performance bugs.. catching security bugs is another problem all together. The more code you have the intractable secuirty becomes"

      Problem is, people (particularly Windows users) buy features before they buy security. Sad, but true. I've made a nice little freelance business out of it. Funny thing is, though, I haven't had to do a whole lotta worm fixing for them. If they're keeping up with their machine, then the value of being 'worm proof' goes down even further, thus making Microsoft sting from the lack of features driving their sales.

      Does it suck? Sure. Real life is funny like that.

      • It's because they gave up. (Score:4, Funny)

        by Ungrounded Lightning ( 62228 ) on Wednesday May 05, 2004 @02:01PM (#9065787) Journal
        Problem is, people (particularly Windows users) buy features before they buy security.

        IMHO that's because Windows users have given up on getting security. B-)

        With a choice of an insecure platform with fewer features or an insecure platform with more, of course they'll pick the one with more. Just think: They might actually be able to get something done between crashes, infections, and reinstalls.

    • Re:A few suggestions (Score:5, Interesting)

      by Quarters ( 18322 ) on Wednesday May 05, 2004 @01:34PM (#9065477)
      You say to stop using buffer-over-run prone languages but then turn around and harp on .NET. Isn't the point of .NET and a managed language like C# to prevent things like buffer over-runs?

    • Re:A few suggestions (Score:4, Informative)

      by k4_pacific ( 736911 ) <k4_pacific@yah[ ]com ['oo.' in gap]> on Wednesday May 05, 2004 @01:36PM (#9065505) Homepage Journal
      The problem is not all the features. Rather, the problem is that all the features are part of the OS which means that a security hole in some feature gives an attacker kernel level priveleges which is a Bad Thing. They need to go with the Unix model wherein the bulk of the features are in user space and the kernel handles basics like file i/o and scheduling. I mean, come on now, why is the WEB BROWSER part of the OS in Windows? Putting something which parses and displays downloaded documents of unknown origin inside the kernel is just asking for trouble. I think that their desire to destroy Netscape overpowered their common sense in this case.

    • Re:A few suggestions (Score:5, Interesting)

      by Chanc_Gorkon ( 94133 ) <<moc.liamg> <ta> <nokrog>> on Wednesday May 05, 2004 @01:37PM (#9065513)
      First off:

      1. Dumping Features would break lots of stuff. I suggest that they don't ADD any more and fix what they got!

      2. Um, gcc prevents this?? There's no language that prevents these types of things. Even if you write with a language that supposedly does not have Buffer Overflows, you still rely on other modules that were written in a language that does allow them ot happen.

      3. UNIX and Linux both have 20 ways to do things as well. It's called choice. You choose the best for your situation. I think what you mean is that ActiveX components used on the web should never be allowed to stray out of the web sandbox nor should they be allowed to execute code. And another thing...the mail client should NEVER be allowed to execute code with out asking the user forty times!

      • Re:A few suggestions (Score:5, Insightful)

        by shunnicutt ( 561059 ) on Wednesday May 05, 2004 @01:48PM (#9065631)

        And another thing...the mail client should NEVER be allowed to execute code with out asking the user forty times!

        And I bet you'd still have users that would click the "Yes, i'm an idiot" button forty times just so they could see the pretty new screen saver their friend so thoughtfully sent them!

    • >Like the airlines think Saftey, Saftey, Saftey - Microsoft need to adopt the slogan.. Security Security Security

      I thought Microsoft's slogan was

      "Developers developers developers" ?
      http://www.ntk.net/media/developers.mpg

    • It's time to tighten up C++ (Score:5, Interesting)

      by Animats ( 122034 ) on Wednesday May 05, 2004 @01:54PM (#9065696) Homepage
      Stop using languages/tools that allow you have buffer overflows in code. That'll cut out 90% of critical updates in one swoop.

      Yes. I've been trying to get the C++ committee to tighten up that language for years, with little success. It's time to get more serious about this, and apply pressure via ANSI (which is supposed to insure that standards are safe) and the Department of Homeland Security's National Cyber Security Division. Like it or not, we need to go to full subscript checking for anything that could possibly be exploited. The resulting 10-20% performance hit is minor compared to the costs of dealing with these attacks.

      I've sent this to the C++ committee:

      • After the damage caused by the Sasser worm, the latest in a long series of buffer overflow exploits, perhaps the designed-in lack of safety in C++ should be reconsidered.

        The Sasser worm exploits a buffer overflow in Microsoft's LSASS service, which is, apparently, written in C++.

        Perhaps more weight should be given by the Standards Committee to tightening up C++ and making it a safer language. The Committee has consistently rejected most suggestions which tighten up the language, usually on the grounds that they would impact existing code or prevent some dangerous but valid code from being used.

        It is now appropriate to ask ANSI, and the Department of Homeland Security's National Cyber Security Division, to reevaluate the C++ committee's priorities in the light of the documented and substantial damage caused by weak safety features of the language. Whether the committee should be permitted to promulgate unsafe technologies with ANSI approval must be seriously questioned at this point.

      That will probably be ineffective. The appropriate forum will probably be Congressional hearings on computer security, which were threatened last year after the SOBIG virus, and are likely to happen this year.

      • Like it or not, we need to go to full subscript checking for anything that could possibly be exploited.

        Arrays of primitive types are a feature inherited from C, and the design of C is such that the compiled code is a direct translation (optimizations notwithstanding) of the source code. The compiler doesn't insert any code that you didn't write.

        Added in C++ is the ability to overload operators, including the subscript operator, so you can write classes which act just like arrays, but do bounds-checkin

    • Re:A few suggestions (Score:4, Interesting)

      by RzUpAnmsCwrds ( 262647 ) on Wednesday May 05, 2004 @03:00PM (#9066422)
      "2. Stop using languages/tools that allow you have buffer overflows in code. That'll cut out 90% of critical updates in one swoop."

      XP SP2 is being compiled using a new C compiler which automatically generates code resistant to buffer overruns. It's not perfect, but it is a start.

      Combined with the new firewall and NX protection (on AMD64 systems), XP SP2 should be far more secure than its predecessor.
  • They have cancelled security? What next? Will Microsoft stop supporting Linux? Oh no!

  • Next Gen? (Score:5, Funny)

    by daeley ( 126313 ) * on Wednesday May 05, 2004 @01:25PM (#9065373) Homepage
    Their Next Generation security project was doomed from the start once Lore kidnapped Data and took his place in the landing party.

  • And it's already rumored... (Score:5, Funny)

    by tunabomber ( 259585 ) on Wednesday May 05, 2004 @01:26PM (#9065378) Homepage
    ..that the "revised security plan" will make heavy use of the recent advances in obscurity technology.

  • RTFA (Score:5, Interesting)

    by Dynedain ( 141758 ) <slashdot2NO@SPAManthonymclin.com> on Wednesday May 05, 2004 @01:26PM (#9065387) Homepage
    This is Palladium, and it has not been "dropped", only shelved because it was too ambitious. They say they've invested too much on this not take advantage of it.

    • Re:RTFA (Score:5, Informative)

      by Too Much Noise ( 755847 ) on Wednesday May 05, 2004 @01:34PM (#9065480) Journal
      actually, no - the software support was not going the way MS wanted it. From the article:

      Juarez said the project is being shelved because customers and ISV partners didn't want to rewrite their applications using the NGSCB API set.


      So here you have it - customers and partners didn't like it.

      • Re:RTFA (Score:5, Funny)

        by spectral ( 158121 ) on Wednesday May 05, 2004 @01:51PM (#9065659)
        Not knowing spanish (and, like the stupid American I am, automatically assuming it IS spanish), how do you pronounce Juarez? If Juan is essentually pronounced with the ju becoming a 'w', is his name 'warez'?

  • In conjunction (Score:5, Funny)

    by razmaspaz ( 568034 ) on Wednesday May 05, 2004 @01:27PM (#9065402)
    Microsoft also lowered the hardware requireements for longhorn from 2x4ghz procs to a single 1ghz proc, citing the decrease in complexity of drm will free up much of the needed processing power.

  • Would the new Longhorn security system... (Score:3, Insightful)

    by joel.neely ( 165789 ) on Wednesday May 05, 2004 @01:27PM (#9065403)
    ...bypass virus scanning for malware authors who pay Microsoft [slashdot.org]?
    • Come on, how paranoid can you get? How can M$ control what files all 3rd party antivirus software scan for? Why would they do this in the first place, viruses are one reason people are moving servers to linux.
    • If the RIAA paid M$ (And I'm sure they do) M$ might use this to scan your computer for copyrighted music. And so on. This is "trusted computing"... As in, he RIAA can trust my computer, not me.

      I trust my own damn computer. If I want to store hundreds of illegal documents on an encrypted disk image, I'm confident it won't send the password to Apple or the government. I know it won't be hacked into because it uses RSA's proven encryption. It's MY computer, and if I want to use it to do things that industry X

  • Uh? Listening? (Score:5, Insightful)

    by Anonymous Coward on Wednesday May 05, 2004 @01:27PM (#9065405)
    What makes you think they are listening. They are presumably publically "killing the project named NGCSB", quietly inventing a new name and happily keep working on that, less publically this time now that they have used the publicity of Palladium/NGCSB to make initial "front door" contacts in the entertainment industry, they know who to expect at the "back door".

    The ol' "keep renaming the thing so people don't have a steady label for what they are fighting". The british sellafield->windscale->thorp nuclear shenanigans, the last Palladium->NGCSB namechange, TIA->something-or-other. All the same propaganda trick.

    The solution for opponents is to either keep using the old name so that the public latches onto it (everyone still calls it "Sellafield" and, to an extent, "TIA"), or invent your own name and get it to penetrate the public consciousness (much harder, only example I can think of it "Infidel")

  • The security feature we need is... (Score:5, Funny)

    by potus98 ( 741836 ) on Wednesday May 05, 2004 @01:28PM (#9065408) Journal
    "Though Microsoft plans to use the NGSCB "compartmentalizing" technology in future versions of Windows, the company is moving swiftly to support No Execute (NX) security technology in newer AMD and Intel processors. NX reduces memory buffer overruns that many hackers exploit to insert malicious code into Windows and allows developers to mark pages as nonexecutable. "

    What we need is "No Executive" security technology. Even the greatest security tools can be hogswaddled by the pointy hair types.

    [/obligitory upper-management jab]

  • Wrong deduction (Score:3, Insightful)

    by Rosco P. Coltrane ( 209368 ) on Wednesday May 05, 2004 @01:28PM (#9065417)
    Glad to see they actually listen to the gripes from the media and users.

    Microsoft doesn't listen to the media and the users, they listen to their shareholders and their finance guys. And they are saying that Windows looks like crap when it comes to security, undermining the credibility of the product, in turn threatening the sales and therefore their dividends.

    Microsoft listen to users? bah... If they did, they'd have jumped on the internet bandwagon much earlier. They're going about the whole security thing just like they dealt with TCP/IP and the web: they're thrasing to catch up. And the sad thing is, they probably will sooner than you think...

  • Microsoft does what it does best (Score:3, Insightful)

    by ObviousGuy ( 578567 ) <ObviousGuy@hotmail.com> on Wednesday May 05, 2004 @01:28PM (#9065418) Homepage Journal
    Microsoft never lets projects really die. They may kill off other companies' projects, but never their own.

    What they are doing, as they have done in the past with such flops as Bob, is slowly merge the improvements and features that they planned on delivering in a single project into their whole lineup across the board. As the article says, Longhorn is planned to incorporate this security technology.

    While this is by no means a cure-all for the problems that Windows faces, it is a step forward in computing. Whereas legacy systems such as Unix are finding it harder to support newer hardware features such as the NX codes in the latest AMD and Intel chips, the deep corporate partnerships that Microsoft has with these companies allows them to bring such technologies to the public at a faster rate than otherwise possible.

    That said, Windows sucks, has sucked, and will continue to suck. Linux shows it up every single time. Not to mention that Linux's security structure is already designed to thwart the exact problems that Microsoft is attempting to stop.

    • Re:Microsoft does what it does best (Score:5, Informative)

      by carsont ( 648940 ) <tc+slashdot@@@jc...dsl...telerama...com> on Wednesday May 05, 2004 @01:42PM (#9065574)
      Whereas legacy systems such as Unix are finding it harder to support newer hardware features such as the NX codes in the latest AMD and Intel chips

      Uh, what?

      As far as I know, the so-called "NX codes" are just the ability for the MMU to mark a page of memory as non-executable.

      Real architectures, such as SPARC, Alpha, and PA-RISC, have had this feature for a long time. It's used in Solaris for the non-executable stack feature, and it's the basis for OpenBSD's W^X feature [openbsd.org].

      So Intel, AMD, and Microsoft are just catching up to features which platforms you dismiss as "legacy systems" have had for years.

      • IANACPUExpert, but my understanding is that x86 has had a distinction between code and data pages since at least the 80386. I don't know if NX is different from data. Why would you execute something that isn't code?
        Anyway, I know Microsoft has never taken advantage of this feature. I'm surprised *BSD (particularly) FreeBSD hasn't.

  • There it goes, again. (Score:4, Insightful)

    by Lispy ( 136512 ) on Wednesday May 05, 2004 @01:31PM (#9065449) Homepage
    First they cancel WinFS, now the NextGen Security stuff, they just delayed it to 2006 and they just announced the hardware specs that are totally way off. Next thing they cancel is Avalon and they will delay it to december 2006. In the end it will be a minor upgrade such as WinXP was to 2k with some boring new stuff and an ugly new GUI-theme. We've seen this before. This won't stop them from calling it the biggest step since Windows 95. well, nothing to see here. Move along...

    Actually, it's good for the Linux Community that Microsoft keeps making the same mistakes again and again. Ahh..old faithful! ;-)

    Maybe Miguel will now rethink his very stupid "I'm scared, I'm very scared" quote he made a few days ago...

    • Um, no. (Score:4, Interesting)

      by abh ( 22332 ) <ahockley@gmail.com> on Wednesday May 05, 2004 @01:42PM (#9065577) Homepage
      - WinFS wasn't cancelled. It was scaled back so they could deliver what worked in a reasonable timeframe.

      - Microsoft hasn't announced hardware specs. What you're referring to is what a bunch of watchdog folks are GUESSING will be the hardware specs.

      - WinXP is much more stable than 2k. If you consider stability a "boring" enhancement, well, I bet you're in the minority.
    • Again, this is why people think Slashdot is a fucking joke when it comes to reporting "tech news." Slashdotters spread these incorrect truths around and they just become true because it's anti-"M$."

      WinFS was NOT cancelled. It wasn't even scaled back. They just removed some extraneous network features not required (which will probably be free downloadable updates anyway). But, all the sites like Slashdot completely SPUN it and misreported it. Slashdot is owned by VA Linux, so the agenda is obvious. :)

      • Re:EVERYBODY LISTEN UP--WinFS was not "cancelled" (Score:5, Insightful)

        by Lispy ( 136512 ) on Wednesday May 05, 2004 @02:45PM (#9066224) Homepage
        But don't you agree, on a rational basis, that we have seen stuff like this before? This might not be true with WinFS or whatever, but isn't it that the same promises rise from Redmond tower every single time they plan to release an OS? In the end their "revolutions" and integration plans never lived up to the hype. I would be very, truly and deeply surprised if this time it would be any different.

  • Possibly already too late (Score:5, Interesting)

    by ites ( 600337 ) on Wednesday May 05, 2004 @01:36PM (#9065497) Journal
    We are getting to the stage where a fair chunk of PCs connected to the Internet are destined to die. It's reasonable to assume that MS has performed a kind of triage: - Home PCs are beyond the reach of any help. Whatever is done is already too late. Home PC users will have to migrate to Linux within 6-12 months or face working without the Internet. - SMEs can be protected with additional work. SMEs need better firewall security and better patching methods. - Most enterprise computing is safe as is. Many data centers will switch away from Windows for cost and reliability issues but the ones that can't will remain faithful Windows clients. So Microsoft has to concentrate on helping the people who can still be saved, namely SMEs that have several PCs behind a shared internet connection. Having seen three of my friends' PCs dead today from Sasser (MSIE rebooting without end, and no way to do anything else on the system), I'm rather sceptical that home computing can be saved.

    • Re:Possibly already too late (Score:4, Interesting)

      by Lispy ( 136512 ) on Wednesday May 05, 2004 @01:39PM (#9065546) Homepage
      The funny thing is that most users prefer to stick with Win98SE instead of upgrading since they were never hit by any RPC worms. That's what will kill Microsoft eventually. Users won't upgrade since they don't trust their new stuff. Okay, it's crystal clear to all /.ers that a Win98 box is a desaster waiting to happen, but in the users expirience, for example my girlfriends, it feels safe since whenever they hear about a worm it's all those Win2k/XP users that get all the fun. They will stick with their old boxes and hopefully move to another machine when their local Linuxguru is holding their hands (as I will with my girlfriend if she finally has the money for a new box).

      • I agree with you on this. Most of my workstations are running 98SE and I see little incentive to upgrade. History has shown that with Microsoft, every new evolution of their software introduces even more problems than proposed solutions.

  • I Dreamed This! (Score:5, Funny)

    by bfg9000 ( 726447 ) on Wednesday May 05, 2004 @01:41PM (#9065569) Homepage Journal
    In a recent interview with WinEvil.com, Gates confirmed, "Yeah, it [the NGSCB] just wasn't eeeevil enough for us. We've got a history of setting the evilbar pretty high, and our current efforts were "extremely irritating" at best... We're looking for true unadulterated mindbending evil, and we know our customers won't settle for anything less. Give us a chance -- you won't be disappointed."

    Gates then proceeded to use a Windows XP CDRom as a prism to magnify his own inner evil until it was focused enough to melt a cute puppy, drawing appreciative applause from the crowd of evildoers. The crowd then had a huge WindowsXP InstallFest and cut off their own testicles in preparation for the comet Zurg's arrival to take them away.
  • It takes a MMORPG or a simple PC game 3+ years to make, MS seems to throw out OS's every couple years, whats wrong with this picture? There is no need for Windows 2003, they should have secured 2000 and waited to build a solid secured OS say in like 2006.. MS needs to buck up, get with the program and stop wasting peoples time. just my 2 cents.
  • Microsoft has killed its Next-Generation Secure Computing Base (NGSCB) project

    The'll just insert a coupon with Longhorn saying that users will get the Free Security upgrade when Half Life 2 ships, or when someone believes the 'free beer - tomorrow" sign, whichever comes first

    Like they ever had a security project in the first place

  • Expect the DRM lockdown initiative to be back with a new name, probably not long after some virus or worm scare that captures vast attention.
  • (In MS Meeting Room 30 feet below Earth's surface)

    PHG (pointy hair guy): Right. We killed the old plan.
    MSGurus: Hooray!
    PHG: Everyone gets a bonus.
    MSGurus: Hooray!
    PHG: We have a better plan.
    MSGurus: Hooray... we think.
    PHG: Because we spent so much time and money on the old plan...
    MSGurus: Booooo!
    PHG: We have to implement the new time in a fraction of the time. Bill thinks six weeks is plenty. Meeting adjourned.

  • No, Palladium is still very much alive (Score:5, Informative)

    by Anonymous Coward on Wednesday May 05, 2004 @01:54PM (#9065702)
    Interestingly, at the same time as this article pops up in feedreader, I get this link from e-week [microsoft-watch.com] that refutes the claim. Net: microsoft says palladium is still very much alive.
    • Didn't you know that:

      WinFS was "cancelled?"

      The iPod Mini is a complete and utter failure?

      Microsoft violates human rights in China?

      Longhorn apparently already has hardware requirements, even though they were merely predictions by watchdogs who attended the WinHEC?

      Nobody likes Windows XP, and everybody is hearing about Linux, even though Google Zeitgeist shows Linux at 1% usage?

      The Lone Gunmen die? Oh, wait...

      Yes, kids, you need to try getting your news outside of Slashdot once in a while--you'll see

  • Probably going to show up under another name (Score:5, Insightful)

    by Ra5pu7in ( 603513 ) <ra5pu7in@gm a i l . com> on Wednesday May 05, 2004 @02:03PM (#9065808) Journal
    What's the odds that Microsoft will continue to seek a way to push their concept of trusted computing onto the consumer -- by giving it another new name? Palladium got too much bad PR, so they changed the name. Enough people caught on, so now they are abandoning that name (not the project, for sure).

  • Would never work anyway (Score:5, Insightful)

    by t_allardyce ( 48447 ) on Wednesday May 05, 2004 @02:04PM (#9065814) Journal
    The fact is that the only way to implement this sort of DRM is through tamper-proof hardware, and even then its not like someone with a camera phone or even a good old small film camera to get a copy of that 'private' email (which is mostly what they are touting its use for). As for music and videos theres the if-i-can-see-it-i-can-copy-it which just cant be stopped, people will tolarate surprisingly low quality. And this isnt rocket science either, most people will be able to defeat these systems, software or hardware. Its not in Microsoft's interest to pursue this unless they want to piss people off or look very stupid when their "virus proof" OS gets hit one week after launch. It was a stupid idea before and it always will be a stupid and hated idea. Im glad they dropped it.

  • Not strange at all. (Score:5, Insightful)

    by miffo.swe ( 547642 ) <daniel@hedblom.gmail@com> on Wednesday May 05, 2004 @02:19PM (#9065979) Homepage Journal
    Implementing palladium hard will do one thing over night. Many tech savvy Windows users would switch away in a heartbeart. Most if not all of my friends who uses Windows rarely pay for any application they use. They consider it their god given rights do download anything they please. Any hindrance to that would make them switch in notime since they are very reluctant to actually start forking the dough for the applications they use. Bring in all the movies and music they download and they would gladly suffer hell on a commandline to avoid having to pay for the things they use.

    Come to think about it, harder and more vigalant enforcement on comercial software is only going to drive these people to open source no matter how they do it. Enforce and people migrate, dont and people dont pay. They are in a tough spot, BSA and ppl.
    • That's an interesting point. Let's do some CB analysis on this one. Currently: Windows: Cost - initial high, software widely available for free. Easy to use (contentious, but Linux is more difficult, let's face it, if only through lack of experience) Linux: Cost - initial free, software free - time - high, harder to use That excludes security, because most half-sane people I know either install updates regularly, (automatically in most cases), and then just remove the worm when/if it hits them. Should W

  • Spoken too soon? (Score:4, Informative)

    by seanmcelroy ( 207852 ) on Wednesday May 05, 2004 @02:39PM (#9066178) Homepage Journal
    An eWeek article located here:

    http://www.eweek.com/article2/0,1759,1585363,00. as p

    says MS is denying this is true.

  • Why do we fear such incompetence?! (Score:4, Insightful)

    by Anita Coney ( 648748 ) on Wednesday May 05, 2004 @02:57PM (#9066386) Homepage
    I used to be afraid of what Palladium could do for the computing industry. Many tried to convince me that there was nothing to fear because there was no way in heck Microsoft could ever get anything done right and on time. It appears they were correct. Now it's being pushed back to Longhorn, which is being pushed back to oblivion. Now I'm left wondering what all the fuss was about.

    Heck, Microsoft cannot even secure its own "proprietary" gaming console, why did we ever fear that they'd lock down all of our computers?!
    • I admit that Microsoft is incompotent, but you REALLY should not underestimate what a company with BILLIONS of dollars in liquid capital can do.

      We only have 2 PC BIOS manufacturers now... Do you think that for a billion dollars they really wouldn't instantly put Microsoft's DRM restrictions in their BIOSes?

      I don't advise anyone to be scared, but I certainly advice everyone to pay attention to the progress they are making, and whatever you do, don't dismiss it, or it'll be here before you even realize it.

  • Tigerdirect is selling [tigerdirect.com] what they claim to be "The Next Level of Computer Security for Your Home or Office". I think their definition of computer security may be a bit different than yours or mine however, as one of the major selling points is a "-110 decibel siren to sound alarm and scare off intruders". Imagine that bad boy going off every time the machine is violated by the Windows worm de jour! ;)

  • Security vs Safety (Score:3, Interesting)

    by master_p ( 608214 ) on Wednesday May 05, 2004 @05:37PM (#9067787)
    Windows are secure. They are not safe, though. Security is different than safety.

    Something is not safe when its maker has made mistakes that all third parties to use it.

    Something is not secure when it is not guarded, i.e. there is no one to watch over it.

    Microsoft should increase the safety of its products, i.e. remove all the bugs. They are secure, already. There is no unguarded place in Microsoft Windows NT/2000/XP (unlike its baby O/S).

    Palladium has nothing to do with safety or security. It only has to do with copyrights, i.e. to prevend from unauthorized access to media.

    I am surprised that Microsoft has not made a tool to grep the code for buffer overruns and other potential problems. With all the compiler technology they have, it would be very easy for them.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Close