3 New Windows Security Problems Found 190
DotNM writes "USA Today is running a story that outlines three security issues in Microsoft Corporation's popular Windows desktop operating system product. It describes the issues and urges users not to download .hlp files from email attachments. Apparently there are issues, even for a Windows XP system patched with Service Pack Two."
"Issues"? (Score:5, Insightful)
What has become of the word "problem"? "Issue" is marketdroid-speak.
News flash (Score:3, Insightful)
Hey, let me give you all a tip.....even if the future service packs for XP reaches version 10, it will alway be insecure and full of critical issues that are discovered by people other than Microsoft.
At least with Linux, the community usually discovers them first and before the problem is made public there is already a patch available. Now, these poor saps with Windows machines will probably have to wait weeks for a patch. Meanwhile, thier machines are being zombified as I type and turned into spam gateways.
People could still use internet safety education (Score:2, Insightful)
Yet people will continue opening strange attachments.
I hardly blame Microsoft for this with people uneducated enough to open a
Merry Christmas, learn how to use the technology you spend your cash on, etc. Love Wilson.
Re:OMG, an OS with security issues... (Score:3, Insightful)
Try MS-DOS. No remote root exploits in over 23 years. No new viruses in a decade. No malware. No worms.
Of course, you have other options. You have the classic Mac OS, CP/M, Apple DOS, etc.
My point? Every OS that provides services to the Internet isn't 100% secure. Sure, Linux and *BSD may be more secure than Windows, but Linux and *BSD aren't perfect.
Re:ANI... (Score:3, Insightful)
Re:Linux Flaws (Score:5, Insightful)
There is no way to compare flaws in Windows and Linux, and every attempt to do so is misguided. The reason is that the politics behind disclosure for Microsoft is entirely different than for Linux, so there is no way to link them statistically.
From the classic "there is one error for every thousand lines of code in a mature program" logic, a person could estimate how many bugs are present in both code bases and look at the number of published bugs to see who is covering their butts more. I'd guess Microsoft has more to lose from bad PR, so odds are they have internalized most knowledge about bugs.
Re:Surprise, Surprise... (Score:3, Insightful)
The averege user have no clue that they should not open attachements. The average user don't read media that warns about not opening attachments. The watch Desparate Housewifes and Biker Build-off and Cops and Americas Funniest Videos.
Don't for one second think that the average user has any clue about what to do or not do in Windows oe any other OS for that matter.
Re:News flash (Score:3, Insightful)
...and therein lies a weakness. Sure if you take a major project like Apache or MySQL then they will be scrutinised very carefully, however one could also argue that this increases risk as a skilled hax0r could spot a potential exploit in a way they couldn't with closed source (which, I will wager is what happened with Santy). There are (obviously) arguments for and against closed / open source, however if I may remind you of your own comment:
At least with Linux, the community usually discovers them first and before the problem is made public there is already a patch available.
And we compare this to the Santy situation, sure - there was a patch and workaround issued quickly, however 670,000+ sites still got compromised; it doesn't matter how quickly a patch is issued - once a fast spreading worm is in the wild the only thing that is a working defence is good basic security principles, such as you already mentioned, setting correct file permissions. If a worm can cover the planet in 15 minutes you ain't going to be hearing about the exploit and patching your box in that time. We humans are simply too slow. There is no substitute for a skilled admin. As you say, the code is only as good as the coders, and if that code isn't being checked by anyone who is skilled enough to spot these problems and it's just so damn useful (i.e. phpBB) that it becomes popular and therefore gets installed by lots of people who don't apply basic security principles then we have all of the ingredients for a potentially serious problem.
I'm not having a go at you here, I'm merely pointing out that it is unwise to be lulled into a false sense of security just because one uses OSS.
Re:In other Words (Score:2, Insightful)
Re:News flash (Score:2, Insightful)
With open source, the vuln is usually found by the ones developing the project or a group that has forked the code. The patch and new version is released before the exploit code. So, when an exploit comes out, you have a place to go to get a patch.
These vulnerabilies are STILL not fixed. Its been like 4 or 5 days.