CCIA Urges Dept. of Homeland Security to Avoid Microsoft 413
An anonymous reader writes "The Inquirer has posted an article reporting that the Computer and Communications Industry Association (CCIA) has urged the US Department of Homeland Security, in an open letter to Tom Ridge, secretary of the department, to avoid using Microsoft software because Microsoft's software is 'riddled with obvious and easily exploited vulnerabilities.'"
and in other news... (Score:5, Insightful)
Re:and in other news... (Score:3, Insightful)
Money. It boils down to money.
Re:and in other news... (Score:3, Interesting)
There was nothing wrong with a load of Enron shares in your portfolio a few years ago, either...
Yes, Microsoft is about money, but I wouldn't want to risk my investment money in a company with the medium term business issues Microsoft currently face, or in a company that engages in the same sorts of dubious accounting practices as Enron (don't ask, Google) and just hasn't been caught yet.
Re:and in other news... (Score:2, Informative)
It took around a year to drop from a high of around $60 to a low of about $20, and that's a 66% drop.
Re:and in other news... (Score:2, Funny)
and in other news still... (Score:5, Interesting)
Man if it wasn't for timestamps, I'd swear we were in 15th century Britan. Hello Fifedom!
The real threat isn't the flaws!!! (Score:4, Insightful)
Just like freedom in the USA is the only real reason why it's so much better than the enemies, the freedom offered by Linux and the GPL has an internal value that makes it so much better than the alternatives. Only that is then end game, and only that is what will make us truely secure.
I Can See Them Now.... (Score:2, Insightful)
On a more serious note... blah
Re:I Can See Them Now.... (Score:4, Interesting)
I believe in MS on the front-end, linux on the back-end, running a virus gateway at the mailservers, antivirus software at the desktop, and centralized patching to fire off new patches on all desktops at once. That said, I would only put MS on the back-end at gunpoint. Linux may not need any of that protection at the desktop, but the lack of apps keeps it from being as usable; the apps that are available are not very compatible with what everyone else is using. In these days of limited sysadmin resources, I would rather the users have a very intuitive package in front of them to minimize calls like "how do I start using this? I have to source what and do what to my environment?" The sysadmin resources should be left to take care of the valuable back end.
Linux is far from 100% secure...take a look at various security bulletins each week and you'll see all sorts of apps that are being patched. Have we forgotten past Linux worms? How many recently patched phpBB2 or Nuke for recent problems according to those advisories? Where is the mantra of "the hole shouldn't be there in the first place?" that is constantly fire off at MS when those holes are found in open source software? Is it because many Linux apps are like that and the blame is distributed across a multitude of developers rather than a single monolithic software company that simple minds can more easily divert their attention to? Sorry, but "they patched it within 8 hours" is not an excuse. For both platforms, "the hole should not have been there! where is the code auditing that should have prevented that problem from being there in the first place?" As complex as software is becoming, I do not think that this is going to go away without radically altering current coding practices.
What we need is a very large corporation to adopt 100% Linux (reference Guinea Pig in wikipedia) so that apps become more compatible and patches are more easily recognized. We've seen smaller companies like Ernie Ball do this, but we need bigger testbeds. Then, we can complain in 10 years about the Linux juggernaut and how Putrix is better.
It's all about the approach (Score:3, Insightful)
In fact, they would be able to use a framework for distribution through their computer n
Duh... (Score:2, Informative)
Duh...
Re:Duh... (Score:3, Insightful)
the report told them (Score:4, Funny)
Re:This is actually funny... (Score:2, Funny)
Re:oh yea? (Score:3)
(and no one better say anything about the spelling.)
Pretty obvious (Score:5, Interesting)
Re:Pretty obvious (Score:4, Insightful)
Re:Pretty obvious (Score:5, Insightful)
Favorite line: "Although Unix is more reliable, Redman said, NT may become more reliable with time"
I live in that area, and there are a LOT of Msft job openings requiring security clearance these days.
Re:Pretty obvious (Score:2)
Well I guess it depends on perspective. More reliable than NT? Sure.. More reliable than Unix? I think not.
Comment removed (Score:4, Insightful)
Re:Pretty obvious (Score:2)
Yeah, but are those used for *important* things? Bear in mind that what the DOD counts as "important" may be more life-and-death stuff.
Re: (Score:2)
Re:Pretty obvious (Score:2, Insightful)
Re:Pretty obvious (Score:3, Interesting)
Indeed it is, which is why nobody is saying it here. I'm not Dick Cheney, so I can't speak for all of DoD. The group I work with doesn't use Microsoft products in anything that has to be a) secure and/or b) reliable.
Re:Pretty obvious (Score:3, Informative)
How typical of someone who works in defense- you haven't the slightest idea what goes on anywhere except in your little world.
Remember the destroyer that had to be towed into port because its Windows network crashed and it was dead in the water, because someone entered a 'zero' into a database field, and windows shit the bed? Yeah, the mission-critical functions of a nuclear powered destroyer
Re:Pretty obvious (Score:3, Insightful)
Remember the destroyer that had to be towed into port because its Windows network crashed and it was dead in the water, because someone entered a 'zero' into a database field, and windows shit the bed? Yeah, the mission-critical functions of a nuclear powered destroyer aren't very important.
If entering a zero into a database field causes Windows to crash, it's because a badly written device driver (more than likely NOT provided / approved by Microsoft!) was the cause. Next question: Why is your code bl
Re:Pretty obvious (Score:3, Insightful)
If that is true, Microsoft is in even worse shape that I think it is.
Re:Pretty obvious (Score:3, Interesting)
Re:Pretty obvious (Score:5, Interesting)
(The machines running the actual applications were also Windows boxes.)
The Windows boxes were considered "safe enough" to put on the public network. If it wasn't Windows, even if it had an A1 rating, Gibson's "Black Ice", and half of Fort Knox guarding it, it was considered unfit for use on a public network.
From what I've been told, by people working in the US Navy, Windows computers on ships are often riddled with viruses and other nasties. Protection is minimal to non-existant. I've no reason to doubt these first-hand accounts.
The use of Windows, alone, is not the problem. Windows can be made reasonably secure, and proper counter-measures do exist for dealing with intrusions and viruses.
The problem is in the sheer reckless stupidity of key personnel who are high enough up the chain of command to enforce their stupidity on others. You cannot afford to have such people in any key organization, much less an organization whose role is national and international security.
I don't want to imagine what would happen if critical RADAR stations or missile systems were ordered to switch to Windows. The Department of Homeland Security is all fretting about "sleeper cells", while the DoD seems to be spending its time asleep.
I can say, from practical experience, that Windows is used in situations for which it is not authorized or certified. I can also say that the use of Windows in potentially vulnerable situations is on the rise. Sure, there's nothing I can do about it, but that doesn't mean I like it.
Would I work in such situations? Already have, and I would again. Why? Because Government jobs pay better than any company I might be able to talk into using a secure environment.
That's the sad part of it. I could very easily build you a computing environment that had rock-solid security, combined with phenominal ease-of-use, combined with amazing performance, for less than it is costing companies to install and maintain Windows, plus pay for outage caused by viruses and crackers. I'd say that probably 30-40% of all regular Slashdot readers could.
As Megadeth noted on one of their albums:
Re:Pretty obvious (Score:3, Insightful)
Let's consider, then, how the issue can be addressed. So-called "Trusted" Operating Systems (ie: OS' that have a B2 rating or better) have certain capabilities that address the human element.
A "Trusted" OS, for example, iso
Re:Pretty obvious (Score:5, Interesting)
Funny... I'm in the Marine Corps (part of the DoD last time I checked), where we and the Navy have a mandated Microsoft-only procurement requirement. Not just "you have to justify buying non-Microsoft software" but "you have to prove that a Windows NT platform absolutely cannot do what you need to do". The usmc.mil website runs Domino (and doesn't properly sign its certificates... grrr....), but the entire Navy/MC WAN is NT4.
Maybe our WAN is not what you are calling "important". It's true, we don't put Windows on fighter jets or in tanks, but we don't put UNIX in them either. So maybe the medical and service records of all the men and women in the Navy and Marine Corps aren't "important" to you, but they're damn sure "important" to me, and I'm outraged that the network seems to have been compromised over the past few weeks.
Re:Pretty obvious (Score:3, Interesting)
Hmm... makes me wonder what the V-22 Deathtra^H^H^H^H^H^H^H^H Osprey was running
Then what? (Score:4, Insightful)
People tend to forget that more holes are found in Microsoft products partly because more people use Microsoft products. As a result, that's where the attackers focus a great deal of their energy. Linux would have the same problem if it had Microsoft's market share.
Re:Then what? (Score:5, Informative)
Linux has more market share than Windows in the server market, yet Windows has a disproportionally higher frequency of reported critical OS flaws.
Re:Then what? (Score:2, Insightful)
Re:Then what? (Score:2)
What's your source of the number of "reported critical OS flaws" in linux?
Re:Then what? (Score:5, Funny)
Re:Then what? (Score:3, Insightful)
Obviously popularity isn't the *only* reason that vulnerabilities are found. ISS is just a suck-ass product, and a lot of people use it as it comes with the OS -- in unpatched and default configuration. That's why it has more holes than the pretty robust Apache.
But the argument it responds to is saying that The windows OS does have decent security, but more bugs are exploited due to its popularity. In this context, talking about IIS vs Apache i
Re:Then what? (Score:5, Insightful)
For 8710 [debian.org] packages across 11 different architectures, only 23 announcements isn't bad at all. That's 1 out of every 355 packages.
If you wanted to extrapolate from there, MSFT has what, maybe 100 or 200 software packages? Let's say 250 and be fair. According to Windows update, I've had 4 security related updates this month. If Microsoft distributed as many packages as Debian does, that would equate to 128 patches over the same time period.
I'll stick with Debian, thanks.
Re:Then what? (Score:5, Informative)
All bugs in Linux, whether exploitable or not, whether severe or merely cosmetic, whether dangerous or merely annoying (or just plain non-optimal), are publicly announced and fixed at the time they are found.
Microsoft publicly announces only a small fraction of the known bugs and security problems found in its products. If Microsoft were to be as thorough in its security announcements and fixes, you would be inundated with 8 new announcements, if not more, per hour, every day, for the rest of your life.
Re:Then what? (Score:4, Informative)
Ummm...yeah. I guess the fact all Linux distros which I've seen have Apache "in unpatched and default configuration" (unless the user chooses to not install the web server) doesn't matter?
Yay! Another idiot who just counts the number of vulnerabilities instead of paying attention to what they are. Somehow things like: "Steve Kemp discovered a buffer overflow in zblast-svgalib, when saving the high score file. This vulnerability could be exploited by a local user to gain gid 'games', if they can achieve a high score." don't scare me. Lots of this is obscure stuff in the first place--who uses the atari800 emulator? Who uses LinuxNode--some sort of amateur radio networking(?) program? I've never even heard of it.
Many of these are local compromises--something MS has just barely started looking at. Many of these are programs which wouldn't be included with a Windows disk. Linux distros often come with hundreds (or thousands) of different programs, and would not normally be installed. Debian comes with over 8710 packages.
What about multiple programs which do the same thing? One of the vulnerabilities was a program which uses qmail. I believe Debian also has sendmail and postfix. So were counting problems with all three? And programs which attach to them as well? Is someone going to install all of these mail servers on their box? How many mail server programs does MS make? About wu-ftp, there also appear to be multiple ftp server programs. Do we count them all? Wu-ftp is well known to be insecure. Does this mean "Linux" is more insecure than Windows if someone chooses an insecure ftp server when their distro gives them the choice of several?
Very few of these vulnerabilities would even touch the default install, and the video games? Well, maybe we should include all the video games you can buy for Windows. Oh no! What if GTA: Vice City will allow people to cheat by changing the high scores file??? That's a major vulnerability! We'd better notify the security team and get all our Windows boxes patched! Even the ones which don't have GTA installed!!!
Just counting the number of vulnerabilities is the red herring. Most of those MS wouldn't even pay attention to and insist they aren't even security related. Linux and developers of other systems such as FreeBSD and OpenBSD are far more paranoid than MS could ever dream. That is why you see more security announcements for them. It means they are MORE secure, not less. Would you say a security guard who sleeps on the job is more secure than a guard who reports every little incident??? The sleepyhead only reported three problems last month! He must be doing his job! Never mind the fact half our inventory disappeard on his watch. That could've happened to anyone.
Re:Then what? (Score:5, Insightful)
Re:Then what? (Score:3, Funny)
1) There has never, at any time, anywhere on the face of the planet been any security problems in any software produced by any company, other than Microsoft.
2) The only reason for the multitude of releases of all other software, is to add features and f
Re:Then what? (Score:5, Interesting)
If they are obvious, then we already found them. Numerous... I don't think so, not in the core system. When a new Linux vulnerability comes out, it's big news and dozens of hackers descend on it immediately. Then when the fixes go out, they are *easy* to apply and highly unlikely to break anything unrelated in your system.
Any new features that go into core systems get heavily peer-reviewed for security impact. That's *proactive* security. This process has been going on for 30 years (long before Linux appeared) and you might say, it's reached a state of comparative maturity.
This is the difference between security as an afterthought and security as a process. Besides that, Linux 2.6 has a gleaming new plug-in security harness. This allows the user to tailor their own security system. For example, mandatory access controls allow the administrator to limit the actions of any process, even root. The impetus for this originally came from the NSA [nsa.gov]. You can bet that's interesting to government departments across the board.
Re:Then what? (Score:5, Interesting)
A few days ago, I did a simple test using Mozilla's email client, where I emailed a copy of /bin/ls to myself, to see what Mozilla would do when it received a linux binary executable.
I'm happy to report that I was offered the choice to save it to disk, or to open the data with an application (which I had to choose without a default, and apps handle the binary data as data, not executable code).
When I saved the file to /tmp, the resulting binary was of course byte-for-byte identical to the copy in /bin, but Mozilla did not set the execute permission bit by default. Since I knew the file was ok, I type "chmod 755 /tmp/ls", and then I was able to run the executable.
I had to save the file, then locate the file using another application (I used a shell, but many people might perfer a file manager like Konq), and I had to explicitly change the permissions to allow the internet-received data to be able to run and have (non-root) control over my computer.
So, getting back to the original question.... it's safe to say the until linux systems are populated with dangerous email clients, email-virus writers are going to have to try a lot harder to trick users into executing their code!
Re:Then what? (Score:5, Informative)
This line--that Windows has the largest market share in worms and viruses because Windows has the largest market share--was trotted out in the last few weeks during the peak of the Sobig and Blaster activity, and routinely shot down. The problem is inherent design flaws, not market share. Many have pointed out that unix-type OSes run the majority of critical Internet services, and by the market-share argument, these services should be the subject of continual attack. And yet they are not.
In short, this argument that greater adoption of unix-type OSes by the masses will result in more unix-type worms and viruses is nothing short of FUD.
Have a look at Mac's Immunity to Recent Virus Attacks [slashdot.org] which came about in response to an article posted on MacCentral [macworld.com] on this topic. In sum, some columnist repeated the assertion that "Macs have "no more inherent security" than their PC counterparts, it's just that they've failed "to capture interest" among the creators of these viruses." This post [maccentral.com] is fairly representative of many, and makes clear the vulnerabilities of Windows are real, stem from technical reasons, and not just market share.
Mac OS X is the subject of the links above because that is where my interests lie, but the jist of the arguements could apply to any unix-type OS
Re:Then what? (Score:3, Interesting)
So you end up with, sure if bugs are found for Linux, they'll probably get fixed faster, and from past experience with Linux and bugs this is very very true.
Re:Then what? (Score:2)
Re:Then what? (Score:2)
The best solution will percalate to the top rather than having the top dictate what you will use.
Re:Then what? (Score:2, Insightful)
Hardly. Consider this: Linux programmers increase in number with the penetration of Linux. As Linux penetration grows, so does the number of people able to fix security flaws. Whilst the number of crackers may increase, both sides of the
Re:Then what? (Score:2)
Then why are my Apache logs full of IIS exploit attempts, even though Apache runs on over twice as many servers [netcraft.com]?
Re:Then what? (Score:2, Interesting)
The lead story says "'riddled with obvious and easily exploited vulnerabilities.'"...How many people found the exploit that the blaster worm uses? Maybe a couple dozen at most? That doesn't seem like an obvious exploit to me. Heck, any exploit (*nix or Windows) that requires a buffer overflow of a certain amount of characters, or a specifically formed p
Re:Then what? (Score:4, Insightful)
Re:Then what? (Score:2, Insightful)
Wait a minute, no it hasn't. IIS has had literally an order of magnitude more critical flaws, and it's got far less market share.
Talk about false pretenses, Mr. WRONG AGAIN!
Your trolls and flamebait need to be modded down, but you'll probably be left alone this time because you used something as fancy as a numbered list.
Re:Then what? (Score:3, Interesting)
Re:Then what? (Score:3, Insightful)
Do you realize that you just contradicted yourself? You just identified a major difference between OSS and Windows--besides popularity--that affects security, yet concluded that if Linux became as popular as Windows, Linux would have the same problems.
But what happens if (Score:5, Funny)
Re:But what happens if (Score:2)
Re:But what happens if (Score:2)
I hear Richard Stallman agrees! (Score:3, Funny)
Next thing you know, it will be linked off of slashdot. This is highly irregular behavior, and very newsworthy.
Slow news day?
I'm so pissed off with MS (Score:3, Funny)
I'm going to mention this in my class, in front of everyone. I'm also going to tell them how flaky XP and MS products are in general!
This is a lesson to us future PHBs!!!!!Re:I'm so pissed off with MS (Score:2, Interesting)
To disable Messenger in XP Pro:
Click Start->Settings ->Control Panel
Click Administrative Tools
Click Services
Double click Services
Scroll down and highlight "Messenger"
Right-click the highlighted line and choose Properties.
Click the STOP button.
Select Disable or Manual in the S
Re:I'm so pissed off with MS (Score:2)
Actual Security (Score:2, Interesting)
Security!=Vulnerability (Score:2)
That statement is definitely correct, but even if windows can be setup to provide the same level of security as linux, the fact that MS is being targeted to a much higher degree than linux makes MS systems much more vulnerable.
Redundant (Score:5, Interesting)
I think their model works better than Red Hat's, where I get 3-5 emails a day notifying me of critical software fixes
If you took a few minutes to read those fixes you would realize almost all of them are "proactive", that is, they are fixing vulnerabilities, before an exploit is made against them. This is intrinsic in the OSS model, where experts worldwide examine the source code all the time, for instance in university classes and research centers. Commercial, closed-source software, on the other hand, usually is examined only by crackers who throw anything they can at the software until it breaks.
Personally, the system I prefer is Conectiva's, where apt-get is combined with rpm packages. Running "apt-get update; apt-get dist-upgrade" each time I get a vulnerability warning takes much less time than deleting spam, even in my relatively well protected email account.
I knew it! (Score:5, Funny)
In a similar note... (Score:5, Interesting)
With the right push, we might see the tides change in *nix favor.
obvious and easily exploited and easily patched (Score:5, Interesting)
The fact is, you can make windows as secure as any other OS out there, as long as you know what you're doing.
I think it's fishy that they don't back up their "obvious and easily exploited vulnerabilities" claim with any real examples. The only evidence they provide is Blaster and SoBig -- an exploit for a vulnerability patched a month in advance, and a simple dumb-user email worm. Unfortunately all anyone sees is the fact that two worms came out near the same time -- and not the fact that they could have been prevented easily by more competent sysadmins and informed users.
Anyway, I think it would be cool to see the DHS use a less-mainstream OS. But I don't think this open letter makes an argument any more sophisticated than the "microsoft sucks! You'll get a million viruses dude!" spouted off by any 13-year-old linux zealot.
Re:obvious and easily exploited and easily patched (Score:3, Informative)
For a hole that was in the system for years, which is similar to many other major in the news exploits. The fact that the patch was available for months is little consolation if there were nefarious groups who were aware of these holes for years, which is something that no one can conclusively answer.
I think the simplistic "all other systems are secure, but MS systems are weak" zealotry often repeated by the puppets is incredibly weak, but a
Re:obvious and easily exploited and easily patched (Score:4, Insightful)
What turns that glib claim into a lie is, with closed source it's impossible to know what you're doing.
Never mind that security has never been an overriding concern in Windows' basic design. The end result speaks for itself, as any 13 year old can see.
Windows not as securable as UNIX (Score:5, Interesting)
Can you?
Can an NT administrator, using user level tools, perform the equivalent of a chroot jail? Can he make specific apps suid or sgid?
While Windows technically does not imply use of other Microsoft products, it does tend to be correlated with it. Outlook has had numerous poor security decisions that a mail admin simply cannot fix. IIS has also had poor architectural decisions. Remember MS swearing that they'd rewrite the thing from the ground up for the next release? The design of IE -- permeating the entire OS, providing many services to applications, and with no internal security model in place, makes for all kinds of nasty problems. It's a great way for spyware to slip pass personal firewalls, it's used in places like Outlook where a full-blown HTML renderer with the huge variety of features it has is a pretty bad idea from a security standpoint, and it provides a high degree of control to remote websites over the local computer -- much higher, than Mozilla.
The MS Blaster issue wasn't actually all that egregious, AFAIK. It's not like UNIX systems haven't had RPC flaws in the past, either. The real problem was the number of unmaintained machines that were vulnerable. I'd call something like Melissa, that relies on phenomenally stupid security decisions from Microsoft ("let's have an automatic execution environments in our documents, which are intended for wide interchange!") much worse.
Re:Windows not as securable as UNIX (Score:3, Informative)
I've never seen or heard of a NT sandbox.
Fortunately not. setuid is the door to so many Unix exploits it isn't even funny. For NT, you would use services to do this.
Setuid improperly used, sure. To say that suid is flawed is ridiculous, though. It's an interface for giving privilege escallation with an application-defined interface. You cannot say that something that basic is
Re:Windows not as securable as UNIX (Score:3, Insightful)
Known exploits are not the problem. I have protected myself from many *unknown* exploits on my UNIX systems (layers of stateful ingress *and* egress filtering, chroot jails, system-level IDS, etc...). There is a lot of research taking that even further.
Besides, I wouldn't say something's securable just because fixes to previous problems have been easy with filtering or provi
Re:obvious and easily exploited and easily patched (Score:3, Insightful)
Well designed systems do not expose RPC control intended only for LANs to internet accessible interfaces, and they do not enable by default these services that very few users will ever need.
Well designed email clients do not allow users to easily execute code. For example, mozilla in linux will only allow you to save an attachment that appears to be code
Re:obvious and easily exploited and easily patched (Score:2)
Something more helpful would be... (Score:4, Insightful)
ANY software can be compromised to ANY degree. There are just as many exploits lurking in an Open Source distribution (let's face it, it's rare that someone uses ONLY the Operating System), as there are in anything.
Implementing (and adhering to) strong policy, working diligintly to keep systems updated, and keeping users informed. These are essential parts to creating (and maintaining) a "secure" infrastructure.
Granted, it's easier said than done; but it's possible. There are FAR MORE corporations/entities that DID NOT get affected by blaster/sobig/melissa/codered/etc. than there are corps/entities that did.
What are the Impartial Objectives? (Score:5, Insightful)
It would be totally inappropriate for a goverment agency to blacklist a specific vendor without going through extensive hearings. That does not mean that they should not consider the vendor's history when evaluating each purchase. For the anti-MS crowd that means that they should reject each MS product individually.
More seriously, they need to evaluate what their software requirements are. I strongly suspect that they need software which will:
Re:What are the Impartial Objectives? (Score:3, Insightful)
that is an oxymoron
Only empty, vague generalities are impartial. everything else is quite flexible. The appearance of objectivity is a red flag, especially when we're talking about politicians (or your job).
Good list though :-)
Re:What are the Impartial Objectives? (Score:3, Informative)
The GPL does not restrict the US (or any other) government (or any company, for that matter) from keeping modifications confidential. As long as the government does not distribute the software outside of itself, it can do whatever it wants. T
There are bigger issues here as well (Score:2)
Huge, HUGE surprise here...NOT! (Score:5, Interesting)
Re:Huge, HUGE surprise here...NOT! (Score:2)
Re:Huge, HUGE surprise here...NOT! (Score:3, Interesting)
"CCIA Unsuprised By New Evidence in European Commission Microsoft Case, Stresses Importance of Effective Remedies"
"Attorney General Tom Reilly is right to continue fighting a settlement with the Microsoft Corporation that fails to protect consumers."
"CCIA Welcomes Microsoft "Netscape Fine"
"CCIA Condemns Microsoft Predatory Pricing Scheme "
"CCIA, SIIA Filing Brief Appealing U.S. v. Microsoft Decision"
FUD!!! (Score:3, Interesting)
Or, is it just that since there are so many machines running Microsoft OS's, it is just easier to find and exploit these bugs?
I have yet to be convinced that the open source model truly leads to fewer bugs and vulnerabilities. Yes, more eyes can see the code, but still these many pairs of eyes miss things. Look at sendmail for crying out loud.
Woes of a faulty operating system (Score:2, Insightful)
Too bad Linux-philes are running in too many (bleeping) directi
OSS more secure? (Score:2, Insightful)
So can Open Source developers do a better job of building secure software? Is this an area in which Open Source software can compete with Microsoft?
Yuioup
666 Eleventh St? (Score:2)
There's a joke in there somewhere..
About CCIA (Score:5, Informative)
Our member companies range from Sun Microsystems, Fujitsu, Nokia, Nortel Networks, Tantivy, Time Domain, and Vion to AT&T, Verizon, NTT USA, Oracle, Intuit, Yahoo!, Sabre, and AOL
Its the who's who of MS competition.
Idiotic (Score:3, Interesting)
Maybe this letter is a step in the right direction in this regard, but I have to believe that DHS already knew all of this. They are, after all, a government department DEDICATED to security.
New Commercial (Score:4, Funny)
Microsoft Yearly Earings $6.16 billion.
Microsoft Cash Reserves $46 billion
Microsoft Market Share 92% of the Desktop
Watching Ed Black poke Microsoft with the sword of it's own making - Priceless
Easy to say, not so easy to do (Score:2, Insightful)
The relatively easy part would be replacing simple desktop functionality. The not-so-easy part would be identifying and analyzing all of the custom software used by the US Federal governement that is deployed using Microsoft-specific technology (e.g. Visual Basic).
Even if there IS
It can be done step-by-step (Score:4, Interesting)
Not news (Score:4, Insightful)
CCIA's mission is to further our members' business interests by being the leading industry advocate in promoting open, barrier-free competition in the offering of computer and communications products and services worldwide.
Maybe I'm missing something, but this seems like nothing more than a high powered Washington based lobbying group whose business constituents are diametrically opposed to Microsoft. How is this even news?
If you listen very closely... (Score:2)
You can hear faint laughter from a basement in Iraq, perhaps echoed from some remote cave near the Afghan-Pak border.
However, in other news... (Score:4, Funny)
"Well, two organizations support Microsoft, only one against" said Tom Ridge. "I guess that means we'll stick with Microsoft!"
Why quote from a newspaper? (Score:3, Insightful)
Quoting someone to add weight to your argument, whether it's a philosopher, pop star or journalist, generally removes credibility from what you're saying because it suggests that you don't feel your argument is strong enough on its own.
If I were posting a comment on Slashdot about security, for example, and I quoted a security expert, then that would be fair enough because the intention would be to reference knowledge that I couldn't personally have.
But the CCIA published their open letter because, supposedly, their opinion is important and should be taken seriously. Quoting a journalist, especially at the conclusion of the letter, seems inappropriate and even a little desperate.
Oh yeah? (Score:3, Insightful)
The bullshit is yours. (Score:5, Insightful)
If I had gone and said the north american power grid should be replaced at the wake of the outages [ . . . ], I would have been accused of countless acts of civil disobediance.
My first question is what is wrong with Slashdot? I mean someone saw fit to give the parent coward "Insightful" for what she or he wrote? Someone wind the clock back before 2000 when Slashdot wasn't frequented by Microsoft apologists.
I'm not sure what makes you think your exercising your 1st Amendment right to speak freely (assuming you're a US citizen) would be branded civil disobedince, but in case you're really worried (and not just ranting) know you're in good comapny: first, the outage of August 2003 has produced a US-Canadain task force to investigate problems with the aging power grid [nrcan.gc.ca]. In fact, the power grid is so important that it is the subject of dozens of assessments [nerc.com] conducted by North American Electric Reliabilty Council [nerc.com]. Let's just say that NERC is not sanguine about the reliability of the North-American power grid. The problem is so widespread that even US lawmakers anticipate a massive political dispute [nytimes.com].
Regarding your comparison of the power grid to the Internet, network events such as MSBlaster and Sobig.F highlight the fragility of an information network built of insecure nodes. At present, the overwelming majority of the nodes of the Internet are powered by Microsoft software. For better or for worse, "press releases and open letters right at the wake [sic] of major worms" draw attention to the real effects of maintaining so insecure an information network. MSBlaster and Sobig.F are not theories but facts and so prove the unreliability of an Internet composed mainly of Microsoft-powered nodes. The timely discussion of network events such as MSBlaster, Mimda, Code Red, Sobig.X, etc. in the press should, in my opinion, be an obligation of network adminstrators.
Given your post, you'd probably have us ignore the problem in the hopes that the next worm/virus/trojan does not damage our shared information network even more spectacularly. Thanks, but I would rather disseminate information and share data about such network events rather than stop my eyes, ears, and mouth with sand.
Re:bullshit not worth even reading... (Score:3, Informative)