Your comments seem to indicate that you are simply another anti-Microsoft
zealot. For example, you say, "While MS is making (at least publicly) an
attempt to repair security flaws...". In fact, Microsoft IS repairing
security flaws. Perhaps you can explain how you can publicly repair
security flaws without doing so internally. If you've been reading tech
news over the last few years, you would know that Microsoft is absolutely
committed to security. You would also know that Windows is the most secure
operating system available today.
You disagree with me because of your lack of information and you bias. As
an example of my assertion, there was recently a security hole in Linux that
allowed someone hitting a Web server to easily elevate their privileges to
root. It was widely reported. You know how long it took them to fix it? 8
months! That's just unbelievable, and it's laughable that anyone would
claim that Windows is less secure than that. By the time you read of a
security flaw in Windows, Microsoft has already patched it, and Microsoft is
the only company that has a very simple and effective way to ensure that
your OS is always up-to-date.
Concerning the parent-pathing issue (../../), for YEARS, Microsoft has
recommended not allowing parent paths on the Web server. In fact, the IIS
Lockdown tool (available for a few years itself) disallows this and other
security holes. It is up to the server administrator to enable parent
pathing. Most do because they don't want to have to tell developers not to
rely on parent pathing. Make that choice and the consequences are yours,
not Microsoft's.
Concerning the requirement to have a Windows account in order to be
authenticated to the Web server, how in the world do you perceive this as a
security flaw? Your criticism of this approach shows a bit of
short-sightedness. Do you develop multi-tier Web applications? I don't
think you do, because if you did, you would realize how critical such a
system is to a good user-experience. In a multi-tiered environment, I may
hit five or six different resources that require authentication. You think
it's actually a good idea to require users to enter their credentials over
and over and over and over? Worse yet, do you think it's acceptible to
allow multiple systems to authenticate me by proxy? Microsoft systems don't
allow that unless you have explicitly configured delegation. Once again, a
very secure architecture.
It is also much more secure to use integrated security for data source
connections than it is to use the credentials in plain text in the
connection string. People who understand complex application architecture
and security issues across systems understand how critical Windows
Integrated authentication is, and with Kerberos authentication and
delegation, Microsoft has a very good story to tell in this area.
To close, I think it's clear to those who think about these matters that
security holes in Microsoft products (even though they are already patched)
are more publicized than in other systems simply because of the fact that a
very high percentage of computers in the world are running Microsoft
software. If you were a virus or worm writer, would you target a system
used by single-digit percentages, or would you target systems in use by a
wide majority of people in the world? I know the answer, and I think you do
too!
--
Jim Cheshire
Jimco
http://www.jimcoaddins.com
================================
Author of Special Edition
Using Microsoft Office FrontPage 2003
5 Stars on Amazon and B&N
================================
The opinions expressed by me in the
newsgroups are my own opinions and
are in no way associated with my
employer or any other party. Jimco is
not associated in any way with any other
entity.
....I just came back from a client's