MicroMonopoly aids Terrorism?

K

kurttrail

"[T]he link is formatted to take advantage of an Internet Explorer flaw
that allows an attacker to hide the true destination of the link; in this
case, the address bar in Internet Explorer displays "www.fdic.gov," while
the actual Web site is at a different address in Pakistan." -
http://zdnet.com.com/2100-1105_2-5146716.html?tag=zdfd.newsfeed

And I wonder who in Pakistan would want to know about the financial details
about American citizens? Who in Pakistan would want to exploit the fears of
the American populace for their own nefarious purposes? Who, indeed?!

Is MS glacial response to fixing the address bar flaw also helping
terrorists fund future attacks on the innocents?

Stop dragging your feet MS, people are now possibly being terrorized in
their homes because of your Swiss cheese software! Get a temp fix out that
informs people of the misdirection at the very least, if it's really that
effin' hard to fix fully.

PROTECT YOUR CUSTOMERS FROM YOUR MISTAKE, *NOW*!

This should be a lesson to everyone why you can't put all of computer
security eggs in one monopolistic basket!

Demonstrations of the Address bar vulnerability:

http://www.microscum.com/misc/devil/

http://www.microscum.com/misc/intransigence/intransigence.htm

Download & setup up Mozilla as your default browser, that way when you click
on a link in email, you'll know what website you're really being taken to.

http://mozilla.org/download.html

Protect yourself, because MS's desktop monopoly gives them absolutely no
incentive to fix their own mistakes for their monopoly locked-in customers!

There should be an investigation into how MS's desktop monopoly has weakened
the safety of the general public!

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
G

Guest

Just quit with scare tactics, Kurt. Do you really think terrorists are in their bunkers on a lap-top trying to obtain your bank account number? This is a pathetic attempt to promote your ridiculous website (yes, RIDICULOUS). You are a JOKE. Get a life you former band-geek turned computer-geek
 
M

Mike Brannigan [MSFT]

see
http://support.microsoft.com/?id=833786
For advice and guidance on protecting yourself from these sites.

User who are still concerned about this issue may also wish to look at a
third party tool/plug-ins at
(Note :- not Microsoft recommended or supported by us. This is one of a
number of such third party tools)
http://xforce.iss.net/xforce/alerts/id/159

--
--
Regards,

Mike
--
Mike Brannigan [Microsoft]

This posting is provided "AS IS" with no warranties, and confers no
rights

Please note I cannot respond to e-mailed questions, please use these
newsgroups
 
K

kurttrail

Mike said:
see
http://support.microsoft.com/?id=833786
For advice and guidance on protecting yourself from these sites.

Oh yeah! The average computer illiterate is lucky if he find his way to
Windows Update, let alone some obscure support document hidden among tens of
thousands of other ones.

Fix the problem! Stop the brush off! People are getting screwed even as we
speak.
User who are still concerned about this issue may also wish to look
at a third party tool/plug-ins at
(Note :- not Microsoft recommended or supported by us. This is one
of a number of such third party tools)
http://xforce.iss.net/xforce/alerts/id/159

It's just plain safer to use another browser, till you guys get your asses
in gear, and even then it's just a matter of time, before your next security
vulnerability is found and exploited en masse. Smaller targets are just a
hell of a lot easier to miss, than the monopoly-bundled browser in MS's OSs.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
K

Karl Levinson [x y] mvp

kurttrail said:
Oh yeah! The average computer illiterate is lucky if he find his way to
Windows Update, let alone some obscure support document hidden among tens of
thousands of other ones.

That's exactly why this IE URL spoofing issue is a whole lot of nothing.
The average computer illiterate is going to fall for phishing whether or not
the URL is spoofed using this issue or another issue or isn't spoofed at
all. I can think of a lot of ways to spoof a URL for which there is no
patch and for which multiple browsers are vulnerable. The average person
would trust a popup window that doesn't even have a URL field in the window,
or that uses the http://user@domain URL spoof, and then there's ARP
spoofing, man in the middle attacks, DNS spoofing and cache poisoning,
sniffing, Dsniff, and all sorts of vulnerabilities in web browsing and
TCP/IP that aren't Microsoft's fault and for which there are no patches.

It's true that Microsoft has been waiting to deploy their fix for an
unusually long time [I would guess they've already coded the fix a while
ago], but I have to imagine there's a reason for their decision to do this,
given the flack they've already received over this.

If the average user can't find his way to Windows Update, despite having the
windows update agent installed and an icon right on his start menu, then
that average user is going to be vulnerable to all sorts of things no matter
what OS and browser he's running and what patches the vendor does or doesn't
release. [It also sounds like you're demanding that Microsoft release a
patch to protect its customers, but then state that most customers probably
wouldn't be able to install the patch if one was available.]

Anyways, security isn't just patches. A user that can't read articles on
how to be secure is going to fall for phishing. It's not really the best
idea to verify the identity of web sites by using the Address: field in the
browser, period.
 
K

kurttrail

Karl said:
kurttrail said:
Oh yeah! The average computer illiterate is lucky if he find his
way to Windows Update, let alone some obscure support document
hidden among tens of thousands of other ones.

That's exactly why this IE URL spoofing issue is a whole lot of
nothing. The average computer illiterate is going to fall for
phishing whether or not the URL is spoofed using this issue or
another issue or isn't spoofed at all. I can think of a lot of ways
to spoof a URL for which there is no patch and for which multiple
browsers are vulnerable. The average person would trust a popup
window that doesn't even have a URL field in the window, or that uses
the http://user@domain URL spoof, and then there's ARP spoofing, man
in the middle attacks, DNS spoofing and cache poisoning, sniffing,
Dsniff, and all sorts of vulnerabilities in web browsing and TCP/IP
that aren't Microsoft's fault and for which there are no patches.

It's true that Microsoft has been waiting to deploy their fix for an
unusually long time [I would guess they've already coded the fix a
while ago], but I have to imagine there's a reason for their decision
to do this, given the flack they've already received over this.

If the average user can't find his way to Windows Update, despite
having the windows update agent installed and an icon right on his
start menu, then that average user is going to be vulnerable to all
sorts of things no matter what OS and browser he's running and what
patches the vendor does or doesn't release. [It also sounds like
you're demanding that Microsoft release a patch to protect its
customers, but then state that most customers probably wouldn't be
able to install the patch if one was available.]

Anyways, security isn't just patches. A user that can't read
articles on how to be secure is going to fall for phishing. It's not
really the best idea to verify the identity of web sites by using the
Address: field in the browser, period.

You have every right to your opinion, unfortunately not everybody is as
computer literate as you, and just wouldn't expect that the address bar
would display anything other than the site of the web page that they
navigated to. Hell, I bet there are a lot of people that have only heard of
the term "phishing" in passing and think it's some reference to the band
Phish, and aren't aware that it's talking about scamming them.

It's MS's flaw that's being used to help validate a scam, or potentially
much worse considering the source of the scam.

This needs to addressed immediately, and not wait to be part of some IE
rollup patch. MS needs to stop dragging it's heels. And there should be an
official investigation in MS glacial pace of supplying a fix, and into how
their Monopoly OS is actually a menace to the general public's computer
security.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
R

Robert Moir

kurttrail said:
You have every right to your opinion, unfortunately not everybody is
as computer literate as you, and just wouldn't expect that the
address bar would display anything other than the site of the web
page that they navigated to.

I think the point is that too many people don't look at URLs anyway.
It's MS's flaw that's being used to help validate a scam, or
potentially much worse considering the source of the scam.

IIRC there was some talk at the time that mozilla also had a (much less
severe) problem with these kinds of URLs.
This needs to addressed immediately, and not wait to be part of some
IE rollup patch. MS needs to stop dragging it's heels.

If I thought they were waiting to include it in a roll-up fix then I
would/will agree with you. I've not seen anything pointing to that myself,
I'm assuming that fixing this is more trouble than it appeared at first and
they've had to go back to it a couple of times.
And there
should be an official investigation in MS glacial pace of supplying a
fix,

Official on the part of whom? Who has jurisdiction here? I can't help think
you are over-reacting a little Kurt. Of course, I am not going to tell you
that you are not entitled to your opinion, I'm just advancing the reasons
why I don't feel the same.
and into how their Monopoly OS is actually a menace to the
general public's computer security.

How about an investigation into how the general public is a menace to their
own computer security?

There are plenty of scams and worms out there which do _not_ rely on an OS
exploit to spread and they are among the most "popular".


--
--
Rob Moir, Microsoft MVP for servers & security
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html

Kazaa - Software update services for your Viruses and Spyware.
 
K

kurttrail

Robert said:
I think the point is that too many people don't look at URLs anyway.

Says you. And if it really is true, is that a good enough reason for
accepting MS's slacking?
IIRC there was some talk at the time that mozilla also had a (much
less severe) problem with these kinds of URLs.

Pray tell, like what? I overheard these two people talking once, and you
know what, they were saying that GW Bush is really Gay!
If I thought they were waiting to include it in a roll-up fix then I
would/will agree with you. I've not seen anything pointing to that
myself, I'm assuming that fixing this is more trouble than it
appeared at first and they've had to go back to it a couple of times.

http://www.iss.net/support/product_utilities/

Didn't seem so hard for these guys! MS could license it from them. What's
more important MS's customers security, or MS releasing their own in-house
developed patch?
Official on the part of whom? Who has jurisdiction here?

US Gov't. MS is still an American company. The Justice Dept. or even
Homeland Security, since it's MS's OS that has been the one that has been
exploited, time & again, at the expense of the security of the general
public.

Melissa, Code Red, Slammer, Blaster, Sobig, Swen, Bagle. It's MS's
fat-assed monopoly target that's putting the general public at risk. And
now MS is dragging of their feet on this address bar exploit! How many
times does a target have to get hit before ya'll wake up and smell the
coffee?!
I can't help
think you are over-reacting a little Kurt. Of course, I am not going
to tell you that you are not entitled to your opinion, I'm just
advancing the reasons why I don't feel the same.

Had this been the first or second time, you might be right. The
over-reaction is now is hiding your head in the sand and hoping that it will
all blow over, after time and again MS's Holey Software gets exploited at
the expense of the general public.
How about an investigation into how the general public is a menace to
their own computer security?

I ain't there fault that MS OS is the target of every computer literate
loonie on the effin' planet.

Are you telling me no one has ever pulled the wool over your eyes?
Everybody is a potential sucker, even the members of MENSA, but so many
people wouldn't be suckered with any one computer nasty, if MS wasn't the
only real OS choice for the Desktop.
There are plenty of scams and worms out there which do _not_ rely on
an OS exploit to spread and they are among the most "popular".

That's total BS, almost all of them rely on running on one company's OS.
And that's the biggest security hole in this nation's computer security.
Yes, there are some pests made for some other server OSs, but they've had a
totally negligible impact on the overall general public computer security,
and only helps to prove that having multiple OSs in the server market, helps
to diminish the effect of viruses and the like, on the public. A desktop OS
market with 5 or 10 players would be intrinsically much more secure for the
country, and the world as a whole, than having one big, fat target that
can't help from getting hit over & over & over & over & over again.

Wake up and smell the coffee, coppertops, because soon it will be just some
burned black crud at the bottom of the pot.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
J

Jupiter Jones [MVP]

Take a closer look at your list.
Many of those such as Blaster would have been a non issue if users had
simply used the patch that was available for weeks before Blaster came
on the scene.

It largely comes back to the users.
If the user will not properly protect their computer especially when
given a few weeks notice, their is little that can be done.
In your narrow minded way, you choose to focus all the blame on
Microsoft.
Your infantile website is a testament to you and your misguided ideas.

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://www3.telus.net/dandemar/


message
Garbage snipped
 
K

kurttrail

Jupiter said:
Take a closer look at your list.
Many of those such as Blaster would have been a non issue if users had
simply used the patch that was available for weeks before Blaster came
on the scene.

They are total non-issues for Linux or UNIX users.
It largely comes back to the users.

No, it comes down to having only one Desktop OS target.
If the user will not properly protect their computer especially when
given a few weeks notice, their is little that can be done.

If there were multiple Desktop OS in the PC market, less people at any given
time would be affected by any one computer nasty.
In your narrow minded way, you choose to focus all the blame on
Microsoft.

They are the one's who have been proven to use predatory monopolistc tactics
to maintain their Desktop OS monopoly. And it's their big fat target that
keeps getting hit.

Multiple targets are just plain safer than one big target.

Please try to explain to everyone how having only one big target of an OS is
safer for society as a whole, if you disagree with my previous sentence.
Your infantile website is a testament to you and your misguided ideas.

Thanks you! You just don't know how much it pleases me to know, that my web
site upsets you so, that you have to express your opinion of it with no
prompting on my part whatsoever.
More of your garbage snipped

Have a nice day! :)

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
K

Karl Levinson [x y] mvp

They are total non-issues for Linux or UNIX users.

Riiiight, Linux, Unix and OpenBSD have zero vulnerabilities.

Right, Linux has fewer vulnerabilities than Windows.

Right, users that can't configure and patch Windows would magically be able
to keep Linux secure.

Right, Linux web servers are hacked less frequently than Windows web servers
according to www.zone-h.org
No, it comes down to having only one Desktop OS target.

Right, switching to Linux or more than one desktop OS makes companies more
secure / easier to secure.
If there were multiple Desktop OS in the PC market, less people at any given
time would be affected by any one computer nasty.
Multiple targets are just plain safer than one big target.

Riiiiiight. Maybe if www.debian.org was running some Windows servers, they
wouldn't have been hacked a few months ago.

In the past 12 months, Microsoft, Linux, Cisco and others all had highly
critical remote vulnerabilities discovered that required patches. And *nix
already owns the lions share of web servers. So how would switching to
heterogeneous OS environments do anything to increase security or reduce
support costs? Or would it actually increase support costs, double or
triple the amount of work and patches required, and increase the likelihood
that a company would make critical security mistakes that lead to a
compromise?

Sure, like you, I find it puzzling that Microsoft hasn't released a patch
for the IE URL issue yet. But that doesn't make your pro-*nix statements
above true.
 
K

kurttrail

Karl said:
Riiiight, Linux, Unix and OpenBSD have zero vulnerabilities.

Did I say that?
Right, Linux has fewer vulnerabilities than Windows.

Did I say that?
Right, users that can't configure and patch Windows would magically
be able to keep Linux secure.

Did I say that?
Right, Linux web servers are hacked less frequently than Windows web
servers according to www.zone-h.org

Did I say that?

Nope to all four! I said in reply to Jupiter that those Windows based
viruses were a non-issue for *nix based OSs.
Right, switching to Linux or more than one desktop OS makes companies
more secure / easier to secure.

Did I say that? Can't you address what I actually write?

Would it have been as easy as it was for the Japanese to destroy & damage as
many ships on Dec. 7, 1941, if those ships were spread out across the
Pacific, instead of being all bottle up in Pearl Harbor?

Is having only one target to hit easier than hitting multiple target with
one shot?

It's a matter of common sense. Not whether one OS platform is better than
another, rather that having multiple OS platforms are intinsically more
secure than only having one.
Riiiiiight. Maybe if www.debian.org was running some Windows
servers, they wouldn't have been hacked a few months ago.

It affected one server, not potentially 95% of the Desktop computers on the
planet or anybody else system other than Debian's.
In the past 12 months, Microsoft, Linux, Cisco and others all had
highly critical remote vulnerabilities discovered that required
patches.

Yep, and because there are multiple choices in server networking platforms,
an attack on one platform doesn't take out the others. This is just my
point, but your too much of a "MS uber alles" advocate to see it.
And *nix already owns the lions share of web servers. So
how would switching to heterogeneous OS environments do anything to
increase security or reduce support costs?

It's common sense dude. During the cold war, did the USA & the USSR build
one central location each for all their missiles, or did they spread the
missiles out over vast areas? They spread them out to multiple locations.
Now it would have been easier to control all those missiles if the were
centrally located, but the threat of having them all taken out in one
massive first strike was so untenable, that both countries spread their
missiles to the four winds.

MS's Desktop monopoly OS, is like having all your missiles in one central
location, you risk losing them all with just one shot.
Or would it actually
increase support costs, double or triple the amount of work and
patches required, and increase the likelihood that a company would
make critical security mistakes that lead to a compromise?

Nope, you answer my question, which you conveniently cut out, first, and
that was, "Please try to explain to everyone how having only one big target
of an OS is safer for society as a whole, if you disagree with . . . .
Multiple targets are just plain safer than one big target."

But you won't, and that's why you cut it out in the first place, because you
know it's a totally indefensible position! And that's why you were trying
to put other words in my mouth and paint me as pro-*nix, to try to bury my
actual point in a blizzard of your Bull Sh*t! Didn't think I'd notice, huh?
Well, don't you ever think you can play games with my opinions, and get away
with it. Better people than you have tried, and failed just as miserably
you have.

Now to answer your question in two parts, "Or would it actually increase
support costs, double or
triple the amount of work and patches required,"

Who knows? Does having multiple Server OSs now, increase support costs,
double or triple the amount of work and patches required, as compared to the
support costs, amount of work & patches for the monolitic Desktop
environment that the general public is forced to accept at present?

"and increase the likelihood
that a company would make critical security mistakes that lead to a
compromise?"

It would affect only that one companies products, hence lessoning the effect
that any one companies critical security mistakes would have on the general
public as a whole. As this is exactly my point.
Sure, like you, I find it puzzling that Microsoft hasn't released a
patch for the IE URL issue yet. But that doesn't make your pro-*nix
statements above true.

I'm not pro-*nix, and I didn't make any pro-nix statements, that was your
fantasy. I am advocating a diverse desktop PC OS market that would by it's
very nature lessen the effects of any one given computer nasty from
affecting potentially 95% of the PCs on the planet.

"Please try to explain to everyone how having only one big target of an OS
is safer for society as a whole, if you disagree with . . . . Multiple
targets are just plain safer than one big target."

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
K

kurttrail

Jupiter said:
I never said I was upset.
Why do you continually feel the need to project your own feelings on
others?
I simply consider the source Kurt!

"Please try to explain to everyone how having only one big target of an OS
is safer for society as a whole, if you disagree with . . . . Multiple
targets are just plain safer than one big target."

Stay on topic, answer the question, and stop playing your WinTroll games,
Juppy.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
J

Jupiter Jones [MVP]

Kurt;
Stay with your facts.
I never even suggested "one big target of an OS" is the way to go.
Those are your words and ideas.
You seem to need to falsely put statements to others in order to
support your ideas.
To bad you can not support your point on its own merit.
Furthermore you start to name calling.
Name calling is strong evidence that you lack the ability to support
your own point of view.
Good bye Kurt.
 
K

kurttrail

Jupiter said:
Kurt;
Stay with your facts.

I did, notice that I was quoting myself.
I never even suggested "one big target of an OS" is the way to go.

You were disputing my arguement that MS's monopoy OS is what is the biggest
security hole for the general public by blaming the general public.
Those are your words and ideas.

Which you were trying to dispute by blaming the victims, rather than the
delivery system of being locked into one big fat target of a Desktop OS.
You seem to need to falsely put statements to others in order to
support your ideas.

No, I trying to actually get you to confront my ideas, instead of doing the
side-step shuffle to protect your Masters.
To bad you can not support your point on its own merit.

I already have, it's you that have not support any contrary point the
dimishes my opinion in the slightest bit.
Furthermore you start to name calling.

What else could you be called when you only answer that most inconsequential
part of my post, and leave the meat of it untouched? That's exactly the
tactics of a troll.
Name calling is strong evidence that you lack the ability to support
your own point of view.

My point has been proved, and only the MicroDeafDumb&Blind can't see it.
MS's desktop OS monopoly is the biggest security risk for the general public
today, because that one giant-assed target can't help from getting hit.

It's a hell of a lot easier to hit one bird with one stone, than two birds
with one stone. I have common sense on my side, you have only your
unwavering devotion to MS to back you up.

Thank you!

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
K

Karl Levinson [x y] mvp

Did I say that?

If you weren't implying that users switching to *nix would make them more
secure, then I don't see the point in making that statement at all. Of
course Blaster isn't an issue for *nix users. So what? [unless the
implication was that switching to *nix is better.]

Switching half the desktop computers to *nix would not have made Blaster,
Welchia, SQL Slammer any better. Five computers can potentially DoS a
network, and one infected computer can allow an attacker to bypass the
firewall to compromise the data on the entire network.
It affected one server, not potentially 95% of the Desktop computers on the
planet or anybody else system other than Debian's.

Yeah, but that was one he11uva server. It was several servers at several
*nix distribution and development sites that potentially could have
compromised files that are downloaded by *nix users worldwide. AFAIK
Microsoft's FTP and Windows Update servers have never been compromised, and
if they had been, it would be major news, not just "oh, it's just one
server."
Yep, and because there are multiple choices in server networking platforms,
an attack on one platform doesn't take out the others. This is just my
point, but your too much of a "MS uber alles" advocate to see it.

Wha? I don't care if you choose Microsoft or *nix. If you check my site at
http://securityadmin.info/faq.asp#firewall, you'll see that I point people
to non-Microsoft open source solutions like Knoppix and OpenBSD, even though
my role here and there is not vendor advocacy but in trying to help people
that are already beyond the point of choosing what to purchase.

With the exception of firewalls, I generally don't see people recommending
buying half Cisco and half Nortel switches and routers... because as with
choice of OS, the added cost and complexity of supporting more than one
solution trumps any benefit of changing from homogeneous environment to a
"50% vulnerable to this, 50% vulnerable to that" environment.

Even with all the vulnerabilities in IE, for example, it can make a lot of
sense to standardize just on Windows and IE and no other browser or OS,
because if you use OWA to check your email with Windows integrated
authentication, everyone you switch to *nix or Netscape won't be able to do
that. Frequently, functionality trumps security, and sometimes Microsoft
builds solutions that other vendors choose not to support.

Nope, you answer my question, which you conveniently cut out, first, and
that was, "Please try to explain to everyone how having only one big target
of an OS is safer for society as a whole, if you disagree with . . . .
Multiple targets are just plain safer than one big target."

I don't control society. I only control my organization. I have no way of
encouraging other organizations to switch to another OS. The European
community is switching to desktop *nix, and we'll see if the world is any
more secure after that. Somehow I doubt it. And I disagree that switching
half my organization to another OS would help my security, in fact I believe
it would hurt it. Any company or support staff that can't keep a
homogeneous Windows network patched and secure is going to fail even more
miserably at keeping a mixed environment secure, and having Blaster infect
20 machines or half the machines is just as bad as having Blaster infect the
whole network.

Also, security is not about achieving maximum security, it's about saving
money and effort. You choose to implement a certain safeguard not because
it makes you more secure, but because the cost of implementing the safeguard
compares favorably with the cost of other safeguards and the cost of not
implementing the safeguard and becoming compromised. Given that, my
arguments about a heterogeneous environment increasing support complexity is
a direct response to your question.
But you won't, and that's why you cut it out in the first place, because you
know it's a totally indefensible position!

It is defensible. I just defended it.
And that's why you were trying
to put other words in my mouth and paint me as pro-*nix, to try to bury my
actual point in a blizzard of your Bull Sh*t! Didn't think I'd notice, huh?
Well, don't you ever think you can play games with my opinions, and get away
with it. Better people than you have tried, and failed just as miserably
you have.

Whoa! Calm down there killer! :D

Fair enough. You mistook me for a pro-Microsoft person too. In my defense,
your anti-Microsoft signature below plus your statements mentioning *nix are
what made me think you're pro-*nix. If you're anti-Microsoft and you don't
appear to be a Mac or BeOS or Amiga or Novell enthusiast...
 
K

kurttrail

Karl said:
If you weren't implying that users switching to *nix would make them
more secure, then I don't see the point in making that statement at
all.

The point is having one monopoly Desktop OS is a National Security risk
that is as obviously untenable as putting all your eggs in one basket.
It's quite obvious that the Anti-Trust settlement did little to protect
the general public as a whole for the predatory abuses of Microsoft, and
now that monopoly is a major National Security threat.

I'm not advocating any other option than the breakup of Microsoft in
order to protect the general pubic.
Of course Blaster isn't an issue for *nix users. So what?
[unless the implication was that switching to *nix is better.]

It was my reply to what Jupiter had said, that's what.
Switching half the desktop computers to *nix would not have made
Blaster, Welchia, SQL Slammer any better. Five computers can
potentially DoS a network, and one infected computer can allow an
attacker to bypass the firewall to compromise the data on the entire
network.

Again, with this MS vs. *nix phobia. Oy Vey! Can't you get it through
your thick skull, I AM NOT ADVOCATING *NIX. PERIOD! MS needs to be
broken up for the general public good, not to promote the *nis desktop,
but for the safety of our society of individual human beings as a whole
in the digital world.
Yeah, but that was one he11uva server. It was several servers at
several *nix distribution and development sites that potentially
could have compromised files that are downloaded by *nix users
worldwide. AFAIK Microsoft's FTP and Windows Update servers have
never been compromised, and if they had been, it would be major news,
not just "oh, it's just one server."

It's been overwhelmed plenty of times. And who needs to hack it? MS
does a good enough job screwing it up all on their own.
Wha? I don't care if you choose Microsoft or *nix. If you check my
site at http://securityadmin.info/faq.asp#firewall, you'll see that I
point people to non-Microsoft open source solutions like Knoppix and
OpenBSD, even though my role here and there is not vendor advocacy
but in trying to help people that are already beyond the point of
choosing what to purchase.

You're the one arguing this as MS vs. *nix, I am not. Maybe you need to
step back, and reread this thread to gain some perspective on how you
words belie your protestations of not being an MS advocate.
With the exception of firewalls, I generally don't see people
recommending buying half Cisco and half Nortel switches and
routers... because as with choice of OS, the added cost and
complexity of supporting more than one solution trumps any benefit of
changing from homogeneous environment to a "50% vulnerable to this,
50% vulnerable to that" environment.

In the corporate world where the bean counter overrule common sense,
that probably is the case. But the individual consumer in the privacy
of his home is locked into not having any choice. You want to run the
last PC hardware, with the latest popular titled software, you have to
run an MS Desktop OS. I want for the average individual to have the
same ability to be able to choose between OS's, not only to have
competition bring down the prices of software down to reasonable levels,
but as matter of their computer security.
Even with all the vulnerabilities in IE, for example, it can make a
lot of sense to standardize just on Windows and IE and no other
browser or OS, because if you use OWA to check your email with
Windows integrated authentication, everyone you switch to *nix or
Netscape won't be able to do that. Frequently, functionality trumps
security, and sometimes Microsoft builds solutions that other vendors
choose not to support.

Or can't use, because MS use of proprietary standards, and others are
unwilling to pay and play by MS's monopoly-protected extortion of
licensing terms.
I don't control society. I only control my organization. I have no
way of encouraging other organizations to switch to another OS. The
European community is switching to desktop *nix, and we'll see if the
world is any more secure after that. Somehow I doubt it. And I
disagree that switching half my organization to another OS would help
my security, in fact I believe it would hurt it. Any company or
support staff that can't keep a homogeneous Windows network patched
and secure is going to fail even more miserably at keeping a mixed
environment secure, and having Blaster infect 20 machines or half the
machines is just as bad as having Blaster infect the whole network.

Also, security is not about achieving maximum security, it's about
saving money and effort. You choose to implement a certain safeguard
not because it makes you more secure, but because the cost of
implementing the safeguard compares favorably with the cost of other
safeguards and the cost of not implementing the safeguard and
becoming compromised. Given that, my arguments about a heterogeneous
environment increasing support complexity is a direct response to
your question.

No, it's total subterfuge. You talking on the micro level of one
companies network where as I'm concerned with the macro level of the
general public that is made up of private individual human beings, our
human society. If every corporation had no real choice of platforms,
that would put the entire corporate community's computers at greater
risk, just as MS Desktop monopoly puts their locked-in individual
consumers at a higher risk today.

Your homogenous argument may be the practical bean-counter thing to do
on a micro-level of one corporation, but extend it out to every
corporation, and the risk of the entire corporate computing world being
taken out with one shot increases a hundred-fold or more.
It is defensible. I just defended it.

No, you did a corporate tap dance that had little to do with protecting
the general public in the privacy of their own homes from the National
Security risk of having on big fat OS target. Corporations can afford
the best and brightest minds to help protect their companies, despite
the inadequacies of any one given platform. The general public is
forced to depend on MS, and has no viable choice in the matter.
Whoa! Calm down there killer! :D

Fair enough. You mistook me for a pro-Microsoft person too. In my
defense, your anti-Microsoft signature below plus your statements
mentioning *nix are what made me think you're pro-*nix. If you're
anti-Microsoft and you don't appear to be a Mac or BeOS or Amiga or
Novell enthusiast...

....then logically you stereotype me as pro-*nix. My assumptions about
your MS advocacy was based on you making this into MS vs. *nix, when I
only mention Linux & Unix in passing in answer to Jupiter, not part of
my main argument. You're going off on that wild tangent, off of one
passing reference shows where your heart is really at. Even your other
wild foray off-topic about using diverse platforms with in a particular
company, was bogus, because at least that company has a choice when it
come to their networking platforms. If every corporation on the planet
were forced to use nothing but MS, like individual consumers having no
real choice but MS, then would you say that was a more secure situation,
than having choices as they do today in the corporate world?

And I'm not really anti-MS, I'm pro-consumer-choice, and MS just happens
to be the biggest obstacle in the way of Consumer Choice. And even
Linux's creator says that the Linux desktop is still 5 to 10 years away.
So maybe corporations & gov'ts can afford to use a Linux Desktop for
pure office purposes because they can afford to support themselves, but
as a consumer multimedia OS, it is still years away at best. For the
average PC consumer, not your corporate big wigs, MS's monopoly hurts
the individual consumer, and by extension the entire general public, not
only with monopoly-protected non-competitive pricing, but also by
risking their computer security of everybody by having everybodies'
*Personal* *Computer* in one big fat monopolistic target of a basket.

--
Peace!
Kurt
Self-anointed Moderator
microscum.pubic.windowsexp.gonorrhea
http://microscum.com
"Trustworthy Computing" is only another example of an Oxymoron!
"Produkt-Aktivierung macht frei!"
 
R

Robert Moir

kurttrail said:
Says you.

Yes. Says me. Based on my observations. I thought we were being adult in
this thread and respecting others rights to hold an opinion?
And if it really is true, is that a good enough reason for
accepting MS's slacking?

Not at all, if "slacking" is what it is.
Pray tell, like what?

http://www.mozillazine.org/talkback.html?article=4078
http://bugzilla.mozilla.org/show_bug.cgi?id=228176

Yes. I'm well aware its fixed in mozilla, before you ask.
I overheard these two people talking once, and
you know what, they were saying that GW Bush is really Gay!

You know, what, if I was actually an American, I might understand what that
reference to Mr Bush meant.
http://www.iss.net/support/product_utilities/

Didn't seem so hard for these guys! MS could license it from them.
What's more important MS's customers security, or MS releasing their
own in-house developed patch?

Obviously, not being a Microsoft employee, I can't comment on their internal
decision making process. None of us have any way of knowing, for example, if
MS looked at the ISS fix and rejected using it for some reason do we?

ISS may have something released and that _is_ great, but that doesn't mean
that MS haven't had problems.
US Gov't. MS is still an American company. The Justice Dept. or even
Homeland Security, since it's MS's OS that has been the one that has
been exploited, time & again, at the expense of the security of the
general public.

Melissa, Code Red, Slammer, Blaster, Sobig, Swen, Bagle. It's MS's
fat-assed monopoly target that's putting the general public at risk.

Hmmm or people not keeping their systems patched and up to date; as that
would have prevented most of the problems you note above. That list right
there only needs, oooh, every other virus on the planet adding to it, and it
would be a list of viruses I've _never_ caught.

Actually, lets look at Melissa - that is a complete human problem, that does
not rely on any "exploitable" code at all. The others except bagle, I know
the exploits used were all patched prior to the virus hitting. Some of the
exploits, e.g. the RPC one blaster uses, are very disappointing, thats for
sure; IMO Microsoft have some questions to answer on that one at least.

Bagle, I know nothing about and can't be bothered to go and look up right
now, so I'll let you have that one.
And now MS is dragging of their feet on this address bar exploit!
How many times does a target have to get hit before ya'll wake up and
smell the coffee?!
[snip]

Are you telling me no one has ever pulled the wool over your eyes?

No. Where did I claim that? I can however say I've never been fooled by an
email borne virus or worm. Anyone who still clicks on attatchments named
"Naughty pictures of Anna Kornikova hot
stuff.jpg.exe.com.not.a.virus.this.time.no.really.honest.exe.jpg.bmp.vbs"
deserves everything they get.
Everybody is a potential sucker, even the members of MENSA, but so
many people wouldn't be suckered with any one computer nasty, if MS
wasn't the only real OS choice for the Desktop.


That's total BS, almost all of them rely on running on one company's
OS.

You call BS on something so easily provable? Here is a free example: Go take
a look at the origins of the "419" scam. I'll be here waiting for your
apology when you've researched a little and found out exactly how OS
dependant it is.

And actually Kurt, this may shock you, but I was talking in a wider frame
than just computing. Guess what, there were scams and exploits around before
we even had computers in people's homes. You'll find that out while you do
some research on the origins of the 419 scam. If you want to know more about
it all, visit www.snopes.com sometime and see for yourself.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top