Stop Microsoft

All Things Microsoft => Microsoft as a Company => Topic started by: mobrien_12 on 10 June 2006, 03:25

Title: MS chooses to leave critical security hole unfixed.
Post by: mobrien_12 on 10 June 2006, 03:25
http://news.zdnet.com/2100-1009_22-6082307.html?tag=zdfd.newsfeed

Quote

Microsoft will not fix a serious flaw in Windows 98 and Windows Millennium Edition because a patch could break other applications.

The security bug relates to Windows Explorer and could let an intruder commandeer a vulnerable PC, Microsoft warned in April. The software maker has made fixes available for Windows Server 2003, Windows XP and Windows 2000, but it has found that eliminating the vulnerability in Windows 98 and ME is "not feasible," it said.

Yeah... right, not feasible.  Take some of that billions of reserve money and do your freaking jobs.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Orethrius on 10 June 2006, 06:03
Just substitute "profitable" for "feasible" in that statement and you'll get the generic MS mindset.  Hell, do that for ANY of their releases.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Calum on 10 June 2006, 10:56
perhaps it really isn't feasible due to poor system design in the first place?

they are really saying that their win32 (not NT) based systems are shit, and considering they were the standard for 5 to 7 years, that's pretty appalling. how much money do you think microsoft made from windows 95. 98 and ME? for a system this poor that serious security vulnerabilities cannot be fixed without making the system unusably unstable?

and nobody cares! none of the windoids ask for their money back or anything, they just put up with it!
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Aloone_Jonez on 10 June 2006, 12:05
Since they're planning on killing support for Windows 98 next month I don't really blame them for not being arsed to fix it, that said they should either support something or not, not just do a half arsed job of supporting something which is what they do anyway.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Jack2000 on 10 June 2006, 13:28
i wonder if they will abondon 98 in full
as in "relese source and let the open comunity to picker  on it "
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Orethrius on 10 June 2006, 13:56
Quote from: Jack2000
i wonder if they will abondon 98 in full
as in "relese source and let the open comunity to picker  on it "

 Not a chance in hell.  That being said, it seems that nobody noticed that Windows 2000 was made open source (http://slashdot.org/article.pl?sid=04/02/12/2114228) quite some time ago.  A lack of willingness to use it doesn't make it any less leaked.  :D
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: H_TeXMeX_H on 11 June 2006, 03:58
Yay, I hope they keep doing this :D
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: piratePenguin on 11 June 2006, 04:19
BTW:
Quote from: my php.ini
; Print out errors (as a part of the output).  For production web sites,
; you're strongly encouraged to turn this feature off, and use error logging
; instead (see below).  Keeping display_errors enabled on a production web site
; may reveal security information to end users, such as file paths on your Web
; server, your database schema or other information.
display_errors = Off
It's not a huge deal (I don't know any situation where security information is revealed), but I think display_errors should be off.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Calum on 11 June 2006, 14:37
well firstly, open source does not mean you can see the source, it means you have a right to use the source to develop new code.

secondly, there is no possibility of windows' source code ever being released to the public as it would compromise a great deal of software in microsoft's current products which is unstable and insecure. they have stated this publicly, and even in court as part of a defense argument i believe! unlike most other popular operating systems microsoft windows really is too far down the road to ever be fixed up, in terms of security and stability, to the point where it can safely have the source code available to be viewed by just anyone.

to me, this makes it a failure as a secure and viable operating system.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: worker201 on 12 June 2006, 22:09
Well, that's what you get for not following Microsoft's regimented upgrade schedule.  If you want your computer to be more secure, you better upgrade.  To XP.  Then, in a couple months, when Vista is ready, you can upgrade to Vista to avoid a hole in XP that they've decided would be "unfeasible" to fix.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: xyle_one on 15 June 2006, 22:15
I see nothing wrong with them not supporting an 8 year old operating system. Sure, 98 isn't good, they admit that, but it's 8 years old. Time to move on people.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: worker201 on 16 June 2006, 00:00
Maybe it is time to move on.  But that should be the customer's decision, not the vendor's decision.  This is like Microsoft almost forcing people to upgrade, whether they have the hardware/opportunity or not.  Windows XP won't run on everything, you know.  And, believe it or not, some people have locked themselves into mission critical applications that need Win98 to function.  Let's not punish the less fortunate (and anyone with a 486 who is dependent on Win98 is definitely less fortunate) simply for being less fortunate.

xylon?
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: xyle_one on 16 June 2006, 00:39
Quote from: worker201
xylon?
Yeah, the one and only :)

How's it going worker201? How was your trip?
Quote from: worker201
Maybe it is time to move on. But that should be the customer's decision, not the vendor's decision. This is like Microsoft almost forcing people to upgrade, whether they have the hardware/opportunity or not. Windows XP won't run on everything, you know. And, believe it or not, some people have locked themselves into mission critical applications that need Win98 to function. Let's not punish the less fortunate (and anyone with a 486 who is dependent on Win98 is definitely less fortunate) simply for being less fortunate.
 
I can't fault the company for discontinuing support for an ancient os even if people are still using it for critical applications (yikes!). I remember reading about this on, I think, slashdot, and windows 98 was just too poorly written to fix, so they didn't. If a company wants to continue to run critical apps on that, then so be it, but to expect MS to continue support is ridiculous. If not now, then when would it be an ok time to stop supporting it? 5 years? 25 years? Apple stopped supporting all older versions of it's classic os in 2002. And I believe Redhat no longer supports older versions of it's OS.

I don't see anything wrong :/
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: piratePenguin on 16 June 2006, 00:46
Quote from: xylon
Yeah, the one and only :)

How's it going worker201? How was your trip?

I can't fault the company for discontinuing support for an ancient os even if people are still using it for critical applications (yikes!). I remember reading about this on, I think, slashdot, and windows 98 was just too poorly written to fix, so they didn't. If a company wants to continue to run critical apps on that, then so be it, but to expect MS to continue support is ridiculous. If not now, then when would it be an ok time to stop supporting it? 5 years? 25 years? Apple stopped supporting all older versions of it's classic os in 2002. And I believe Redhat no longer supports older versions of it's OS.

I don't see anything wrong :/
MS said they would support it for longer than this - that's what's wrong.
The Ubuntu people say they'll support 6.06 for 5 years, and I'd be pissed at them if they ended it any shorter than that (and I do NOT plan to use 6.06 for much longer).
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: xyle_one on 16 June 2006, 01:08
Quote from: piratePenguin
MS said they would support it for longer than this - that's what's wrong.
The Ubuntu people say they'll support 6.06 for 5 years, and I'd be pissed at them if they ended it any shorter than that (and I do NOT plan to use 6.06 for much longer).
I doubt they planned for a security fix to be impossible to add without breaking the system even more. Given that, I would have dropped support for this particular patch as well.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: piratePenguin on 16 June 2006, 01:10
Quote from: xylon
I doubt they planned for a security fix to be impossible to add without breaking the system even more. Given that, I would have dropped support for this particular patch as well.
They should always plan for that (and reduce the time they say they'll support stuff for in future).
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: xyle_one on 16 June 2006, 01:13
Quote from: piratePenguin
They should always plan for that (and reduce the time they say they'll support stuff for in future).
Yeah, sure. Plan for every conceivable exploit and bug that could possibly come into existence. That is totally feasible :rolleyes:
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: piratePenguin on 16 June 2006, 01:23
Quote from: xylon
Yeah, sure. Plan for every conceivable exploit and bug that could possibly come into existence. That is totally feasible :rolleyes:
Well look what fucking happened! They broke their promise.

Don't make promises you can't keep. It would've made more sense for them to say "We'll try and support this for X years but if something crops up that we can't fix w/o breaking other stuff coming towards the end of X years, we won't fix it and we'll end support early" - or so. Afterall, this is obviously what they were thinking - it's just not what they promised (and I see exactly why they didn't say it).
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: mobrien_12 on 16 June 2006, 02:03
I paid for Win98.  I paid for it, they OWE me for their support lifecycle.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Pathos on 16 June 2006, 10:36
...hmmmm, commercial businesses can't support products forever.

Sure you paid for Win98 but did you pay directly for eternal support ?

When I buy a motorbike the company only manufactures a finite number of spare parts that they charge for. When those have run out too bad.

Redhat will do the same thing.

I would never recommend anyone in this day and age to have a non nt based version of windows connected to the net.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: Jack2000 on 16 June 2006, 13:23
"you better upgrade. To XP."
wtf did i see correct are we telling people to swich to xp !
wtf man Xp is part of the stupid NT family not the 9* one !
and another thing i do not need updates and i do not care about support
i can support my own system !
i want them to abondon it like abondonware
and get on with it
... not that i am going to follow them into a new os ...
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: piratePenguin on 16 June 2006, 20:26
Quote from: Pathos
...hmmmm, commercial businesses can't support products forever.

Sure you paid for Win98 but did you pay directly for eternal support ?

When I buy a motorbike the company only manufactures a finite number of spare parts that they charge for. When those have run out too bad.

Redhat will do the same thing.

I would never recommend anyone in this day and age to have a non nt based version of windows connected to the net.
MS didn't say "We'll support it until we run out of resources" (they'd be supporting it forever if that was the case), they said "We'll support it until July 11th 2006" (this was in 2001 IIRC - they announced "extended" support, support was supposed to end in 2002 IIRC) which they didn't do.

I have no idea about Red Hat, but the Ubuntu people say they'll support 6.06 for 5 years, they said they'd do it and now they better fecking do it. They better be prepared to fix critical things after 4 years 11 months (and fix the things that breaks), because they've said they will.
Title: Re: MS chooses to leave critical security hole unfixed.
Post by: worker201 on 16 June 2006, 22:19
Quote from: Pathos
When I buy a motorbike the company only manufactures a finite number of spare parts that they charge for. When those have run out too bad.

That's a bad arguement.  Because 1), the manufacturer licenses other companies to make OEM spare parts so that they don't have to, 2), there's nothing contractually illegal about making your own spare parts, if you have the know-how, 3), one patch can be applied to an infinite number of computers at pretty much zero marginal cost - you don't have to maintain a warehouse containing enough patches to meet demand, and 4), the manufacturer made no guarantee beyond the factory warranty, and doesn't give a crap what happens to your car after that, except in cases of defect/recall.


PiratePenguin is right - they said they would support it, and backed down.  That's Microsoft's only real crime here.  Unless you consider the general upgrade cycle to be a crime.  Personally, I think planned obsolescence is criminal.

 [OFFTOPIC]This reminds me about my trip to Ecuador.  I was surprised how many ancient computers they had there.  On the ship, there was a tractor-feed dot matrix printer that must have been at least 20 years old, still printing away like it was brand new.  See, the prices of computer hardware have not been as artificially lowered in other countries as they have been in the US.  Here in the States, it is ALWAYS cheaper and more cost effective to just get a new one when the old one breaks.  Getting a replacement OEM motherboard from the manufacturer is always more expensive than getting a new computer.  Not so in the rest of the world.  If the hardware is broken, they fix it.  There are people on street corners who sit with toolsets and fix anything you bring them.  That's why 10-50 year old electronics are still being used over there.

Now, many of those people just don't have the processor strength to run WindowsXP.  Hell, some of them can't even run Windows95!  What will become of them when support for Windows98 is ended?  Are you going down there to teach everyone how to use Linux?  Are you going to install FC5 on their 75MHz PCs so they can run OpenOffice instead of Word?

Just something to think about.  It's easier to argue against support when you don't need it.[/OFFTOPIC]