Forum Moderators: open

Message Too Old, No Replies

Microsoft Security - Lack Thereof

         

Brett_Tabke

8:21 pm on Jan 6, 2004 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



If successful, the lawsuit would achieve something unprecedented by holding Microsoft legally liable for damages linked to flaws in its products--even though the company's customers surrender this right under the terms of Microsoft's end-user license agreements.

[pcworld.com...]

No campaign by any company I have seen in 30 years has been as well played out as Microsofts ability to shift focus and blame for it's on going security woes. The above article is a pretty good wrap up of the issues involved.

In early 2002 the company declared that it was halting software development for a month so that its developer teams could focus on one issue--security. Two years later, with no visible improvement, that unfulfilled promise leaves many users doubly frustrated.

bcolflesh

8:23 pm on Jan 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



It's an amusing idea, but every single software company, including MS competitors would side with Redmond in this case..

webdevsf

10:41 pm on Jan 6, 2004 (gmt 0)

10+ Year Member



[The company has] all of these computer geniuses who should be able to figure out that there are flaws when they are developing the software

You can sue doctors for malpractice. (Replace computer genius with doctor in the above sentence to see how it makes you feel...)

bakedjake

11:19 pm on Jan 6, 2004 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



eh. Half the fault is Microsoft. But half the fault is the user's, too. Going after the manufacturer is the wrong answer here.

Why should Microsoft be blamed when a ton of users are still using 5 or 6 year old technology to protect their computers? People don't use tires for 6 years. If my tires wear out, or my brakes wear out, that's my problem.

There's just as many stupid UNIX users. "Oh look, I'm going to try installing Linux by inserting a CD and pushing the big red default install button that installs a bunch of services I don't need!"

Your problem is not a technology one - it's a social one. Fix the users, first. You'd be surprised how fast your security problems go away.

Got an insecure computer? FINE No internet access for you until you patch your faulty computer. Reminds me of state vehicle inspections. We have the technology to do this, BTW...

korkus2000

11:45 pm on Jan 6, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



How we love to sue. Don't hold the murder responsible blame the people who own the land where the crime took place.

"It's like having a car where the locks don't work."

They need to look at the first model Ts and see how much stuff broke. Since cars have had over a century to perfect its mechanisms. The first cars rolling off the line were not any where near as reliable as cars are today.

Makes it really hard to be in business when everyone is pointing the finger for why they:

1. Haven't upgraded.
2. Haven't patched.
3. Don't secure incoming traffic.

I hope all of the Linux people pay attention. That system is next. Virus writers don't think it is big enough game just like macs. When the other OSes start to become more available the same thing here will happen.

This upsets me not because it is MS (They have done their dirty work in the past), but because the mentallity of todays consumer.

plumsauce

3:07 am on Jan 7, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member




it's a poor workman who blames his tools

lukasz

4:37 am on Jan 7, 2004 (gmt 0)

10+ Year Member



They need to look at the first model Ts and see how much stuff broke. Since cars have had over a century to perfect its mechanisms. The first cars rolling off the line were not any where near as reliable as cars are today.

I tired of reading this inacurate Bill Gates quote again.
You cannot compare hundred years old mechanical industry with IT. How long did it take hundred years ago to put car into production? Which tools did they have to achive that?.Why not compare with for example mobile phone industry which is much more matured than IT although both started at the similar time.
Coming back to main topic I am very happy to see someone finally going after, lazy irresponsible software developers.
Why do we need to accept those licence "agreements" which limit or exclude developers liability. Is there any reason why developers shouldnt be accountable for their products faults?

webdevsf

2:12 pm on Jan 7, 2004 (gmt 0)

10+ Year Member



Developers are held accountable - people sue Microsoft every other week it seems. Some of them even win!

Software development is analagous *but not the same* as cell phones, cars, whatever. Cell phones are simpler than PCs. A faulty car can kill you. A faulty PC will usually not kill you.

I'd prefer they also sue some other unnamed large software manufacturers, who are far more egregious about providing shoddy software software to corporations and suck the blood out of them for every last nickel as long as they can.

So there. :)

plumsauce

8:33 pm on Jan 7, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Software development is analagous *but not the same* as cell phones, cars, whatever.

exactly. mobile devices are *in general* closed devices.
this is much easier than having to accommodate rogue
third party applications.

for ms server software, it is generally the third party
stuff that causes problems. after all by definition an
av violation is never the os.

wackal

8:38 pm on Jan 7, 2004 (gmt 0)

10+ Year Member



don't forget, once a precedent is set that developers can be sued for software flaws, then each of us will have a target on our backs. I'd rather not write code if I had to worry that one overlooked thing could ruin me or my business.

Also, the big companies have millions to spend on debugging, but what about the little guy working in his garage on something that will beat Windows?

bignet

1:25 am on Jan 8, 2004 (gmt 0)

10+ Year Member



Microsoft Security - Lack Thereof

Brett brewing a little storm in the microsoft forum ;)

Now which is better Microsoft or *nix servers?

lukasz

4:49 am on Jan 8, 2004 (gmt 0)

10+ Year Member



mobile devices are *in general* closed devices.
this is much easier than having to accommodate rogue
third party applications.

for ms server software, it is generally the third party
stuff that causes problems. after all by definition an
av violation is never the os.

sounds like M$ PR release.
So without "third party stuff" windows will work perfectly?
I dont think it ever happened.
What about "illegal operation", "fatal error" and so on. Also security holes are not inflicted by some "third party stuff" they are build -in.


I'd rather not write code if I had to worry that one overlooked thing could ruin me or my business.

But you wouldnt mind to ruin your client business, although he paid for your software? If you are not sure that your software will perform than dont sell it!

millions to spend on debugging

1 Micro$oft Way - build crappy software and then spend millions on debugging, patching and fixing.

plumsauce

6:49 am on Jan 8, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member




What about "illegal operation", "fatal error" and so on. Also security holes are not inflicted by some "third party stuff" they are build -in.

not when properly configured and installed.
i stress that this is an issue of too many
amateurs running around playing sysadmin.
this problem exists on *all* platforms.
look around at the majority of questions
in the technical forums on WW. the lack
of knowledge is absolutely apalling.

i read that a new linux kernel patch has been
released today for a vulnerability that exists
in all versions between 2.2 through 2.6
that's a vulnerabilty at the kernel level
since whenever 2.2 was released. clearly,
this qualifies as a builtin flaw(see above)

where should my lawyer serve the papers :)

lukasz

11:35 am on Jan 8, 2004 (gmt 0)

10+ Year Member



One vulnerability - thats about what M$ announces daily.
You lawyer can serve the papers to the place where you bought your linux.

korkus2000

2:31 pm on Jan 8, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This is something we will all be facing. I think we will see more and more people blaming for their inability to secure information. I think we are seeing the future of successful websites. MS is a large target.

No matter how well you QA and beta a product there will always be issues that needs patches. It is when a software company ignores these issues where the real problem lies. MS did do this in the past, but they have been on it because of the law suits. Many companies don't. Thats the reason I just can't move to open source. They just don't have the money to back quick patches and fixes.

bignet

6:17 pm on Jan 8, 2004 (gmt 0)

10+ Year Member



1 Micro$oft Way - build crappy software and then spend millions on debugging, patching and fixing.

Solution: Just do not use it if you think it is that bad

plumsauce

6:53 pm on Jan 8, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



at least we're not "kewl" or "leet" :)

let's put it this way,

a client has multiple machines. some of these
are linux and maintained by a third party firm.
these have been hacked multiple times. some of
these are windows, and the owner likes to *play*,
these are unreliable, but never hacked. i share
admin with the owner.

there is another client with windows servers on
the same subnet that have been up so long that
i am worried about the power supply fans seizing
up. never been hacked. on service pack *1*. i maintain
these as well, and no one else has admin.