[Full-Disclosure] Knocking Microsoft

From: James P. Saveker (james_at_wetgoat.net)
Date: 02/27/04

  • Next message: Tiago Halm: "[Full-Disclosure] Fake Email" 
    To: <full-disclosure@lists.netsys.com>
Date: Fri, 27 Feb 2004 20:15:55 -0000

    Some personal thoughts,

    Yes indeed it's no secret that Microsoft valued functionality over security
    for many years. I think that's how they are a market leader today. This
    model could not be sustained however, as with the advent of exponential
    internet growth security has undoubtedly become a major concern.

    Microsoft has in there defence started the trustworthy computing scheme,
    which many would not hesitate to laugh at. However windows server 2003 does
    not by default load unnecessary services. Microsoft has developed "bits"
    client to downloaded patches requiring minimal user interaction depending on
    the configuration. In the enterprise they have improved SMS server to
    deploy patches across "bits". For smaller business they offer SUS for FREE.
    The code they produce is far more stringently tested in regard to security
    than perhaps it was before.

    The key to increasing the windows security model is not just one thing,
    however with the advent of granular code patches will be smaller and cheaper
    to deploy requiring much less bandwidth than today. Longhorn will be a big
    jump for Microsoft and a major test of the trustworthy computing yada yada.

    I do not understand why people knock Microsoft so much in regard to security
    today. I regularly hear people talking about how many vulnerability's
    Microsoft has and how poor this is. As everybody subscribing to this list
    and similar zone-h, bugtraq etc will know Linux has many warnings posted
    also. Yet I rarely hear people talking about that and indeed how it is far
    more difficult to keep linux distro's up to date. Windows has a far greater
    end user base than any other operating system. It would be a fair
    assumption to then say that perhaps virus writers and "hackers" are going to
    look for ways to exploit windows far more than other "end user" system in
    order to gain greater penetration. That is not to say that people do not
    look for sploits in web application servers running nix and other such
    systems in respect to the amount of nix servers on the net.

    I don't mean to open an open "sauce" debate but merely say my bit and see
    others peoples views on the topic.

    James Saveker

    "The only thing which helps me maintain my slender grip on reality is the
    friendship I share with my collection of singing potatoes..."

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Tiago Halm: "[Full-Disclosure] Fake Email"

    Relevant Pages

    • SecurityFocus Microsoft Newsletter #49
      ... Subject: SecurityFocus Microsoft Newsletter #49 ... Microsoft Windows NNTP Denial of Service Vulnerability ... Microsoft IIS SSI Buffer Overrun Privelege Elevation Vulnerability ... Microsoft ISA Server H.323 Memory Leak Denial of Service... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #164
      ... Got Storage Security Risks? ... MICROSOFT VULNERABILITY SUMMARY ... Chat Client FTP Server Default Username Credential Weak... ... NetServe Web Server is a compact web server for Microsoft Windows ...
      (Focus-Microsoft)
    • Re: MS and security: good effort but no cigar
      ... Microsoft saved money by making NT without a new maintenance ... build upon the progress it's already made in security. ... The low-hanging fruit of millions of insecure Windows machines ... Then there's the issue of poorly secured server applications. ...
      (microsoft.public.windowsxp.general)
    • SecurityFocus Microsoft Newsletter #176
      ... MICROSOFT VULNERABILITY SUMMARY ... Microsoft Windows XP HCP URI Handler Arbitrary Command Execu... ... PHPNuke Category Parameter SQL Injection Vulnerability ... Microsoft Baseline Security Analyzer Vulnerability Identific... ...
      (Focus-Microsoft)
    • SecurityFocus Microsoft Newsletter #242
      ... MICROSOFT VULNERABILITY SUMMARY ... PostNuke Blocks Module Directory Traversal Vulnerability ... Groove Networks Groove Virtual Office COM Object Security By... ... The Microsoft Windows IPV6 TCP/IP stack is prone to a "loopback" condition initiated by sending a TCP packet with the "SYN" flag set and the source address and port spoofed to equal the destination source and port. ...
      (Focus-Microsoft)