- From: "Steve Riley [MSFT]" <steve.riley@xxxxxxxxxxxxx>
- Date: Tue, 22 Jul 2008 19:03:28 -0700
Dan, how in the world have you conflated remote assistance with file systems? They have zero relationship.
Besides, the presence of a remote assistance capability does not at all indicate that the underlying operating system is inherently less secure -- just like the absence of such ability does not indicate that the underlying operating system is inherently more secure. The remote assistance feature:
* is disabled by default
* requires you to enable it before any connections are permitted
* requires you to invite someone else to connect
* encrypts the communications path with 128-bit RC4
* allows you to disconnect the session at will
Using your terminology, these steps provide sufficient "internal safety." There is no way that someone from anywhere in Microsoft (not just India) can or would connect to your computer without your knowledge and consent.
Linking back to file systems -- you do understand, of course, that your FAT-formatted C: drive is accessible to any remote assistance session. Say you have Windows 98 on that drive. A malicious remote assistance user could easily replace those files and -- if you weren't watching -- you'd have no idea until you next booted it. Compare this Windows Vista: if someone replaced parts of the non-booted operating system, then next time it's booted, Windows integrity protection and system file protection alerts you to this; the system either refuses to boot or reverts to its original state (depending on what was maliciously overwritten). Again, Vista's "internal safety" is vastly improved over that of any previous version of Windows.
I don't know what else I can say to help you understand.
"Dan" <Dan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:2EB67198-4ACB-4437-A17C-3CA42D5C342C@xxxxxxxxxxxxxxxx
2. That is true but XP and even Vista are totally focused on external
security. Can Microsoft remotely work on a Microsoft Windows 98 Second
Edition computer via India like Microsoft can work on a Windows XP
Professional computer? Microsoft has done remote access work on the XP side
of my dual-boot computer which is in NTFS. My computer has a Western Digital
Hard Drive in Fat 32 on C: and a separate hard drive on D: with Windows XP
3. I have tried out Ubuntu Linux within a Windows environment within XP
Professional. I have run Windows Virtual PC 2007 within Windows XP
Professional. It is great but it does not fully meet my needs as a consumer.
Consumers want to play games. My friend Chris from camp is going to build a
98 Second Edition computer with my old motherboard. He wants to play old dos
games that he enjoys. The nice thing about 98 Second Edition is that you can
exit to MS-DOS mode. This allows gamers to play games. It is all in the
Microsoft articles about compatibility.
"Steve Riley [MSFT]" wrote:
You are asserting that one single vulnerability allows "military and top
secrets to be leaked" and thus requires the use of some other operating
system. You simply cannot make this assertion, for two reasons.
1. NO ONE KNOWS whether your suggested operating system has the same
2. ALL software has vulnerabilities, many of which allow attackers to take
control of a system. Establishing good security practices (patch when we
release, install only the services you need, apply the principle of least
privilege to data, and so on) is MORE important than the particular piece of
technology you've chosen to deploy. And the older the software is, the more
difficult it is to manage and the more likely it is to get attacked --
because older software was not written to be centrally-managed (no group
policy and no machine identity in 9x, for instance) and was not written with
resiliency in mind.
And this talk of "internal safety" regarding 9x is really nonsensical. Vista
and even XP+SP3 are FAR more difficult to attack than 9x was. We at
Microsoft have the benefit of about 10 years of historical data from Watson
reports (online crash analysis, Windows error reporting). We can divine a
lot of information about attacks from this data. Whereas in the past most
attacks were targeted at the operating system, this is no longer true. The
majority of crashes we see now come from third-party software installed on
the box. And in this case, crashes are good: various features in the
operating system (DEP, ASLR, SRP, and more) have detected that something
malicious is happening, and stop it before the attack succeeds. You could
never do that with an OS as simple as 9x.
"Dan" <Dan@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> I see your point Steve but US-Cert maintains that all NT source code is
> vulnerable thus my point being valid about having 98 Second Edition
> within a network for internal safety reasons and potentially to act as
> gateways. How can we allow our military and top secrets to be leaked.
> Please see the United States Computer Readiness Team at the Department > of
> Homeland Security and so you can see how I am getting at the true value > of
> source code that is flexible enough to offer external security, > internal
> safety, and more. Thus we have a source code matrix as presented > below.
> am not skilled enough to write the code for this yet but I bet > Microsoft
> others are.
> NT= New Technology --- outer defense network
> 9x = Internal Safety --- based upon DOS as maintenance operating > system -- > lacking in XP and Vista --- no true maintenance operating system > according
> Chris Quirke, MVP --- Vista is indeed great on security issues but > still
> lacks in compatibility as the FAA has mentioned only using Windows 2000
> (which I like as well --- totally old-school reminds me of Windows 98
> Edition) as well XP machines (which are good but too vulnerable in this
> and age due to the large surface area created by too many services and > not
> having strong enough default settings within Internet Explorer -- > another
> reason to separate the browser from Windows like the Justice Department
> mentioned rightly in the 1998 case although Apple should be > investigated
> for the practice of tying Quick time with Itunes and I feel this > practice
> tying software must be banned for safety and security reasons in the
> Unix/Linux/Mozilla/etc. --- third party programs and open source
> technologies mingling as one with closed proprietary software which is
> protected by IP. Thank you for continuing this discussion.
> -------------------------------------------from us
> Vulnerability Note VU#800113
> Multiple DNS implementations vulnerable to cache poisoning
> Deficiencies in the DNS protocol and common DNS implementations > facilitate
> DNS cache poisoning attacks.
> http://www.kb.cert.org/vuls/id/MIMG-7DPJ7W (Microsoft NT but not 9x
> http://www.kb.cert.org/vuls/id/MIMG-7ECLCY (Ubuntu vulnerable)
> http://www.kb.cert.org/vuls/id/MIMG-7ECL5Z (Apple unknown whether
> I am sure you know see that 3 dans --- 2 on that website and myself
> Dan have helped bring this issue to light about how critical it is ---
> of boggles the mind doesn't it ---- good reason to bring 98 Second > Edition
> and/or another variant 9x/NT/Unix source code --- on-line --- Microsoft > is
> the only one that has the resources to do this and the whole world now
> your help -- Thank You for seeing the Light of our current situation
> the Defense Network.
> "Steve Riley [MSFT]" wrote:
>> A standalone telephone certainly is secure, and keeps its users safe. >> For
>> such a phone will never receive or transmit unwanted conversations, >> and
>> users of such phones will never be bothered with advertisements, >> thoughts
>> that challenge their perceptions, or interesting and surprising
>> A standalone computer certainly is secure, and keeps its users safe. >> For
>> such a computer will never receive or transmit unwanted software, and >> the
>> users of such computers will never be bothered with advertisements,
>> that challenge their perceptions, or interesting and surprising
>> No risk = no reward.
>> The value of a networked system increases as the square of the number >> of
>> elements in that system. A single system has a value of 1^2=1; a
>> network has a value of 2^2=4; a three element network has a value of
>> and so on. (Bob Metcalfe, "It's all in your head," Forbes Magazine, 7 >> May
>> 2007: http://www.forbes.com/forbes/2007/0507/052.html.)
>> Chris's distinction between the Internet and "a network" (presumably
>> private, for Chris doesn't specify) isn't useful today. The network
>> is clearly evident on the Internet; I'd argue that in a private >> network,
>> network effect is diminished. Why else would we all be rushing >> headlong
>> the eventual recognition that private corpnets truly belong on the
>> and that continuing to make the distinction means a loss of real >> business
>> value? (Scott Charney, "Creating a more trusted Internet,"
>> Steve Riley, "Directly connect your corpnet with IPsec and IPv6,"
>> I quote our own materials here as evidence of the demand from
>> forward-thinking customers that the industry envision new practices >> and
>> develop new technologies that allow for the full realization of the
>> effect. Chris's argument that per-user security "creates artificial
>> doesn't reflect reality. On the contrary, _stronger_ per-user (and
>> per-machine) identity and authentication are critical for allowing the
>> network effect to flourish. Indeed, the lack of strong identity and
>> authentication has been a hindrance, and that's why you see >> technologies
>> like smart cards and TPM chips becoming more common. When we reach the
>> where all communications are in the context of validated identities,
>> in transactions with integrity and confidentiality protection, between
>> endpoints that mutually authenticate their identities and their
>> configurations, then who cares whether the underlying network is >> trusted
>> -- >> Steve Riley