Following Up "Beware the Microsoft Shell Game!"
What this means is that unless a knowledgeable sysadmin has taken explicit action to prevent it, any 15-year-old who can copy code off the Internet, can use Microsoft's IIS to bypass your firewall, bypass your password system and gain administrator-level access to the machine that hosts your web server. They can inspect, alter or delete files at will, no matter how you have them secured. They can also use root-level access to that machine as a springboard for attacks on other systems inside your firewall.
A writeup on this latest in the apparently unending stream of gaping holes in Microsoft's security is at http://www.eeye.com/html/Research/Advisories/AD20010501.html.
This is about bad as it gets, folks. It's a big, nasty problem even by Microsoft's security-bug-of-the-month standards.
At Craig Mundie's anti-open-source sermonette in New York Thursday, I hope someone will have the temerity to ask him a few simple questions:
1. Should Microsoft's record on security inspire confidence in customers considering entrusting their digital identities to Microsoft's Hailstorm system and their critical business data to .NET?
2. Even the most cursory inspection of sites that specialize in tracking security bugs (such as CERT and BugTraq) suggests that open-source operating systems such as Linux and the BSDs have a far better security record than Microsoft Windows, both in having fewer vulnerabilities and in more rapid deployment of fixes. How does Microsoft propose to close the technology gap and catch up to the quality level of these systems?
3. How can potential operating-system customers with millions (perhaps billions) of dollars riding on the security of their computer systems form a rational estimate of their exposure if they cannot inspect the source code of those systems?
4. If the answer to question 3 is "You can see the source code if you're a big enough company to pay us for the privilege", then why should customers have to pay for the privilege of doing the job Microsoft's own QA teams so frequently bungle?
5. How would you respond to the following statement: "Any engineer or executive who, disregarding best practices, entrusts security-critical functions to closed-source software is committing an actionable breach of their responsibility to their employer?"
Eric Raymond can be contacted at Eric S. Raymond.
|Red Hat Enterprise Linux 7.1 beta available on IBM Power Platform||Jan 23, 2015|
|Designing with Linux||Jan 22, 2015|
|Wondershaper—QOS in a Pinch||Jan 21, 2015|
|Ideal Backups with zbackup||Jan 19, 2015|
|Non-Linux FOSS: Animation Made Easy||Jan 14, 2015|
|Internet of Things Blows Away CES, and it May Be Hunting for YOU Next||Jan 12, 2015|
- Designing with Linux
- Red Hat Enterprise Linux 7.1 beta available on IBM Power Platform
- Wondershaper—QOS in a Pinch
- Internet of Things Blows Away CES, and it May Be Hunting for YOU Next
- Ideal Backups with zbackup
- Slow System? iotop Is Your Friend
- New Products
- Hats Off to Mozilla
- Non-Linux FOSS: Animation Made Easy
- diff -u: What's New in Kernel Development
Editorial Advisory Panel
Thank you to our 2014 Editorial Advisors!
- Jeff Parent
- Brad Baillio
- Nick Baronian
- Steve Case
- Chadalavada Kalyana
- Caleb Cullen
- Keir Davis
- Michael Eager
- Nick Faltys
- Dennis Frey
- Philip Jacob
- Jay Kruizenga
- Steve Marquez
- Dave McAllister
- Craig Oda
- Mike Roberts
- Chris Stark
- Patrick Swartz
- David Lynch
- Alicia Gibb
- Thomas Quinlan
- Carson McDonald
- Kristen Shoemaker
- Charnell Luchich
- James Walker
- Victor Gregorio
- Hari Boukis
- Brian Conner
- David Lane