MS preps emergency patch for Windows shortcut peril Warning of an uptick in attacks, Microsoft plans to issue an emergency update to patch a critical Windows vulnerability that hackers are exploiting to seize control of PCs. The patch, which fixes the way Windows parses shortcut icons, will be released on Monday at around 10 a.m. California time. It comes two weeks after reports …
are you too dense to recognise that marketing does not equal reality? I mean, do you REALLY think that those sugary breakfast cereals are part of a better balanced diet? Do you REALLY think that bottled water is totally pure as the driven snow? Do you REALLY think that a subcompact Chevy is actually as safe in a crash as they swear to you it is?
Hmmm. Or are we just somehow expecting IT marketing to actually, for some miracle reason, actually be LITERALLY true in every detail, whereas every other thing in our lives gets a pass?
I'm not saying it's not a bad thing that this wasn't fixed, but honestly, all the anti-vendor marketing speak sometimes feels like listening to 14 year olds....
"Or are we just somehow expecting IT marketing to actually, for some miracle reason, actually be LITERALLY true in every detail, whereas every other thing in our lives gets a pass?"
I can't speak for the OP, but I grant no passes. All marketing lies are offensive. The sub-text in every case is "We think you are stupid enough to fall for this and have no moral qualms about exploiting other people's stupidity for our own personal gain.".
The problem is, in this case as in so many OTHER cases of marketing speak, that it isn't a total lie.
Anyone who knows much about Vista will understand that substantial areas of the kernel and the device driver models WERE totally re-written from XP, to avoid many types of attacks. They broke a whole lot (i..e., ALL) of 3d party device drivers to do it, too. So we can see that that happened - in fact it happened to such a degree that Vista got a terrible reputation for how many devices didn't have drivers for it after it launched....
But an OS is more than just the kernel and the device driver models - it has all sorts of ancillary helper programs and services, some of which were re-written, some of which were not (as it seems with this one).
So how SHOULD MS go about publicizing the rather large amount of work they did on their kernel, et al? Should they say - "well, we totally re-wrote 25,000 function points of our operating system, but we didn't get around to 55,000 function points of the helper apps?" YEAH, I think not, not at least to Joe Sixpack buying his home computer at Best Buy or Tescos. Function points? I mean who besides Computer Science grads even know what they are?
So what metric should they use? Lines of code? Umm, high level or assembler? Megabytes of executables? I mean, what makes sense?
The answer is that NONE of it makes sense to the vast majority of people that buy Operating Systems. SO - MS, knowing that they really, really did re-write the major sections, simply says "we re-wrote it from the ground up." Because there is no good way to quantify how much they actually did do - and it kind of makes sense.
Same thing with the Chevy subcompact. Now, Chevy subcompacts actually have pretty marginal crash scores in many cases, compared to other cars on the road. But a point CAN be made that all of them are much, much safer than subcompacts of 10 or 20 years ago - MUCH safer. So are they lying when they say they are safe? Yes...and no. Not a clear answer.
Somehow, it seems that CAVEAT EMPTOR has been forgotten...and people keep looking for anything that is not perfect as evidence of ill-intent and deception, rather than admitting that ANYTHING that is created by man is imperfect...
The architect of NT was Dave Cutler, ex-Digital Equipment Corp, so I have always understood that NT had little to do with BSD, but a whole lot to do with VAX OS. I believe some research will show such beliefs to be common to those of us that were around the industry about that time (I've done a little bit of work on VAX OSes, including the real-time variant).
Now, it is true that BSD was ported to run on the VAX architecture, and many VAX machines did end up running BSD, but BSD had little if anything to do with the VAX OS as originally developed by DEC and later copied by MicroSoft's team of ex-DEC developers (Cutler brought several of his DEC team to Redmond). VAX OS was in many ways a more technically accomplished OS than BSD, including heavy-weight clustering and multi-processor support when such things were almost unheard of...
Microsoft lie.
They always have.
MS-DOS was not developed by Microsoft.
NT was NOT paradigm shifting - it had large chunks copied from (I think) BSD. Not the best bits though!
95 was almost as good as some of the operating systems on the Unix machines at my uni...
Vista was not good.
At that point I stopped listening to them and stopped buying any more of their crap.
Had it not been for the pressure applied by the security researcher, buy disclosing this flaw MS would still be sitting around with their thumbs up their asses.
I am all for public disclosure.
Having read the "hurry up and wait" part of their disclosure document, I find it's complete bunk.
Sooner you publish a hole, sooner it gets fixed.
>Microsoft rarely issues patches outside of its monthly schedule ...
>By our count, this is the third time this year Microsoft has issued
>a so-called out-of-band update.
Today is still July, month number seven.
How the heck is three out-of-band in seven months "rare" ??
If this is rare then I hate to think how charred "well-done" would be.
I wait well over ten years before thinking a Win32 OS might be safe enough to trust, finally upgrade the other half's PC from W98 to XP (not many of these vulns affect W98 or Acrobat 5 or ...), and instantly there's yet another string of holes wide enough to drive a tank through.
If only there was an alternative...
;)
Robert's memory seems to be failing a bit, so here's a bit more background, especially for the young uns.
The relevant mainstream VAX OS was called VMS (or later OpenVMS), which in its day was the industry standard 32bit OS. Despite Compaq's and HP's efforts, VMS is still around, and still has class-leading heavyweight clustering and SMP support and and and (though it's still awaiting its own implementation of IPsec, isn't it Richard).
Basically VMS is what NT wanted to be when it grew up, except NT had dropped some of the VMS stuff that Cutler presumably considered "unnecessary baggage" on VMS (stuff like fine-grained security, and resource-specific quotas to prevent resource exchaustion Denial of Service issues). Gates wouldn't have wanted these anyway as although they improved system integrity they caused a performance hit and NT was already slower than W98 on the same tin.
Unfortunately Gates took NT down a different road and now it never can be VMS++. "Trusted computing" in the NT sense doesn't mean the users or admins or whatever can trust it to protect the integrity or confidentiality of their data, it means the "content providers" can trust it not to provide easy ways of copying their highly valuable "content".
In discussions of the history of NT it is commonly noted that Cutler was one of the architects of VMS, and that WNT = VMS++. What is less often noted is that Cutler was also one of the architects of a superb but little-known realtime OS+toolset for VAXes, which was called VAXELN.
There are a few bits in common between the NT kernel and the VMS kernel, but there are a lot more bits common between the NT kernel and VAXeln. You will find this confirmed in Helen Custer's book, "Inside Windows NT" (though I am speaking from personal experience of VMS and VAXELN internals, and from having read about NT internals).
There's been lots of discussion of whether the IP stack inside NT was or wasn't based on the BSD stack at some point. I don't know the answer to that one.
Dave Cutler and a very small team from Digital Equipment Corporation (DEC) were a very visible part of the Win NT development, receiving much of the credit for its development, some deservedly. Unfortunately, the positive impact they had in some areas were more than offset by the negative impact in some others and by the pernicious influence of the C language, Unix, and the undisciplined design and development espoused by many academics at that time and which now dominates our industry.
While Windows NT has many similarities with the VMS and later OpenVMS operating systems, it and the other MS systems were then and remain today fatally flawed, in many cases sharing these flaws with the various Unix variants and with many other C-based environments. These very same types of flaws are directly responsible for this latest breach. At their core are simple concepts, like fully validating the arguments to system calls and using string descriptors and counted strings rather than NULL-terminated ones or using typed pointers rather than unrestrained ones a la "C". If only we had not ...
It is a great tragedy for our industry and for the entire world that Unix and C gained prominence within the academic and research establishments, supplanting all those alternatives of which any one would have better reflected the "best practices" we had painfully discerned. If only we had taken all that we had learned with systems like Multics and later applied in newer systems like VMS/OpenVMS, we might have avoided many of today's perils.
Cutler and his guys knew better, they had just done the PL/I compiler for the VAX using technology derived from the Multics PL/I compiler. Gates should have known better since he had learned on the TOPS-10 system on the DEC PDP-10. Many of the newly-minted CS professors probably did not know better, most never having worked on a real system of any type much less one used in "production". Their students were truly clueless about security, data representation, robust and reliable systems, or much else. The overwhelming majority still are.
Dave, Don, et al do not get a free ride. They made their share of stupid decisions with NT that are still hanging around today. Dave was always known as a quick and dirty programmer -- really good at delivering something as a first version to customers, but moving on while others spent then years honing his "proof of concept" implementation into a sustainable, supportable product roughly two versions and three years later. (Ask anyone who worked with his early RSX-11 operating systems or with early versions of RSX-11M.)
NT is only one example of how many places we collectively failed our industry, making "engineering tradeoffs" where no tradeoff should have been allowed. While many of us knew better, we were swamped by recurring themes in the industry: newer is perceived as better; weaknesses are marketed as strengths; low initial price always wins whether functional or not.
BTW I never worked for DEC nor MS, but have been a customer, partner, and sometimes supplier to them and to other clients in many industries including SCADA. I have personally known and worked with the people I mention.
VMS/OpenVMS on whatever hardware is still the system I would most trust when my life depended on it. It is insane that MS Windows is being used in applications like SCADA rather than a reliable, robust, and far more secure system like OpenVMS.
According to the story I read a number of years ago, it wasn't just the team that went from DEC to Microsoft. At some point it was discovered that parts of the VMS source code, _including the original comments_, were present in early versions of the NT code base. The resulting legal action was dropped when Microsoft agreed to develop NT to run on DEC's Alpha processor - hence the hardware-abstracted architecture of NT, subsequently extended to the PowerPC.
I wonder how much truth there is in this. Most of VMS seems to have been built using a very DEC-specific language called BLISS. I don't suppose that would have been much use to Microsoft.
Who downvoted AC's post? Dave Cutler? Bill Gates? A C-language enthusiast?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
