mailing list archives
Re: MS Security Response is a bunch of half-witted morons
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Sat, 13 Mar 2004 15:04:16 +1300
jim_walsh () goodyear com to me:
Nothing personal against Jim in particular here -- I've received a
couple of direct Email responses that suggest a few others may also
have had trouble grasping the _irony_ I was pointing out...
That dealt with, I'll now address the peripheral security issues Jim
mentioned in his response...
Your points are well taken and understandable. But if you are supporting
a M$ operating system enough to need to read the SB's, then wouldnt your
IE be up to date to read them? ...
First, you are assuming that "needing to read the security bulletins"
is something that may be limited to Windows users. I'm sure many die-
hard *nix security folk read the MS security bulletins with as much
interest as the security admin for a 150,000 seat Windows shop...
Second, you are assuming that if I were responsible for the security of
a large number of Windows machines I would actually use IE. Sorry, but
I am something of a "security expert" and I only use IE very sparingly
(e.g. when I absolutely _must_ access some of the MSDN material I
occasionally need _AND_ that is not available from the monthly DVD drop
of the same, and even then I am very careful).
... Even if you would just use IE to read M$'s
You missed my comments about the significance of the size and
desirability of MS as a target, didn't you?
And the comments about MS' highly lax attitude to shoddy content
distribution processes at third-party sites it has been known to use
from time to time.
I forgot to mention MS' extremely slack attitudes about the
responsibility of CAs and its continued use of one after a very public
complete f*ck-up where MS' preferred CA, despite having special
additional processes that few customers other than MS "enjoy", wrongly
issued code-signing certs in Microsoft's name to a non-Microsoft
I factor those, and other historical indications into my risk
calculations and that is part of why I certainly strongly prefer to
_NOT_ use any MS client software when interacting with any "official"
MS network presence. MS may not like that, but that's the reality of
the world we live in. MS _should_ recognize that if it truly is
planning on being seen as a serious "security player", but in reality
it continues to show incredibly little real concern for this, short of
a few early media-blitz stories about how it delayed Server 2003 so it
could turn off all the cr*p that should never have shipped enabled in
the first place and to take the time to teach its programmers how to
spell "buffer overflow".
... To sit and scream about web design decisions in this mailing group
seems a little childish. ...
You're welcome to your opinion but to date your opinion, and those
similar to it, are outweighed more than 10-to-1 in the responses I've
Also, "getting security" is one of those core attribute things -- you
either get it or you don't. The fact that such fundamental security
edicts as "though shalt not force users to enable 'dangerous' browser
functionality just to read about securing their computers" has NOT been
laid thick, hard and often on the web designers is yet further evidence
that "Microsoft just doesn't get security". Plenty of clever folk who
work at MS do "get security" (and undoubtedly many of them do so more
than I like to think I do) but they either don't care enough, or don't
wield enough influence, to actually have impact where it matters.
... And if one was to argue that "Aanyone needs to
read these articles not just people that support M$ OS's", well to
that...most people that have a M$ OS as an end user have auto update
turned on and dont even think twice about it...if they update at all.
I _know_ there are hoards and hoards of security ignorant folk out
there (just look at the number of witless, technically uninteresting
viruses that show up in our Email every day), and while I care (at some
level) about them and wish they could be helped, my primary concern
here is the security of my own computer systems. MS has _NO_ right to
dictate my security policies for these machines and while I am content
(well, not really, but I know it won't change any time soon) to browse
the wider web with my oddly extreme (by naive user standards) security
settings, it is unconscionable for a major OS vendor that is trying to
"clean up its security act" to take a stand such as this. The fact
that this even happened is, yet again, prima facie evidence that
"Microsoft just doesn't get security".
You're welcome to not agree with me, but you won't convince me that you
are not necessarily wrong _in this case_.
Contains confidential and/or proprietary information.
What bits precisely?
No, seriously, I need to know so I can avoid ever using that
information in anything I may say, write or produce in future. After
all, you went to the trouble of warning me, therefore it would probably
be negligent of me to not ascertain precisely what it is that I should
be careful to not infringe against in the future...
May not be copied or disseminated without express consent of
The Goodyear Tire & Rubber Company
Sh*te -- I just did and without express consent from your employer.
And so did the admins of these mailing lists. Do you really think The
Goodyear Tire & Rubber Company will mind?
Hmmmm -- thinking about it a bit harder, did _YOU_ have the _express_
consent of The Goodyear Tire & Rubber Company to post some of its
"confidential and/or proprietary information" to all these folk? Seems
an odd thing to do with what you're claiming is ostensibly legally
privileged and limited information, even if you _did_ have express
consent to do it...
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854
Full-Disclosure - We believe in it.
- Re: MS Security Response is a bunch of half-witted morons, (continued)