Subject: RE: Any value in this list ?

From: Samantha Naleendra Senaratna <[email-masked]>
Date: Wed, 01 Aug 2001 14:40:07 +1000

Hey,

I do not totally agree with Ian. I think Microsoft does not give enough 
emphasis into security in their products. They do a hell of a job on 
marketing their products and making them seem flashy and attractive, and 
only if they put that much work on security. For example six patches were 
put forward only for this month for patching up vulnerabilities on their 
products. It is a fact that most of viruses are propagated via Outlook. It 
is about time that Microsoft gave more thought into this rather than giving 
excuses because by far they are leading the market in software products as 
well as they have the resources to do it.

Sam

At 11:45 AM 7/31/2001 -0700, Ian King wrote:
>Randy,
>
>People wanted to do more than just exchange text messages, and Microsoft
>(and other companies) built products to help them do that.  Microsoft
>also produces a lot of information on how to secure its products.  I do
>not have the data at hand, but I have read several times that when
>Microsoft servers are compromised, it is often because they are
>misconfigured.  The argument then becomes, "Why aren't they easier to
>configure?"  Go back to premise #1, that people want to do more than
>just exchange text messages - they want collaboration and forwarding and
>rich attachments and scheduling and all the rest of it.  The bells and
>whistles require lots of knobs and switches....
>
>I would also point out that NONE of this class of viruses can infect
>unless the user executes them!  It's not as if Outlook or any other MUA
>automatically launches these viruses - people who evidently live in a
>complete vacuum and have never heard warnings about executable content,
>blissfully double-click on the clearly-identified package, and it blows
>up in their (our) faces.
>
>BTW, internally our mail servers are configured to strip anything that
>looks remotely like an executable.  Sometimes this is a pain (I can't
>mail a legitimate script to a colleague), but that's the world in which
>we live - more openness means more opportunity for sabots in the gears.
>
>
>In any event, blaming any one company for viruses because its products
>are abused, seems way too much like e.g. blaming automobile
>manufacturers for reckless driving.  Sure, no one really needs a car
>that can do 150 MPH when the limit is 60 or 70, but the majority of
>customers demand a vehicle that *could* do twice the limit, regardless
>of whether they take advantage of the capability -- or those vehicles
>wouldn't sell.  Bottom line: blaming the instrumentality is easy, but
>futile.  Human beings are responsible for their own actions, although
>some wish to evade or abuse that responsibility.
>
>Again, this is my own opinion, no one else's -- Ian
>
>-----Original Message-----
>From: Randy Bush [mailto:[email-masked]]
>Sent: Tuesday, July 31, 2001 10:07 AM
>To: Ian King
>Cc: [email-masked]
>Subject: RE: Any value in this list ?
>
>from the outside, it appears as if microsoft consciously decided to
>distribute software with everything enabled so that their product
>would be perceived as very easy to use.  the problem is that this
>means it is also easy to abuse.  so the net is now paying for them
>having a more salable product.  who gains, who is bearing the cost?
>
>randy

---

From: "Venkateswar Reddy Melachervu" <[email-masked]>
Date: Wed, 1 Aug 2001 14:08:10 +0800

Ladies and Gentlemen,
Do we have this list for debating about Microsoft products or how frequently
it released patches or to discuss about the *internet and related issues*?

Regards,
M.Venkateswar Reddy

--------------------------------------------------------------
Huawei Technologies,
Shenzhen, China
Off : +86 755 6540476/77
Hotel :+86 755 6602222  Suit:540
* Ideas and opinions expressed in this mail are personal *
--------------------------------------------------------------
----- Original Message -----
From: Samantha Naleendra Senaratna
<[email-masked]>
To: <[email-masked]>
Sent: Wednesday, August 01, 2001 12:40 PM
Subject: RE: Any value in this list ?

---

From: jamal <[email-masked]>
Date: Wed, 1 Aug 2001 07:14:37 -0400 (EDT)

> it released patches or to discuss about the *internet and related issues*?

And what you makes say this is not related to the "internet"?
MS is producing inferior products which are using the internet to create
havoc.

cheers,
jamal

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 1 Aug 2001 15:06:49 +0200

Jamal writes:

> MS is producing inferior products which are using
> the internet to create havoc.

Extraordinary claims require extraordinary proof.  Do you have any?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Wed, 1 Aug 2001 16:38:56 +0200

Jamal writes:

> I dont see anything extraordinary in those claims.

You don't substantiate them, either.  This being so, they serve no purpose, as
rants against Microsoft are a dime a dozen on the Net--just about every young
male who isn't rich or has failed to get an instant offer from MS after sending
in his resume seems to hate the company.  And students often hate the company
just because they were indoctrinated that way by faculties that have the
not-rich/resume-rejected problem themselves.

If you really feel that Microsoft is doing these things, point us to the
evidence.

> in regards to inferior products: i can site many
> many things ...

Good.  I'm waiting.

> would the fact that BSD is still running the show
> at hotmail be sufficient proof to you ...

No.  Hotmail has had a custom-tweaked version of UNIX running for years (if I
recall correctly, the mailer software was specially modified for Hotmail so that
it could scale); most of it is gradually being moved to Windows and (possibly)
Exchange (although Exchange is poorly adapted to that kind of application), but
I'd be very surprised if all of it were entirely supported on Windows, just as I
know that it has never been supported with any out-of-the-box UNIX environment.
The scale is just too great for any canned solutions.

Would the fact that MVS is still the leading mainframe OS be proof to you of the
inferiority of UNIX?  What about the predominance of Windows on the desktop?

You'll have to do better than that.

> ... or would you need evidence in regards to
> BoDs at airports and ATM machines when you try
> to get some cash at 3am?

I've never seen one, but the mere fact that they are using Windows should tell
you something.  Traditionally, OS/2 has ruled in ATMs, but last I read of this,
Windows NT Workstation was making inroads into this market.  I don't recall any
UNIX presence at all, but I may be wrong.

You'll need to come up with something more than anecdotes.  Something that can
withstand analysis by an unemotional observer with no ax to grind.

> in regards to havoc on the internet: Is the current
> thread insufficient for you?

Yes.  It says nothing at all about Microsoft creating any havoc with anything.

> Again i dont see any extraordinary about any of
> those claims.

They are all subjective and useless rants without hard data to back them up, and
you haven't provided any hard data.

---

From: jamal <[email-masked]>
Date: Wed, 1 Aug 2001 09:57:28 -0400 (EDT)

I dont see anything extraordinary in those claims.
in regards to inferior products: i can site many many things,
would the fact that BSD is still running the show at hotmail be sufficient
proof to you; or would you need evidence in regards to BoDs at airports
and ATM machines when you try to get some cash at 3am?
in regards to havoc on the internet: Is the current thread insufficient
for you?
Again i dont see any extraordinary about any of those claims.

cheers,
jamal

---

From: jamal <[email-masked]>
Date: Wed, 1 Aug 2001 11:51:58 -0400 (EDT)

On Wed, 1 Aug 2001, Anthony Atkielski wrote:

> I've never seen one,

Maybe this will help (and yes ive seen a few, i wish i had a camera)
http://www.daimyo.org/bsod/
Those going to the IETF: Heathrow airport tends to be a good place to
find these things.

>  but the mere fact that they are using Windows should tell

I see the statement you make as a naive assertion as to whether success is
defined by quality rather than monopolistic or marketing reasons.
Predominance in the case of MS is a result of marketing and monopolistic
tendencies, nothing  whatsoever to do with quality. That should be clear,
i hope. Ask the DoJ.
Predominance of MVS is purely to monopolistic tendencies.

I dont think i need to give you any "hard proofs" (to use your term) that
over the last few years, the most disastrous internet viruses are a
a result bad quality design at MS.
It's a shame we dont have standard bodies to ensure quality assurance
on what OSes should be allowed to be on the internet.
Come to think of it, we have moral obligation to ensure that bad OSes
should not be on the internet (maybe i am being too extreme, but i feel
it is unethical for continous harassment from one Os)

> withstand analysis by an unemotional observer with no ax to grind.

I hear you -- didnt get that job therefore didnt get rich and
therefore have an axe to grind. It's definetly a new conspiracy theory.

cheers,
jamal

---

From: Theodore Tso <[email-masked]>
Date: Wed, 1 Aug 2001 18:21:38 -0400

> Extraordinary claims require extraordinary proof.  Do you have any?

How about several megabytes of data sent to the IETF list?  

And this is after Microsoft had been told, multiple times, that active
content was highly dangerous, and MS's response was that because
customers wanted "advanced features", this justified it all.  Sorry,
but I don't buy that argument.

And this is what it makes it different from the buffer overruns in
sendmail.  Those were accidental.  What Microsoft did in MS Outlook
was deliberate and intentional, and that's a major difference.  And
this has nothing to do with Microsoft being Microsoft.  I would be the
first to stand up and denounce GNOME or KDE if they did something as
stupid and irresponsible as what Microsoft did with their mail
readers.

						- Ted

---

From: "Venkateswar Reddy Melachervu" <[email-masked]>
Date: Thu, 2 Aug 2001 08:48:30 +0800

Well,
U know my friend every thing in the universe is relative and hence connected
to each other. So do we discuss in this list about all issues like how MS
Office or outlook injects bugs when connected to Internet just because U see
the term Internet in the sentence?
Regards,
M.Venkateswar Reddy

--------------------------------------------------------------
Huawei Technologies,
Shenzhen, China
Off : +86 755 6540476/77
Hotel :+86 755 6602222 Room No:540
--------------------------------------------------------------
----- Original Message -----
From: jamal <[email-masked]>
To: Venkateswar Reddy Melachervu <[email-masked]>
Cc: Samantha Naleendra Senaratna
<[email-masked]>; <[email-masked]>
Sent: Wednesday, August 01, 2001 7:14 PM
Subject: Re: Any value in this list ?

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 07:20:03 +0200

> How about several megabytes of data sent to the IETF list?

Noise doesn't count.

> And this is after Microsoft had been told, multiple
> times, that active content was highly dangerous,
> and MS's response was that because customers wanted
> "advanced features", this justified it all.  Sorry,

I do.  Microsoft is right.  I consider active content a huge security hole
myself, but I'm part of a small minority.  Most people want their Flash and
Shockwave and RealPlayer stuff and what-not.  I have that all turned off.  I'd
like to turn off Javascript, too, but most sites these days are inaccessible
without it, as the designers have never considered the possibility of a visitor
without Javascript entering the site.  And, increasingly, sites are inaccessible
without a Flash control installed; I just don't visit those sites at all, since
they are usually the sites of movie companies, ill-informed European companies,
and the like.

> What Microsoft did in MS Outlook was deliberate
> and intentional, and that's a major difference.

So?

> And this has nothing to do with Microsoft being
> Microsoft.

True.  Other vendors do the same thing.  It's only a matter of time before Adobe
ruins PDF by including active content in PDF files, if they haven't already done
so (I still use version 4, which is mercifully free of such capabilities, but
since Adobe has to bloat software to maintain their revenue stream just like
everyone else, it's only a matter of time).

---

From: Garrett Wollman <[email-masked]>
Date: Thu, 2 Aug 2001 12:40:45 -0400 (EDT)

<<On Wed, 1 Aug 2001 18:07:56 +0200, "Anthony Atkielski" <[email-masked]> said:

>> I hear you -- didnt get that job therefore didnt
>> get rich and therefore have an axe to grind.

> It is one common motivation for bashing.

Of course, there is absolutely no evidence to back up your assertion.

-GAWollman

---

From: "Anthony Atkielski" <[email-masked]>
Date: Thu, 2 Aug 2001 21:49:39 +0200

> Of course, there is absolutely no evidence to back

In other words, I have the same evidence backing my assertions as the
Microsoft-bashers have backing theirs.