Does Microsoft Need a New Source Code for the Future?

Does Microsoft Need a New Source Code for the Future?

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Does Microsoft Need a New Source Code for the Future? =?Utf-8?B?RGFu?= 07-24-2008
Posted by =?Utf-8?B?RGFu?= on July 24, 2008, 9:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I want to start a new topic on this because the Biometrics debate has gotten
too long. I will now post Chris Quirke, MVPs reply to me about my thinking
the 9x (98 Second Edition) should be part of the internal Defense Network of
this source code.

Chris Quirke, MVP says:

I think we have the same ideas, but weigh things differently and
reach different conclusions - you see the 9x code base itself as
being something to be preserved at all costs, where I see the
factors that make the 9x code base safer in certain respects as
something that should inform other code base development.

An interesting point from the article I linked for you, was the
difference between deeply re-architecting an existing code base,
and starting a new code base from scratch. I'd have though such
deep design change to be as disruptive as re-coding from scratch,
but apparently this is not the case. If that's so, then it may be
practical to re-architect the NT code base as a true stand-alone
OS, which keeps networking out of the center as an discardable
subsystem should unexpected risks demand that response.

I put it this way; exposed code surfaces are like points of wear
in a car. You don't merge piston rings into pistons (or brake
shoes into axles) so that when these parts get worn, they are
easy to replace. Same thing with code surfaces; you may have
to suddenly amputate or replace them, so don't embed them in
the core of how the OS works.

For example, an OS should be able to wipe its own butt without
RPC, and/or not expose RPC to network surfaces (especially
the Internet). It shouldn't rely on RPC to do internal things, weld
this into Internet exposure, and then rely on a firewall as a band
aid over this clickless, remotable risk surface.


Posted by S. Pidgorny on July 25, 2008, 10:23 am
If you were  Registered and logged in, you could reply and use other advanced thread options
G'day:


> I think we have the same ideas, but weigh things differently and
> reach different conclusions - you see the 9x code base itself as
> being something to be preserved at all costs, where I see the
> factors that make the 9x code base safer in certain respects as
> something that should inform other code base development.

Windows 3.1/9x code base is now dead. Everything is NT. Not sure about
mobile devices but will not be surprised with XP as the base for Windows
Mobile next version.

> For example, an OS should be able to wipe its own butt without
> RPC, and/or not expose RPC to network surfaces (especially
> the Internet). It shouldn't rely on RPC to do internal things, weld
> this into Internet exposure, and then rely on a firewall as a band
> aid over this clickless, remotable risk surface.

RPC is as good (or bad, depending on your by-default attitude) as any other
IPC. I can disable RPC in Windows and still run software, but I see no
reason to.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *




Posted by =?Utf-8?B?RGFu?= on July 25, 2008, 1:39 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Windows 9x may be dead somewhat to Microsoft but it is alive and kicking
everywhere else with Mozilla still supporting it with their web browser as
well as AVG 7.5 supporting it as well. People do not realize how stable it
has become.

Heck, 98 Second Edition for me is more stable than XP Professional. Vista
while it is stable enough for me still suffers somewhat with compatibility
issues. However, Vista is indeed tops with external security. However,
Windows 9x has the internal safety and less surface area to attack because it
does not have the services that XP has and XP likes to throw all the
information back compared to 98 Second Edition which is a lot quieter and
runs really well on older PC's. You talk about a great opportunity for all
those used computers that cannot run XP and why not have them run 98SE
instead of being tossed in the landfill. I am sure there are many people
around the world that would see having a computer as a great luxury.

Thanks for replying though and I appreciate your views and I already know
about the end of life software date of July 11, 2006. BTW, did you know this
fact on the Microsoft 98 Second Edition page:

http://support.microsoft.com/ph/1139

Last Review : February 28, 2008

It sounds like Microsoft does care for 98 Second Edition users like myself
who are looking into ways for the company to expand and explore new avenues
into the future of information technology. Microsoft is really great about
supporting their legacy users and I feel that Microsoft has a much better
track record of caring than say Apple who thinks their products are, oh so
great, that Apple can charge a huge premium for them when Apples are based
upon open source code anyway.

You talk about how ironic that is. Furthermore, Bill Gates and Microsoft
are the bad guys in many people's eyes but that is simply not true because
Microsoft is gladly willing to help its users and Bill Gates is now working
to make the world a better place for people who have limited opportunities
and are starving and sick with Aids and Malaria through his Foundation.

So you see that Windows 9x is not truly dead. The reason being is that it
still has life in it and why do you think Microsoft has not sold the 9x
source code if it is useless. The great thing about 9x is that it is
compatibility with older software and games and uses MS-DOS as a maintenance
operating system compared to Vista.
I am using 98 Second Edition as I post back to you and it never seems to
have any issues anymore as long as you don't use too much ram.

I use 512 megabytes of ram with it and editted the system.ini to recognize
less and have a 256 megabyte ATI video card. Nope, it is Windows XP Service
Pack 3 that is having the issues right now with people having trouble getting
updates for it without the proper patch to register the *.dlls again. In
addition, Windows Vista has great external security but lacks the internal
safety of a 9x operating system.

I use XP Professional in a dual-boot on the same machine on a seperate hard
drive. It is NTFS file system compared to the Fat32 file system of 98 Second
Edition.

The thing is when the APS domain was hacked into last summer (2007), the
hacker(s) got into the XP Professional side of my machine because the
external security of the network was destroyed. However, I was also using
VPN to link with the Intranet of the APS domain and 9x did not get hacked
because it has internal safety of a smaller surface area, no rpc, a true
maintenance operating system of MS-DOS, etc. So you can see how 9x machines
were meant to be stand alone. In this ever increasing digital age, I am
surprised that more home consumers do not rise up and demand another 9x
operating system to be able to be more stand-a-lone and not report in to
their boss and/or the government all of the time. Are people really that
willing to give up their precious freedoms to others and end up having the
equivalent of a network computer that does not have an essence of its own
individuality.

It surprises that so many people do not see this and the coming danger of
willing to have just one easily hackable source code out there. You must
have a comprehensive internal safety and external security solution with
closed and open source technologies available from Microsoft and others to
make the best operating systems out there possible and to help mitigate any
incoming threats that may want to harm the Matrix FrameWork and Subsystems of
the Network.

----------------------------------------------------------------------------------------------

"S. Pidgorny <MVP>" wrote:

> G'day:
>
>
> > I think we have the same ideas, but weigh things differently and
> > reach different conclusions - you see the 9x code base itself as
> > being something to be preserved at all costs, where I see the
> > factors that make the 9x code base safer in certain respects as
> > something that should inform other code base development.
>
> Windows 3.1/9x code base is now dead. Everything is NT. Not sure about
> mobile devices but will not be surprised with XP as the base for Windows
> Mobile next version.
>
> > For example, an OS should be able to wipe its own butt without
> > RPC, and/or not expose RPC to network surfaces (especially
> > the Internet). It shouldn't rely on RPC to do internal things, weld
> > this into Internet exposure, and then rely on a firewall as a band
> > aid over this clickless, remotable risk surface.
>
> RPC is as good (or bad, depending on your by-default attitude) as any other
> IPC. I can disable RPC in Windows and still run software, but I see no
> reason to.
>
> --
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-
>
> * http://sl.mvps.org * http://msmvps.com/blogs/sp *
>
>
>
>

Posted by S. Pidgorny on July 25, 2008, 10:07 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
G'day:

news:55349169-F536-4137-B4A3-

> So you see that Windows 9x is not truly dead. The reason being is that it
> still has life in it and why do you think Microsoft has not sold the 9x
> source code if it is useless.

I didn't say that Windows 9x is dead, or that the code is useless. I said
the codebase is dead - in a sense that there is no active development on the
code base. Why it is not sold, or made open - I don't know, and cannot
speculate.

> The thing is when the APS domain was hacked into last summer (2007), the
> hacker(s) got into the XP Professional side of my machine because the
> external security of the network was destroyed. However, I was also using
> VPN to link with the Intranet of the APS domain and 9x did not get hacked
> because it has internal safety of a smaller surface area, no rpc, a true
> maintenance operating system of MS-DOS, etc.

The reason your internal network wasn't hacked is not that Windows 95
doesn't have RPC. In targeted attacks, platform switch doesn't stop
intruders who usualy collect credentials and go from there.

> So you can see how 9x machines
> were meant to be stand alone. In this ever increasing digital age, I am
> surprised that more home consumers do not rise up and demand another 9x
> operating system to be able to be more stand-a-lone and not report in to
> their boss and/or the government all of the time. Are people really that
> willing to give up their precious freedoms to others and end up having the
> equivalent of a network computer that does not have an essence of its own
> individuality.

Nonsense, Slashdot-style.

--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-

* http://sl.mvps.org * http://msmvps.com/blogs/sp *




Posted by Paul Adare - MVP on July 25, 2008, 11:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Fri, 25 Jul 2008 10:39:19 -0700, Dan wrote:

> Windows 9x may be dead somewhat to Microsoft but it is alive and kicking
> everywhere else with Mozilla still supporting it with their web browser as
> well as AVG 7.5 supporting it as well. People do not realize how stable it
> has become.

Just because some application vendor's products run on Windows 9x still
does not mean they are supporting it. If a vulnerability is discovered in
the OS, the app vendors are not about to provide a patch for it. Windows 9x
is no more stable now than when it was originally released.
>
> Heck, 98 Second Edition for me is more stable than XP Professional. Vista
> while it is stable enough for me still suffers somewhat with compatibility
> issues. However, Vista is indeed tops with external security. However,
> Windows 9x has the internal safety and less surface area to attack because it
> does not have the services that XP has and XP likes to throw all the
> information back compared to 98 Second Edition which is a lot quieter and
> runs really well on older PC's.

Compared to Vista and XP, Windows 9x has almost no "internal security"
which is a false term in the first place.

> You talk about a great opportunity for all
> those used computers that cannot run XP and why not have them run 98SE
> instead of being tossed in the landfill. I am sure there are many people
> around the world that would see having a computer as a great luxury.


Since the discussion is about security, the above has nothing at all to do
with the topic at hand.

>
> Thanks for replying though and I appreciate your views and I already know
> about the end of life software date of July 11, 2006. BTW, did you know this
> fact on the Microsoft 98 Second Edition page:
>
> http://support.microsoft.com/ph/1139


What "fact" are you referring to? If you're referring to the end of life
date, that is well known and can be found on lots of pages on the Microsoft
web site.

>
> It sounds like Microsoft does care for 98 Second Edition users like myself
> who are looking into ways for the company to expand and explore new avenues
> into the future of information technology. Microsoft is really great about
> supporting their legacy users and I feel that Microsoft has a much better
> track record of caring than say Apple who thinks their products are, oh so
> great, that Apple can charge a huge premium for them when Apples are based
> upon open source code anyway.

This makes no sense at all.

>
> You talk about how ironic that is. Furthermore, Bill Gates and Microsoft
> are the bad guys in many people's eyes but that is simply not true because
> Microsoft is gladly willing to help its users and Bill Gates is now working
> to make the world a better place for people who have limited opportunities
> and are starving and sick with Aids and Malaria through his Foundation.

Again completely irrelevant.

>
> So you see that Windows 9x is not truly dead. The reason being is that it
> still has life in it and why do you think Microsoft has not sold the 9x
> source code if it is useless. The great thing about 9x is that it is
> compatibility with older software and games and uses MS-DOS as a maintenance
> operating system compared to Vista.
> I am using 98 Second Edition as I post back to you and it never seems to
> have any issues anymore as long as you don't use too much ram.

Microsoft has not sold the source code because they don't sell source code.
You can assign all the motives you want to this but the bottom line is that
not selling the source code has nothing at all to do with whether or not
Microsoft thinks it is useless or not. It is Microsoft's intellectual
property and they simply don't sell it. MS DOS 4.0 was a piece of crap and
the source code hasn't been sold. MS BOB was a piece of crap and the source
code hasn't been sold.

>
> I use 512 megabytes of ram with it and editted the system.ini to recognize
> less and have a 256 megabyte ATI video card. Nope, it is Windows XP Service
> Pack 3 that is having the issues right now with people having trouble getting
> updates for it without the proper patch to register the *.dlls again. In
> addition, Windows Vista has great external security but lacks the internal
> safety of a 9x operating system.

Again, you have no idea what you're talking about here. You really need to
expand your horizons beyond your pet MVP. His opinions are not well
regarded in the security community.

>
> I use XP Professional in a dual-boot on the same machine on a seperate hard
> drive. It is NTFS file system compared to the Fat32 file system of 98 Second
> Edition.

So?

>
> The thing is when the APS domain was hacked into last summer (2007), the
> hacker(s) got into the XP Professional side of my machine because the
> external security of the network was destroyed. However, I was also using
> VPN to link with the Intranet of the APS domain and 9x did not get hacked
> because it has internal safety of a smaller surface area, no rpc, a true
> maintenance operating system of MS-DOS, etc. So you can see how 9x machines
> were meant to be stand alone. In this ever increasing digital age, I am
> surprised that more home consumers do not rise up and demand another 9x
> operating system to be able to be more stand-a-lone and not report in to
> their boss and/or the government all of the time. Are people really that
> willing to give up their precious freedoms to others and end up having the
> equivalent of a network computer that does not have an essence of its own
> individuality.
>
> It surprises that so many people do not see this and the coming danger of
> willing to have just one easily hackable source code out there. You must
> have a comprehensive internal safety and external security solution with
> closed and open source technologies available from Microsoft and others to
> make the best operating systems out there possible and to help mitigate any
> incoming threats that may want to harm the Matrix FrameWork and Subsystems of
> the Network.

Wow, you've really drunk the Chris Quirke kool-aid here and you really have
no concept of what security is all about.

--
Paul Adare
MVP - Identity Lifecycle Manager
http://www.identit.ca
If a train station is where the train stops, what is a work station?

Similar ThreadsPosted
Emailing source code? July 19, 2006, 4:03 pm
Signing Code with Microsoft CA certificates December 29, 2006, 10:06 am
Microsoft IIS ASP Remote Code Execution Vulnerability July 18, 2006, 10:04 pm
Microsoft PowerPoint Code Execution Vulnerability October 2, 2006, 6:42 pm
Microsoft rejects product code as incorrect when it is CORRECT. W March 19, 2007, 7:23 pm
Microsoft Security Advisory (912840): Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution December 29, 2005, 12:16 am
Code signing a "Flash" .EXE file issue / Code sign any .EXE? March 6, 2008, 6:48 am
THE > SUPER-MONEY-SOURCE < December 22, 2005, 6:55 pm
THE > SUPER-MONEY-SOURCE < December 22, 2005, 6:55 pm
EVENT ID 23 SOURCE KDC Error April 17, 2006, 11:12 am

The site map in XML format XML site map

Contact Us | Privacy Policy