Message-ID: <605f8e051001220142n50a28d0fkc3c13c6e5c80d750@mail.gmail.com>
Date: Fri, 22 Jan 2010 04:42:56 -0500
From: Jeffrey Walton <noloader@...il.com>
To: Rohit Patnaik <quanticle@...il.com>
Cc: Full-disclosure <full-disclosure@...ts.grok.org.uk>,
	Valdis.Kletnieks@...edu
Subject: Re: Two MSIE 6.0/7.0 NULL pointer crashes

> Given Microsoft's already poor reputation regarding security, I'm not sure
> how it'd be possible for them to degrade their reputation any more
I don't believe its as bad as you think since Microsoft adopted a SDLC
(prior to circa 2001 was a different story). I also believe a
significant portion of the perception is due to vendors running on a
Windows operating system. When is the last time you heard someone
bashing Adobe, which is currently 'King of the Vulnerability Hill.'?

"Adobe surpasses Microsoft as favorite hacker’s target" (Jul 2009)
http://lastwatchdog.com/adobe-surpasses-microsoft-favorite-hackers-target/
"Adobe predicted as top 2010 hacker target" (Dec 2009)
http://www.theregister.co.uk/2009/12/29/security_predictions_2010/.

You're probably not going to like this, but in 2003, Apache on Linux
over took IIS as most defaced (the Server market share between Windows
and *nix appears to be about equal - see below). Zone-H Statistics
Report, http://www.zone-h.org/news/id/4686

I'm not sticking up for Microsoft. I simply claim the numbers state otherwise.

> Very few people use Microsoft software because of its security reputation.
Presuming 'people' equates to Desktop installations, the numbers I
have seen indicate otherwise. When estimated through browser use,
Microsoft appears to have about 90%. Personally, I am familiar with
two US federal agencies where the desktop is exclusively Microsoft
(about 160,000 total hosts combined, unless the US government has
downsized since 2006).

If you're talking about servers, the numbers indicate that Microsoft
is on par with *nix (IDC report) or slightly above *nix (Gartner
report).

Again, I'm not sticking up for Microsoft. I simply claim the numbers
state otherwise.

> The main reasons for using Microsoft are ease of use and compatibility
> with other users.
Is *nix not trying to do the same? These are two key factors which
*must* be fulfilled before *nix can displace Microsoft on the Desktop.
IT departments like 'easy to use' - it keeps help desk calls to a
minimum. IT departments also like compatibility since they don't have
to spend time researching problems, workarounds, and solutions.

> Given that, I'm not sure that Microsoft's perception will be
> affected very much in the user community.
Agreed.

I do question Microsoft's position on *not* patching flaws when
discovered or reported in a timely manner. But that's another story,
and brings in co-conspirators, such as iDefense and TippingPoint.

For example, CVE-2009-2502 was reported to Microsoft in 2007 by a firm
which buys bugs to save everyone from 0-days. Microsoft probably knew
about the 2502 bug earlier, since the GDI+/JPEG vuln was made public
in Microsoft Security Bulletin MS04-028 (I'm making the leap that
Microsoft performed additional audits on the GDI+ module when reports
started arriving). Yet the bug was not fixed until 2009 (almost 2
years). See http://seclists.org/fulldisclosure/2009/Oct/196.

~JW

On Thu, Jan 21, 2010 at 6:34 PM, Rohit Patnaik <quanticle@...il.com> wrote:
> Given Microsoft's already poor reputation regarding security, I'm not sure
> how it'd be possible for them to degrade their reputation any more.  Very
> few people use Microsoft software because of its security reputation.  The
> main reasons for using Microsoft are ease of use and compatibility with
> other users.  Given that, I'm not sure that Microsoft's perception will be
> affected very much in the user community.
>
> -- Rohit Patnaik
>
> On Wed, Jan 20, 2010 at 6:17 PM, ☣ frank^2 <frank2@...49.org> wrote:
>>
>> On Wed, Jan 20, 2010 at 10:25 AM, Dan Kaminsky <dan@...para.com> wrote:
>> > Seriously.  I mean, just look at Linux, Firefox, and OpenOffice.
>> > Pristine code, not a single security vulnerability between them :)
>> >
>>
>> That's a red herring. His point was the public perception of the
>> software company-- true or not-- would be hindered because Microsoft
>> is all-encompassing. Compared to the world of open-source, the risk is
>> distributed by the sheer virtue of software engineering being
>> distributed amongst thousands of entities. This means that the
>> vulnerabilities are spread across different parties, rather than
>> having all vulnerabilities encompassed by a single party-- in this
>> case, Microsoft.
>>
>> His argument was irrelevant to corporations vs. open-source being more
>> vulnerable than one another-- it was simply a commentary on
>> distributed risk in software engineering.
>>
>> --
>> "Did you and them get your degree from the same university of trolls?
>> I have mistaken nothing for nothing. Fuck you."
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists