But somehow it only counts for vista eh? The hackers said it was cross platform. Adobe after hearing about the exploit updated flash for every platform.

Again, the reason why linux wa still up there is because once an exploit is used it can’t be used on another system.

LordDaMan on April 18, 2008 at 11:39 AM

And yet it was a Vista box that fell to it first. So much for DEP and UAC. /sarc

What I haven’t seen addressed regarding pwn2own is the privileges of the accounts on the Mac or Vista box. I’m going to guess it was default accounts (which would mean super-user). Bad,bad,bad. Never, ever do that. Create a regular user account.

If so, I’d like to know if these same exploits would work against users with reduced privileges. My guess is that the exploit might fire off, but fail since the exploit process would be running with the same reduced privileges as the user.

http://www.news.com/8301-10787_3-9920713-60.html?part=rss&subj=news&tag=2547-1_3-0-20

Seems like again the MSM (well MSM tech news anywayus) had littl to no clue what they where talking about, and made up stories to fit what they wanted to say

Without the exploit code/steps being published, no one has any way of verifying that this exploit is cross platform. As of right now, it is only known that it involved Flash (and some javascript) on a Vista box, to which I surmise also involved IE7.

But somehow it only counts for vista eh? The hackers said it was cross platform. Adobe after hearing about the exploit updated flash for every platform.

Again, the reason why linux wa still up there is because once an exploit is used it can’t be used on another system.

Integrating drivers into a Vista DVD is not hard.

Chakra Hammer on April 17, 2008 at 11:02 PM

I never said it was. I said he’d have to do that in order to install the driver during the install. Something I can do now with my distro of choice, which happens to be OpenSuse.

And yes DaveS, most of us know Windows 7 is not coming out next year. And most likely not in 2010 either. To quote Dick Cheney. “So what?”

BTW, how many security flaws are in Quicktime? LMAO.

Chakra Hammer on April 17, 2008 at 4:07 PM

I hate I missed that question until just now, because that question has been answered. For the last six months of 2007, Quicktime flaws accounted for 8% of all browser plugin flaws. That is a very bad number.

But ActiveX accounted for 79% of all flaws. Basically, 8 out of 10 flaws. If you want to be safe on the internet, avoid Internet Explorer. It won’t guarantee your safety — nothing will — but it’s the single biggest step you can take to avoid spyware and viruses.

Granted, ActiveX is a framework for browser plugins, so you could make the case that it’s not fair to compare it to an ordinary plugin like Quicktime. But that makes no difference: it’s a bad plugin framework, and that much was clear from Day One, yet it kept being used.

So why did Microsoft use it and push it if it didn’t benefit the customer? Because it benefited them. ActiveX was a club to beat Netscape with. The more sites that required ActiveX, the less people used Netscape, because Netscape didn’t support it.

Billy Boy Gates announce a couple of weeks ago that next year Windows 7 is coming out. Not a service pack to VISTA; a whole brand spanking new Windows. Businesses spending beaucoup bucks to convert to VISTA have just been hosed. Vista is a woofer. It is the version of the NT/XP tree, like Windows ME was the version of the 95/98 tree, designed to hold the peones in place.

Duncan Khuver on April 17, 2008 at 9:46 PM

DONT SWITCH FROM Windows 95/Windows 98 to Windows2000 or Windows XP

WAHHHH!!!!!!!!

I clearly said bare metal, which means, oh smart one, that you have no OS installed. In which case, that means no matter what, you lose.

You’ll have to install Vista before you can even get to installing a driver. I can install the nVidia driver as part of the install on all the major distros OpenSuse, Ubuntu, Fedora). No way you can do that without creating a custom install DVD or image.

And while ATI is more difficult than nVidia, it isn’t that much harder. Oh, and I haven’t had to compile a driver in years. When’s the last time you installed a distro?

And just for disclosure, I’ve been in the biz for a very, very long time. I do networking and security, not appdev. I go back to NT 3.51 which truly sucked rocks. Used a lot of OS platforms. DOS, OS/2, Win 9x, NT4, W2k, XP, W2k3, Vista, Netware, Solaris, Linux, System 7, OS 8,9,X. Even hold a MCSE for 2k3 and a degree in comp eng. So save the smarter than thou alpha male speech for the g33k grrrls at the cons.

raz0r on April 17, 2008 at 7:27 PM

Integrating drivers into a Vista DVD is not hard.

I’ve been in the IT Business since 1970, didn’t call it IT way back then. I thought I’d throw in my two cents before it devalues too much.

Billy Boy Gates announce a couple of weeks ago that next year Windows 7 is coming out. Not a service pack to VISTA; a whole brand spanking new Windows. Businesses spending beaucoup bucks to convert to VISTA have just been hosed. Vista is a woofer. It is the version of the NT/XP tree, like Windows ME was the version of the 95/98 tree, designed to hold the peones in place.

IIRC Microsoft has a class action lawsuit against it for putting out improper specifications about what “Vista Capable” really meant.

Yes I have used Video Studio, pretty darn slick. I also happen to like the Eclipse Open Source development platform. Depends what I am working on. Here’s a question for ya. How many non Microsoft platforms does Visual Studio run on? How many non Microsoft platforms does the stuff developed in Visual Studio run on? I can work on Eclipse on more than one platform and develop its apps for more than one platform. In short, I can develop what the end customer wants for the platform the end customer wants. Aren’t we supposed to be more interested in pleasing the customer rather than putting out stuff few except those with the deepest pockets will want or can afford? Eclipse may not be as slick, (and believe me, in some place … yuch) but using it gives the end user not just the developer options. (There is mono on Linux for .Net, but so far it doesn’t impress me)

Personally, I’d like to see the folks at MS concentrate their occasional flashes of brilliance into dazzling multi-platform products so I can pick where I want to run them. I’d like to see them adhere more to standards (Their OOXML may be a step in the right direction. Too early to tell yet) and instead of making good idea enhancements to standards copyrighted, proprietary code give back to the standards organizations.

Regarding what should Microsoft cut out, it should cut out enough to be able to like OpenSuse 10.2 can, run its Windows GUI (KDE in the Linux case), OpenOffice, Java apps, web browsing and a host of other applications on a 500 Mhz 480 MB of RAM 8 year old PC with an NVIDIA video card of only 64 MB of RAM. When Vista can do that talk to me. Granted, it ain’t a screamer, but then neither are some of the “Vista capable” machines that were sold.

If you are willing to settle for software that is “okay” at best, then open source is great. But it absolutely, inarguably, does NOT compete with commercial software. This goes beyond Linux v. Windows.

DaveS on April 17, 2008 at 3:07 PM

Good enough? That is exactly how Microsoft got to where it is now. By being good enough when compared to the competition of the day. Feature bloat is ruining Windows and now Office. About 90% of the users use less than 10% of the features. To Microsoft’s credit, it is a wonder they don’t suffer from more exploits given the size and complexity of their code.

yea to an Adobe flaw that effects all platforms.

Chakra Hammer on April 17, 2008 at 4:04 PM

Did you not read the follow up? I said until we get to see the details, all we know is it involvves Flash, javascript and Vista (which most likely means IE7).

I also wrote this:

The thing to note from pwn2own was that both exploits were web based against what most folks would consider safe applications. No firewall to help you now. Not even application firewalls as the browser and Flash would most likely be green lighted.

Welcome to Web 2.0 people.

These exploits were made possible by sloppy appdev guys, not end users.

And to add to the list of sloppy software: Real Player 10.5.

It will require a huge change in the coding practices and designs to combat and protect against the new breed of web based attack vectors. Attack vectors that will show no bias regardles of the underlying OS.

DaveS,

I clearly said bare metal, which means, oh smart one, that you have no OS installed. In which case, that means no matter what, you lose.

You’ll have to install Vista before you can even get to installing a driver. I can install the nVidia driver as part of the install on all the major distros OpenSuse, Ubuntu, Fedora). No way you can do that without creating a custom install DVD or image.

And while ATI is more difficult than nVidia, it isn’t that much harder. Oh, and I haven’t had to compile a driver in years. When’s the last time you installed a distro?

And just for disclosure, I’ve been in the biz for a very, very long time. I do networking and security, not appdev. I go back to NT 3.51 which truly sucked rocks. Used a lot of OS platforms. DOS, OS/2, Win 9x, NT4, W2k, XP, W2k3, Vista, Netware, Solaris, Linux, System 7, OS 8,9,X. Even hold a MCSE for 2k3 and a degree in comp eng. So save the smarter than thou alpha male speech for the g33k grrrls at the cons.

I am forever scarred none the less.

The Vista box fell a couple days later. So no preening around like a peacock.

raz0r on April 17, 2008 at 8:02 AM

yea to an Adobe flaw that effects all platforms.

Which makes just as much sense as taking your word for how much better Windows is because you work at Microsoft.

That’s kinda like saying I should “take your word for how much better Montana is because you like in the US.” Again, I have nothing to do with Windows. Jesus Christ, at least read the comments before responding to me.

Worse, you’re not just comparing apples to oranges, but without talking about individual applications on Linux, or individual server applications, you really don’t even have an orange to compare your apple to.

That’s sort of my point. There is no comparable solution on Linux for the desktop.

Again, Linux is a great server platform. It is a crappy desktop platform. The community is too fragmented, there are too many distros, etc., for a suitable replacement to emerge, beyond some simple taks like checking email and writing a letter to grandma. Aside from Firefox (which is not a “Linux” app), I can’t think of a single *nux desktop app that approaches the quality of the commercial alternative.

If you are willing to settle for software that is “okay” at best, then open source is great. But it absolutely, inarguably, does NOT compete with commercial software. This goes beyond Linux v. Windows.

(I’m talking end-user, desktop apps, here… dev tools are a different story. PHP, ruby, python, vim, emacs, apache, perl, mysql, etc., are phenominal OSS products.)

What you’re failing to account for, however, is the absolutely phenomenal integration of all of of the Microsoft apps… they form a cohesive platform. VOiP phone systems based on Office Communicator, Exchange server, Outlook, Word, Excel, etc, are integrated in ways that are almost mind-bogglingly thorough. Throw in Sharepoint, and then tools like Visual Studio and Team Foundation Server, the development process easily integrates into the platform.

There is, quite simply, NOTHING in Linux that provides such a robust computing platform. It’s hard to convey how incredibly powerful it is if you have never worked in a fully integrated Microsoft environment–which most people haven’t, because it is quite expensive to have the whole package.

Is it worth it? Given that most businesses don’t buy it, the evidence is that most businesses don’t think it’s worth it, or that it doesn’t perform as promised.

The Linux environment isn’t even in the same league.

DaveS on April 17, 2008 at 3:42 AM

You’re basically comparing a basic Linux environment without Sharepoint and VOIP and Visual Studio versus the MS platform with all of it? Cherry picking your examples a little bit?

Worse, you’re not just comparing apples to oranges, but without talking about individual applications on Linux, or individual server applications, you really don’t even have an orange to compare your apple to.

So, if you buy MS VOIP and MS Sharepoint and MS Visual Studio and MS SQL Server and MS Office for the entire corporation and throw enough hardware at it, you get nice integration.

I would certainly hope so, for the kind of money required.

Unfortunately, many people are finding they can get everything they need without going to Microsoft at all.

If you want VOIP, Microsoft is far from the most cost-effective. Virtually all VOIP platforms offer the potential for greater integration with email and instant messaging. That’s the advantage of the IP part of VOIP.

SQL Server is a decent database, but DB2 and Oracle are better. I know this, because IBM and Oracle have told me so. Which makes just as much sense as taking your word for how much better Windows is because you work at Microsoft.

Personally, I find Postgresql to be the best deal around when you need a powerful database.

The biggest thing Microsoft has had going for it is ignorance of the alternatives, and the monopoly deals with every PC manufacturer that pay MS for every PC sold, whether it has Windows or not.

The problem Microsoft has is that their dominance of the PC market has been based on being able to control that market, and that can’t last forever.

Our company reformatted the drive and installed Red Hat Linux on our new dual-processor 64 bit 3 GHZ system after the “preinstalled” VISTA took a full 22 minutes to boot after consuming the entire previous day finishing installing itself. It was even slower than the original XT!!!