Microsoft Poses a Serious Threat to the Internet

"Arthur Tamarack" <atamarack@hotmail.com> wrote:
>
>Article by Brian Martin: Microsoft Poses a Serious Threat to the Internet
>
>
>Bottom-line, what is the point of what he writes? Does anyone walk away
>with new information or knowledge based on what he wrote?? His article
wasted
>my time. Its the same old dribble. Man, how worthless.
>
>-Art

I have spent 10 years writing software for Microsoft platforms and have been
a vocal advocate of Microsoft all that time. I read Brian's article and
felt he voiced the concerns all of us Microsoft advocates have - the system
is broke.

I think everyone acknowledges that there are possible problems with any software,
especially something as complex as operating systems. However, there is
no real mechanism for ensuring that when known vulnerabilities are identified
and consequently corrected, the patches are filtered through the user community.
This should really be an automatic mechanism, rather than a conscious daily
activity of system administrators to check for new patches.

The other complaint that applied patches often break OS functionality or
other patches is very real. I don't know how many people out there have
had to deal with the enormous number of patches and hotfixes out there, but
it is a daunting job to apply them to one machine, let alone a group of them.
It is awful.

I personally am not about to abandon Microsoft as my web server platform,
but I sure hope they HEAR the community on this. It is getting harder and
harder to convince customers that the Microsoft solution is the "right" solution.
Something needs to be done, and it needs to happen now.

BINGO - Arthur

"Arthur Tamarack" <atamarack@hotmail.com> wrote:
>
>Article by Brian Martin: Microsoft Poses a Serious Threat to the Internet
>
>
>Bottom-line, what is the point of what he writes? Does anyone walk away
>with new information or knowledge based on what he wrote?? His article
wasted
>my time. Its the same old dribble. Man, how worthless.
>
>-Art

>"same old dribble"? Well, that seems to be what we're getting from Microsoft.
>How many times do we have to point out the problems with their software
before
>people will just say "enough!" Microsoft pushed their products for functionality
>and ease of administration. Companies that brough into this didn't bother
>staffing skilled admins since you didn't need a "guru" to run a MS system.
>Yet what does Microsoft do when organizations are dealing with teh worm
of
>the month? They blame the admins for not securing their systems.
>
>-CF

Part of this is Microsoft's fault, and the other part is the fault of administrators.
Yes, admins sometimes don't load the latest patches. However, the software
should NEVER have allowed buffer overruns to be an issue in the first place.
The fact that it was an issue for so long indicates a problem.

Should this surprise anyone? Not really. Microsoft has a long history as
a client software development shop, but they have just recently gotten into
server-side development in a big way. In fact, they are just now getting
really competitive in that space. This also means that those who have been
using Microsoft tools for web development all along are just getting savvy
to the web.

Microsoft needs to learn how to manage their rollouts, but they also need
to learn how to better educate their admins. Microsoft products will continue
to be the target of hack attacks. They are the "big fish," and you get a
lot more recognition for figuring out a hack for IIS than for Apache.

Does this make other web servers more secure than IIS? Not necessarily,
and that is the problem that others may not see right now. As all the hackers
are targeting IIS, Microsoft is struggling to clean up vulnerabilities.
This will ultimately make IIS a very secure web server. Nobody is paying
much attention to hacks against Apache right now, because no one is targeting
it. This means that any exploits due to bugs in the program will be around
until someone honest discovers them (honest people don't look for ways to
exploit loopholes though), and it also means that admins for Apache systems
may not be as vigilant in stopping hack attacks.

So in the end, all this "bad news" for IIS may make it stronger than the
competition. Microsoft appears to have realized it has a problem, and it
appears to be dealing with it in a very public manner. Microsoft has the
resources to make IIS secure. Let's hope they put them to good use!