Dan
Tue Jul 29 04:07:01 CDT 2008
"S. Pidgorny <MVP>" wrote: <response bottom posted>
> G'day:
>
> "Dan" <Dan@discussions.microsoft.com> wrote in message
the base for Windows
> Mobile next version.
>
> > For example, an OS should be able to wipe its own butt without
> > RPC, and/or not expose RPC to network surfaces (especially
> > the Internet). It shouldn't rely on RPC to do internal things, weld
> > this into Internet exposure, and then rely on a firewall as a band
> > aid over this clickless, remotable risk surface.
>
> RPC is as good (or bad, depending on your by-default attitude) as any other
> IPC. I can disable RPC in Windows and still run software, but I see no
> reason to.
>
> --
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-
>
> *
http://sl.mvps.org *
http://msmvps.com/blogs/sp *
>
>
----------------------------------------------------------------------------
Here is Chris Quirke's reply:
At 09:36 26/7/2008, Dan wrote:
>Wow, you and I have really created in uproar in the security community and
>many people are not pleased at all about our opinions. Who would have
>thought that 2 people could upset the security community so much? <grin>
Especially when one of them isn't there ;-)
> From Microsoft.Public.Security Newsgroup
>
>Dan 7/24/2008 6:08 PM PST
>I will now post Chris Quirke, MVPs reply to me
>S. Pidgorny <MVP> 7/25/2008 7:26 AM PST
>
>Windows 3.1/9x code base is now dead. Everything is NT. Not
>sure about mobile devices but will not be surprised with XP as
>the base for Windows Mobile next version.
That's my take, too. I briefly thought of 9x (not 3.x, and yes, they are
different enough to be considered as different OS families) as a small
GUI OS for small devices (e.g. a diskless PDA with 4G flash memory
and 32M working RAM) but while it would fit the "size" and host plenty
of legacy apps, those apps won't match what a PDA is to do, and the
PDA's hardware is likely to be outside 9x's capabilities.
In any case, a core design requirement of 9x - the ability to run apps
written for DOS and Win3.yuk - is no longer relevant, so much of what
constrains how good 9x could be, is redundant and should be discarded.
> > For example, an OS should be able to wipe its own butt without
> > RPC, and/or not expose RPC to network surfaces ... It shouldn't
> > rely on RPC to do internal things, weld this into Internet exposure,
> > and then rely on a firewall as a band aid over this risk surface.
>
>I can disable RPC in Windows and still run software, but I see no
>reason to.
By design, it may be OK, but that design has failed due to code exploits
a couple of times. Not just the Lovesan-era thing (with the "take two"
re-patching of what was considered to have been "fixed" already) but the
Server 2003 era bug that allowed DNS servers to be exploited via RPC.
If I have NO contexts whatsoever, where I need remote systems to call
procedures on my PC, then why should I be forced to provide that "service"?
If the answer is because the internal OS can't do without it, and it can't be
ripped out of the obligatory "network" surface, then that is IMO a sucky
design for a stand-alone OS. I know you can run some things without RPC,
but few articles written at the time of the Lovesan onslaught recommend
disabling the RPC service... it's usually considered "essential".
>Dan 7/25/2008 10:39 AM PST
>
> Windows 9x may be dead somewhat to Microsoft but it is alive and kicking
>everywhere else with Mozilla still supporting it with their web browser as
>well as AVG 7.5 supporting it as well.
Er... AVG 7.5 is replaced with 8.0, and that no longer supports 9x.
There's still Avast as a free av for 9x, as at July 2008.
>Heck, 98 Second Edition for me is more stable than XP Professional. Vista
>while it is stable enough for me still suffers somewhat with compatibility
I haven't had stability issues with XP; as you say, much of the time, all
three are pretty stable. Are these three different systems, or groups of
systems? If groups, are there any commonalities (aside from OS) over
the comparatively-blighted XP group? Right now, I'd consider XP SP3 as
the top of the mature-and-stable pile.
>You talk about a great opportunity for all those used computers that
>cannot run XP and why not have them run 98SE
Old used PCs are a difficult resource to deploy (i.e. set up for others to
own and use) - they are usually heterogeneous in hardware, prone to
hardware failure, and difficult to source reliable and matching parts. If
the target users are, say, a PC maintenance school, it makes sense, so
a winning strategy may be to partner your intended users with such a
mainetance resource, so the community can support itself (and harness
problems as skill-building opportunities).
>Microsoft has not sold the source code because they don't sell source code.
>You can assign all the motives you want to this
One way to sanity-check such things (i.e. whether something is an inescapable
reality or a industry-motivated contrivance) is to watch what happens
in the open
source world. You do get small Linuxen that run on minimal hardware, but
while
the current versions of the main productivity distros may not need
Vista's hardware
specs, they won't be comfy on sub-XP hardware specs.
The cores of these OSs (Linux, BSD, the "new" MacOS) are a very long
evolution,
confirming the value of honing rather than re-inventing code. But
the original design
brief of those code bases was different to 9x; if anything, more like
that of NT, though
from an earlier age (and thus "smaller" hardware).
> > I use 512 megabytes of ram with it and editted the system.ini to recognize
> > less and have a 256 megabyte ATI video card. Nope, it is Windows
> XP Service
> > Pack 3 that is having the issues right now with people having
> trouble getting
> > updates for it without the proper patch to register the *.dlls again. In
> > addition, Windows Vista has great external security but lacks the internal
> > safety of a 9x operating system.
>
>Again, you have no idea what you're talking about here. You really need to
>expand your horizons beyond your pet MVP.
Dan, your terminology differs from mine, and I can't really "get" what you're
referring to, either - e.g. when you refer to "internal security".
I'm also something of an outside to pro-IT group-think, and I'll take this
oppo
to clarify my own (unfamiliar?) terminology.
I refer to safety as underlying security, and sanity as underlying safety.
For example, the purpose of securing a PC so that only Fred can use it,
can be undermined if safety failures mean that what Fred does, is not what
Fred wanted to do (but rather fulfilled the intentions of an attacker).
For example, a safe design that ensures code can't run from a context that
is presented as "viewing a .JPG image", is undermined if defects within the
.JPG-handling code allow insane behavior (i.e. behavior that bears no relation
to what the .JPG-handling code was expected to do).
I'm also entirely unapologetic about my focus on stand-alone and consumer
users, and what I have to say about PC safety is from that perspective. Such
things will probably NOT be applicable to server infrastructure, so if my
ideas
are quoted in inappropriate contexts, I'd expect them to be bounced away.
One such concept is the need for an effective off-HD maintenance OS. In
the pro_IT world, the usefulness of this may be undermined by dangers
from managed users using this to escape central management, so there
may be a risk/benefit decision to avoid such things.
That is exactly the kind of decision I'm talking about, for us who own our
own PCs and have no wish to extend any sort of "remotability" to anything
beyond those PCs. Just as a sysadmin may be happier if his users did
not have the ability to undermine his control, so we would be happy to
have no complex "remote admin" surfaces waved at the 'net.
>Wow, you've really drunk the Chris Quirke kool-aid here
Hmm... that snippage didn't smell like anything from *this* kool-aid
factory ;-)
>and you really have no concept of what security is all about.
Much of what is spoken of as "security" (even in these security circles)
isn't so much about securing X for Y but against Z, but is about safety,
i.e. making sure that unwanted situation S should never arise.
When I first dropped into security newsgroups and elists, I expected to
see 95% networking and domain-centric user admin, and little that was
relevant to my interests. Instead, I found much discussion of the same
malware attacks and safety failures - the problems I see in my terrain.
To me, that means "malware" is far from being a "solved problem",
despite the resources that professionally-managed IT can throw at it.