Internetworkers: http://www.ibiblio.org/internetworkers/

[Michael S Czeiszperger <czei AT webperformanceinc.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wednesday 19 September 2001 08:10 pm, you wrote:
> I have two points. First, without implying that Microsoft products are
> "better" in any sense, one has to admit that due to their prevalence, they
> are targeted with much higher frequency. As a result, you can't just assume
> that MS products are inherently less secure just because they suffer more
> attacks. I grew up with Unix and have there's no shortage of security issues
> in that world either.

You're right, there's security problems with all software. The difference is 
that most UNIX systems have traditionally been servers sold to professionals, 
where there is a reasonable assumption that they will manage security, while 
MS products such as Outlook are shipped by default on most computers sold to 
consumers, where it is reasonable to assume that the user does not have the 
ability to manage security. Because of their target audience, therefore, MS 
has an increased responsibility to ship software that is secure by default.

> Personally, I think this is like suing your home
> builder because a thief exploited the weakness of the glass in your
> windows. (Sorry about the pun). I mean, you might have a case, but you
> better be prepared to be held to the same standards. Security is a tough
> issue.

I'm not sure I understand the analogy. Who's the builder, and who made the 
glass in this case? As far as I know, people are complaining about security 
holes in Microsoft products, and are holding the same responsible. This is 
not to say that other software doesn't have security problems. Its just in 
this case MS has made a point of loudly pointing out security problems in 
competitor's products, while at the same time shipping products like Outlook 
with no security protection at all as the default, which has been the cause 
of a large number of attacks.

> OK, I have a third point. I noticed several posts about people redirecting
> dubious requests on to Microsoft. That's bad for two reasons, if it has the
> intended effect. One, it clogs the 'Net for everyone, not just Microsoft.
> Two, such activity hardly reflects positively on the moral disposition of
> people who do it. It's like complaining that you don't like being shot
> while deflecting the bullets to some other guy because you don't like him.
> How is that better?
>

I'm not sure of this analogy. In this case I think they're reflecting the 
bullets back at the perpetrator. MS wrote IE to generate extra HTTP requests 
back to IIS, not taking into account that IE users just might browse sites 
using competing web server software. The IE design both clogs up the net at 
large, and loads down non-MS servers with extra HTTP requests, and forces 
every webmaster using non-Microsoft software to either conform to their 
standard, or put up with log errors. In this situation, redirecting MS's own 
requests back to their web site, causing MS to spend some of their own 
bandwidth on the problem, seems like a fair protest.

Personally I think the problem is annoying, but small, as the errors are but 
a very small percentage of the errors in my logs.

- -- 
Michael S Czeiszperger
czei AT webperformanceinc.com

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQA/AwUBO6n9MlgOl/a4Fw2AEQLOOACgqyoTUQMX51VjNw2uufEKs/TiLUAAoKXe
s4zUu8MvzLBjCXEmygLneNuM
=mBw8
-----END PGP SIGNATURE-----