Dealing with continuing worm attacks

I think Jonathan Yarden's proproposal that Microsoft should distribute Windows service packs on free CD-ROMs is a good idea as Mr.Gates' platform is full of holes. As for automatic software updates, well, I personaly get annoyed when my PC tries to connect to the web without my say so and my personal PC isn't worth much when it comes to surfing quickly so the extra unexpected bandwith would slow things down considerably.

Microtrash isn't the answer - what makes you think they will patch all the holes - even with automatic updates. Those updates have caused major problems with applications..

The solution to worms - is an educated end user - and other software ...

Educated users and firewalls, closing ports, antivirus and not using MS Address books is the answer... Educate the home user on what ports are, why do you need them, how to turn them off, security, viruses - then add software on top of the education - zing its all good..

I hate this analogy - but if your car broke down every two or 3 days or you had to restart it every two or three miles ... I wouldn't want MS software running a heart-lung bypass machine ... would you ... or other critical machine...

Would you defend GM in the same zellot flavor..

I complained about this to microsoft sometime ago, either give a download area where the download can be stored on zip or cdrom, so the customer can have it permanently. It would be a lot better for people if they have to format and reinstall, then go thru the whole routine of downloading all the patches again.

As long as you are working with Microsoft Windows 2000 SP 3 or higher software platform, Windows updates are now "automatic."
The problem? Slow connection speeds for home users who are unfamiliar with how the process works and critical patches that are newly released are not included. They require a separate download, which can only be done if you are aware you need to install the patch. Find me a basic home user, or a satellite office with no on-site support, and I'll find you a vulnerable machine.

The proposed solution is to offer free cd's readily available for installation at select stores. This too brings up a thousand and one thoughts and questions.

If the product is free, does that automatically mean "rushed?" Windows ME is a perfect example of beating a clock to production. I'd hate to think in haste to get the solution on the market, shoddy programming and unchecked bugs would wreak more havoc. And you have the added problem of patches and fixes coming out multiple times a day. How many times a day are we going to need to run to a store and pick up a cd or three to harden our pc's?

I also have free trade issues with this. Don't get me wrong, I don't exactly qualify as a poster child for a Microsoft world. Though if you buy a car, you do not expect free maintenance on your oil changes, hose replacements or other small duty work. You pay for the car, accept the warranty and the rest is up to you. Why should Microsoft not turn a profit on upgrades the same way the automotive industry turns a profit on maintenance and upkeep?

Answer: One is an industry, one is a single corporation who has a choke hold on the American consumer. I do not apologize for my bluntness. I buy my computer, I have a warranty and product guarantee. I buy hardware or peripherals, many not as expensive as the operating system, I get a warranty and a product guarantee. Yet I do not find these things with the software that turns my computer from being an over-priced paper weight to a functioning machine. Why is that? Why did it take several billion dollars in losses and downtime for accountability to just become an issue?

I see IBM taking on Linux OS as a good thing. Microsoft will now have to compete against the knowlege that another software option is readily available. Linux has been around for quite some time, it's just not been a common thought for most home users. Maybe this is the push Micrsosoft needs to put out a better, more reliable product? We'll have to wait and see.

Until that time, I don't see only one solution to the problem. I think it will take many people, many months to figure out how to reach all areas and abilities of the market.

I don't mind receiving an article such as this, but when I receive a newsletter titled "See why August was a record-setting month" only to find out it is 4 paragraphs about August's viruses/worms and the rest Yarden's opinion of Microsoft. That's a little disappointing. Had I known this was just going to be an MS bash fest, I wouldn't have even bothered reading, I can get that type of information from many other sites. This article was of little technical value at all.

I totally agree with Mr. Yarden's proposal and think automatic updates are a horrible idea. I don't trust Bill Gates enough to allow updates that I haven't investigated.

I agree whole-heartedly with Jonathan's proposal. However, I must also agree with Brian Leach. Microsoft does need to research better and stronger security measures when it comes to their software, in the meantime, why not distribute the updates on CD-ROM? Get the temporary fix out there now and be working on the more permanent fix at the same time.

I think that Microsoft making available FREE updates on CD is a good idea. But, they will never do it due to the cost of distribution each time a new update is required. How do you/they control which CD is the newest version? If that could be worked out, and the CD was not an auto-run, it's certainly a good start. It would be much easier and cheaper if MS would just make bug free software. We all know that the CD's would not be FREE, MS would just build the cost of these free updates into the cost of their other
products. Either way...we, the users, pay for it.

As for the automatic updates...NO! No one should do anything automatically and unknown to my computer. It's not that difficult to go to MS update site and pick the updates you want/need. How many times has a MS update ended up screwing something up and had to be removed. Some of them can't be removed. Give that choice to the user, not to MS.

MS isn't going to spend anything at all unless it in turn generates more revenue. If they make Windows updates a requirement, there will be a charge for subscribing to the Update Program. No way will they generate free CD's or anything else for free.

Perhaps making Windows more modular to install and maintain. We already have the ability to install/uninstall some modules why not make that more robust?

CD's are certainly a better idea than what I've put up with over the last 3 weeks-- multi-hour downloads followed by updates that end up destroying my email connectivity. And I still don't know what may have done the damage or whether I'm better off without the updates.

Service Packs and other patches on CD-ROM is a very good idea! I would even pay for a continuing service sending me CD-ROM regularly.
I have installed a brand new copy of XP and spent a day, downloading, installing and restarting the PC. I would like to buy a new XP complete with all the patches and SP's.

Given the number of CDs they send out trying to attract people to MSN, this should represent a small investment for MS. This is one of the more workable solutions I've seen yet, although it certainly won't eradicate the threats by any means. My feeling is that the fewer machines out there that are susceptable, the lesser the impact on all of us who connect.

It would also go a lot farther towards giving credence to MS's much publicized stance on security. Having a court mandated annual audit by a CISSP on a single product line simply doesn't give me a warm and fuzzy, at least if updates are free and easily available, I can still feel fuzzy or warm and for now, either one will suffice.
Paranoid.

I dont think they are free. I went to order a CD for Win 2K SP4 and it cost 9.95

automatic updates is a terrible idea. when paying long distance or hotel connection charges, I certainly do not want Microsquash adding to my bill.
I would like a plain vanilla OS that I could selectively add features to that could not interact directly with the OS kernel.

Make Service Packs available for free but by the time that you actually get them it's too late.

The time taken between MS releasing the service pack and a person actually recieving it is somewhat lengthy. Also by the time that you actually recieve them they are all well past their needed date but they do prove usefull when it comes time to reload as it saves time in downloading all those patches/hot fixes from MS at last count there where over 80 MB for XP Pro and that takes a lot of time on a 56 KBS modem.

You are however correct that it is because of just how popular MS actually is that they are subject to so much attack but by the same token at the recent Windows 2003 release MS told everyone that this was the most "Secure" OS so far and it was built on their "Trustworthy Computing" what they didn't tell anyone was that there was a problen already known about IE6 well before 2003 was released.

Then shortly after its release they came out with at least 5 fixes some of which where described by MS as "Critical." Now for a home user this may be OK but for any business user who relys soly on MS products they have a real problem just think how many MS ISA servers there are out there and all with potential problems that the new beaut ISA can't stop.

Education is the best form of defence but relying soly on MS for this education and defence is leaving yourself wide open for problems. You need to use third party software just to keep things in order from AV to Firewalls in any DMZ of any business butif you do ths you no longer reap the benifits of the MS Software policy and you end up paying more for your software as you no longer have a company wide MS only policy that only good for a 25% discount.

While I take your point about RedHat they aren't the only Linux Distro out there and places like Mandrake and SUSE offer a better service without the need for payment so only relying on US based Software Companies may be your real problem.

Now if only MS had something like the Mandrake Club where for $5.00 US per month you had access to a whole host of software that was available to download for only the cost of membership and your ISP's costs. And just how much of an OS and Software can you buy from MS for $300.00 US when you can get a complete package from Mandrake, SUSE, Lycoris or even Debian which is by far the most stable OS I have ever used now if only it was more user friendly and not at the same stage that Windows was at when they had 3.11. Given time it will get better but it won't happen overnight but here is a perfect example of a Linux Distro not russhing out with the lattest just for the sake of it and not first proving its stability.

The one real outside connection to company networks with the "One Step Connection Process" is that now I not only have to Secure my network but everyone's home computer that has access to the network as this is where the biggest security isues are going to come from latter down the track and while it's a good idea it needs a lot more thought before it is allowed to be impelmented into general pratice.

When NT was being developed, Microsoft employed a novice project manager for security. Contrary to popular belief, the experience of DEC's Cutler did NOT penetrate into MOST of the components of NT. For most of its life, Microsoft has traded function for quality (to its great advantage...witness the demise of the reliable and secure OS/2). It comes down to this, if you don't have problems to address or versions to upgrade, you don't have mind share and you can be disintermediated...or minimally lose maintenance revenue. It is human nature to IGNORE items that don't bother us....when we should be appreciating them every day of our lives.

No matter how good MS gets, there will still be errors and exploits. They need an effective reset button methodology (System Restore on steroids) to go along with improved quality. Most users are going to have to access the Internet through a personal DMZ eventually.

Isn't it ironic that the OLDER versions of Windows were held harmless in the exploits
of newer technology features.

The holy grail of virus writers (or disgruntled MS employees) will be to penetrate an automatic update facility. There is a middle ground for such a facility...a user can elect only the lag time and the implementation schedule, not the content...and warnings should become increasingly insistent...since the life you affect is not just your own.

The First is obvious and that is just the fact of life that it isn't possible to find a Worm, make a fix and then distribute it world wide in the time frame allowed/necessary.

The second is a Privicy issue as if Microsoft required everyone who activated a MS product to register their name, address ect there could be a real problem if/when the MS site getts "Hacked" and all that user information gets stolen.

Otherwise I can't see a problem but honestly I think that MS has got it about right now and while I'm not all that happy to keep downlaoding patches all the time it is at least faster than having to wait for a CD to arive in the mail that may cause more problems than it is susposed to fix.

I agree that Microsoft should make service packs available on CD. I would also like to see the updates be downloadable so they can be burned to a CD. Over the weekend I visited my sister and installed Win XP and SP1 (from CD) on her system. She is a rural user and only has a dialup connection. It took me over 12 hours to download all of the upgrades she needed. Imagine how much more convenient it would be if rural uses could request a CD or if they could download and burned to a CD. I am too far away to take the computer and return it later. There must be thousands of users with this issue.

If Microsoft every used common sense, none of us would know what to do.
This was one of the best articles I have ever read.
Thanks.

I think Mr. J. Yarden's proposal about Microsoft giving the patches free is excellant, except whoever suggests it to Mr. B. Gates had better have a resusitator on hand and paramedics standing by. Mr. B. Gates gives very little, percentagewise of his wealth, away free!

Microsoft's idea of automatic downloads is the worst idea since 1900! That would wipe out my computer's total capacity in one month, and I imagine many other peoples' personal home computer as well.

Considering the past performances since Windows 95
why bother? Using patches to cover the holes is
not unlike a surgeon using band-aids in an operating room!

Why doesn't Microsoft concentrate on a new system
completely? Redesign it from the ground up, starting with a basic design that any beginner can
learn easily and quickly. Test it thoroughly by
using ex-hackers to do their thing, run every known virus, worm, and you name it, against this system for any holes or flaws, then use top security people to check on security. When they have a much as possible flawless system, then start designing upgrades that can be applied like patches. Each upgrade goes through the same tests as the base did.
Then the new system to be exchanged for the Windows program, grade level of the new system exchanged for grade level of Windows, with a nominal fee.
After all Microsoft has a monoply on all existing
Microsoft products. So it's not likely anyone will dump all their software.
I use Microsoft as a generic term, ALL software
design companies should start thinking in this direction with security in all applications as a starting point. Thinking uppermost all the while,
How Can I Keep A Terrorist Out Of My Program, And
Everyone Elses' Program?
Because that day will come and all the worms and viruses will be like a Sunday Stroll through the park!

I agree, due to the countless security flaws exposed in Windows OS's CD-ROM's are a brillant idea, especially for those stuggling on dial-up Internet access. I also find the Microsoft update site far from successful crashing a number of older PC's I support.
In regard to automatic updates via the internet, who wants your server or PC dialling out to Microsoft without your knowledge, could this led to more flaws being exposed, such as in their IRC code. After all whos fault was the MBlaster originally. The writer of the worm or the original Microsoft programmers that missed it.

How many home users do you think use MS SQL? So why should it be open by default?

Also, when was the last time you downloaded an MS update via dialup? I have broadband at work and at home and some of the updates can take several minutes to download. This is at a download speed of 50 - 100 kbs, now try it at 2kbs.

No, MS SHOULD do a much better job at producing their software, not just bloat it as full as possible and send it out as quickly as possible.

Mac and Novell software do not have anywhere near the vulnerability that MS does, and Novell products do have a VERY large customer base.

Making CD updates as readily available as the MSN and AOL CD's is a reasonable request. Granted, they will not be as timely as being able to download them, but for those users who are still on a 56K (or less) connection, this would be a beneficial and practical solution.

As far as Automatic Updates, NO STINKING WAY do I want to be FORCED to install an update from MS. How many of their patches/SP have BROKEN more than they fixed?????

Also, for the IT professional at work with a broadband connection, it should be simplier to get the downloads to distribute within their LAN.

I realize there are several products out that will allow some form of management of patches, but with the number of them that MS has to distribute there should be something availble from MS. I have looked into the SUS, but I am not thus far impressed enough with its functionality to implement it.

Just think of the SAVINGS MS would see if a viable solution was available to the corporate (meaning any size business) environment in bandwidth and server farm costs.

I startde a Red Hat box about a year ago. It was originally quite buggy but a friend of mine wrote some nice code to give me a workable GUI and it seem to be fine. I haven't rebooted in a while and haven't needed to reinatl since the original install.
I technically run Red Hat Linux (starting base) but as I've been sent scripts and patches from developer friends, I now run a similar idea to Lindows. Looks like Windows, stability like an old Unix.

I think they are releasing a prepacked CD form to some of the schools around town for testing in a larger Network. Who knows, maybe they'll be the next people to get their code stolen by MS!

As far as I know, the service packs are free if you have a license for the product. At least I've never had to pay for my updates and service packs.

Hmm i think as long as we accept that we receives patches and service packs, Microsoft would never learn to deliver their software defect free.
I do belive a better course of action would be to press MS to be better in creating code for the software they sell.

Rgds
KLR.

I used to let M$ update my computer at home until I found a update that didnt protain to my system. They have a bad habbit of loading junk that you dont need so thats why I turned off my automatic junk loader if its not broke why fix it. Dont get me wrong I am a firm beleiver in preventive maintence.