IT Employment

Ask something
Discussion Locked

The Microsoft Juggernaut Part 1

0 helpful
8 replies

by shepster 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

OK, I fear that this discussion is quickly going to digress into a Ford?s and Chevy?s bickering match between proponents of Microsoft and everyone else. I am hoping to avoid that however. I am angry about something Microsoft has done and would like to debate the ethics and thought behind it rather than whether or not Microsoft is a corporeal manifestation of a subdivision of Hades. Here is what I would like to discuss:

I am a network administrator for a small company. We primarily use Microsoft products throughout. Having had many years of experience with Microsoft, I have learned the hard way to test all patches, updates, service packs, etc. that ol? Bill sends out before applying them across my network. Semi-recently, the Melissa virus struck and was followed by a rash of copy cats (to digress briefly, isn?t it amazing how the pathetic refuse that distribute viruses are similar to ants? Meaning that one adventurous, imaginative or unlucky one will diverge from the beaten path and venture into the unknown and will quickly attain a following of mindless drones who head down the same path.) So, back on topic, Melissa and all her progeny struck and with it?s usual sluggishness, the Microsoft juggernaut slowly stirred into action. They released a security patch for Outlook to prevent this type of attack and placed it on the Microsoft Update site so everyone could apply it and the world would once again be safe (insert Superman trumpet fanfare here)! In fact, they were so pleased with themselves that they incorporated this patch in their second service pack for Office 2000.

8 replies

by shepster

Now, for those of you who don?t know, this security patch blocks recipients access to all attachments with, at last count, thirty-seven different extensions. These include BAT, COM, EXE, REG, SCR and a host of others. Now I ask you, isn?t it kind and benevolent of Microsoft to protect us from ourselves? They have neatly proscribed a method of file transfers that has been in use almost from the inception of the Internet. Now, admittedly, it is easy to circumvent this by simply zipping the file up or, even more simply, renaming the file with a harmless extension (e.g. file.abc or file.com.abc). The problem is, this requires explaining to the non-technically minded individuals how to do this, how to change it back and the purpose behind extensions in the first place. In addition, Microsoft has been kind enough to set machines by default to hide file extensions of known file types, which doesn?t allow the unknowledgeable end-user to see what it is to begin with. This action is, in a large part, responsible for the virus risk of file attachments at the outset! Now, you are probably saying, at this point, ?I thought you didn?t want to digress to Microsoft bashing?? and you are right. I am not, however, directing this solely atMicrosoft. I feel that a lot (don?t you hate the way Word won?t allow you to make ?alot? a single word without alot of effort?) of people have some ?splaining to do! I feel that it was arrogant in the extreme of somebody to take it upon themselvesto alter by force a methodology that has been followed for years.

by shepster

Now, you say, ?Nobody is forcing you to apply the updates!? That is correct, but there are other patches and updates that are contained in SP2 that you can?t get without applying the ?evil patch? also. Regardless, I contend that it is the responsibility of the individual or organization to purchase and maintain anti-virus software. I protest that if a security policy such as this is implemented, there should be a method to deactivate it also implemented (There is not, by the way. The only way to get rid of it is to completely uninstall and reinstall Office). My opinion is that the only reason this atrocity was ever committed was due to laziness, ineptitude and the demand of the market that Microsoft ?do something? whether it was rightor wrong! Opinions?

by shepster

Well, now that I have gotten the tirade out of my system, here is one solution I will propose for what should have been done. They should have incorporated some security into Microsoft Exchange which would allow the appropriate authority permissionto grant or deny the ability to pass potentially hazardous attachments to users or groups. Furthermore, they could quarantine denied attachments in a secure area and allow administrative access to test, scan and delete or pass them on. As for individuals who use Outlook to retrieve POP or IMAP email, I honestly feel that it is primarily the responsibility of the email provider to ensure the security and virus free condition of email. Furthermore, I feel that any end user who doesn't have adequate, up-to-date antivirus software and still opens email attachments, especially from unknown senders, will get what they deserve. Any other notions of what the proper method could have been?

by epepke

Or at least this sentence is right: 'My opinion is that the only reason this atrocity was ever committed was due to laziness, ineptitude and the demand of the market that Microsoft "do something" whether it was right or wrong!'

Microsoft does everything it does because you, or somebody like you, made the decision to give them money so exclusively that most competitors have dropped out of existence.

by pxttocyob

You don't even have to open an attachment for it to have an effect. If you right click on it to delete it, windows reads the file and makes an unneeded, unwanted temp copy of it and bang, it's on your system. It's ridiculous for any program to have that many holes in it.

by jklein

This has pissed me off to no end. I am the IT dept. for a small company. I need to send *.EXE files to users from time to time. Vendors need to send me patches or other *.EXE files to fix apps or launch upgrades. So I'm screwed if I want to continueto use Outlook in the office.

The users dont have the time or in may cases the know how to change file names or zip/unzip files. I will have to manually upgrade PCs instead of sending the attached upgrades to the user.

Notice Microsoft has not "fixed" Outlook Express. Guess the barn door is still open.

I am raving, sorry. I bought my first license of Sun StarOffice last week, interesting.

by raul_pty

At first, when the patch came out the first thing we did, was review these settings. We did not deploy this update because of the limitation with the extensions. Today, we are still running Office 2000 SR-1 without SP2, and we have had no problems with office neither with viruses. Security has improved throughout the enterprise with a better strategy....
Putting the patch was the easiest solution, which almost never is the best.

BTW, Office XP incorporates this level of security automatically and you cannot remove it... However (Star Wars Music here) you can customize it with the Administration Pack provided free in the Office Web Site(Works in 97/2000/XP) and configure the security for your users as you wish through a template. ThisAdmin Pack was available before also... I suggest you use also the Custom Maintenance Wizard for these type of tasks... and consider deploying SW through administrative installations. You'll make your work easier...

I did not agree with the released patch either, but in honor to truth... Microsoft stated clearly that this security patch degraded functionality on the product.

Go check it, try it and let's see how it works for you. http://www.microsoft.com/office/ork/xp/appndx/appa11.htm
About StarOffice... it's a well done copy, but it's too heavy to run on desktops, try running several docs with pics and formatting, worksheets with graphs and operations... you'll see what I mean...

Have a nice day you all.

This discussion is closed to new replies.