// COMPLETE THREAD

Microsoft ammunition

3 expanded posts ยท every known parent and child

NODE 5d0a6efeMicrosoft ammunition
>From Infoworld:

March 24, 1997

            Coda dependency may contribute to the fall of the
            great Gates empire

            Last week's column demonstrated that Microsoft is
            unable to respond to the network computer in its
            usual "co-opt the technology" manner -- a fact
            that may signal the turning point in the company's
            history. (Why am I leaving Intel out of this
            prediction, you ask? Because it is in a far more
            flexible position than Microsoft. Its chips can
            run anything. Microsoft needs them to run
            Windows.)

            Add to this NC threat the mounting troubles for
            Microsoft, and it's no wonder there's no joy in
            Redmond tonight.

            Look at the trends. According to International
            Data Corp., Microsoft SQL Server for Windows NT
            has been losing significant market share for two
            years to competing products that run on multiple
            platforms. Microsoft's Wolfpack clustering
            technology is turning out to be a Chihuahuapack.
            (See "Toothless Wolfpack," March 17.) Seemingly
            endless rapid-fire announcements by ISVs to
            support standards such as Java, JDBC, LDAP, IMAP4,
            and CORBA are shoving Microsoft's TAPI, MAPI,
            ISAPI, "SLAP-HAPI," and a host of other
            Microsoft-centric specifications right out of the
            limelight.

            By now you have undoubtedly heard more than you
            want to hear about the fellow in Germany who
            demonstrated that a malicious ActiveX control can
            secretly empty your bank account. Leaks, bugs, and
            hastily cobbled service packs have been drawing
            attention to the immaturity of Windows NT. And,
            most recently, college kids have found more holes
            in Internet Explorer than it takes to fill the
            Albert Hall. (My apologies to those outside the
            Beatles generation who don't get the reference.)

            Meanwhile, Microsoft has crushed or alienated
            practically every potential partner that might
            otherwise have helped it out of its current fix.

            Network hanky panky

            This latest Microsoft Internet Explorer security
            dustup really isn't a bug, it's a feature.
            Internet Explorer was built to make it easy to
            launch a file, whether that file is on your hard
            drive or sitting on a server somewhere in
            Freedonia. Unfortunately, it took someone outside
            Microsoft to realize last August that the file one
            launches from Explorer could be a Word for Windows
            document packing a malevolent macro.

            Then, in the past few weeks, .URL, .LNK, and .ISP
            files were added to the danger list. Then it
            surfaced that Microsoft's Common Internet File
            System opens the door to network hanky panky. This
            is clearly a company that isn't used to thinking
            outside of the universe of the local LAN. The
            Microsoft patches configure Explorer to ask your
            permission before launching a potentially
            dangerous file type (similar to Netscape
            Navigator). OK, but this solution makes it
            virtually impossible for Microsoft or anyone else
            to integrate a browser seamlessly into the Windows
            desktop.

            If seamless, safe desktop access to remote files
            on the Internet is the goal, Microsoft is spinning
            its wheels. There is really only one way to
            provide these features without introducing a local
            security risk. You have to eliminate the
            possibility that anything you run can affect your
            local drives. Better still, get rid of your local
            drives.

            In short, a Java-based browser is a good way to do
            it, but a Java-based network computer is best.
            Which brings us back to the conclusion of last
            week's column.

            But, if you're tired of the repetition, here's a
            reason you should sit through another sermon:
            RandomNoise's Coda. Coda lets you design entire
            Web pages in Java rather than use a mixture of
            HTML content, tags, and Java applets.

            Most pundits seem to be fixated on the fact that
            Coda gives you a way to display fancy fonts that
            HTML can't handle. Our own Bob Metcalfe is the
            only one I know of who addressed the bigger
            picture. (See From the Ether, March 10). He
            pointed out that Coda may lead the way toward
            replacing HTML with Java.

            A Java-based Web page removes the distinction
            between application and data. It presents data
            just as an HTML page would, but every element on
            the screen has the potential to be an interactive
            part of a sophisticated application.

            In other words, the Web page becomes both powerful
            and safe enough to earn the right to be the new
            desktop user interface to the world. But Internet
            Explorer and Windows are nowhere in that equation.

            So is Microsoft in a batting slump, or is this the
            beginning of the end? Personally, I think
            Microsoft can pull out of this one. All it would
            have to do to fully recover is turn Windows NT
            into Unix, drop Distributed Component Object Model
            for CORBA, phase out its Windows-centric protocols
            for platform-independent standards, adopt
            NetWare's Novell Directory Services, kill ActiveX,
            port SQL Server to several different platforms,
            and abandon the idea of integrating Internet
            Explorer into the desktop.

            Well, I'm going to take a nap. Wake me when all
            that happens.
NODE 0ca8b34dRe: Microsoft ammunition
>From Infoworld:
>
> March 24, 1997
>...
>             If seamless, safe desktop access to remote files
>             on the Internet is the goal, Microsoft is spinning
>             its wheels. There is really only one way to
>             provide these features without introducing a local
>             security risk. You have to eliminate the
>             possibility that anything you run can affect your
>             local drives. Better still, get rid of your local
>             drives.

The author misses the point.  Whether your personal files are stored on a
local disk or on a server doesn't matter.  What matters is whether random
downloaded code (again, Java or ActiveX doesn't matter) can use your
authority to read/modify those files.  The ActiveX model of, "It's signed
by XYZ Corp.  Of course it's safe." is so much bullshit.*  The Java
approach of running untrusted code in a safe box is better, but doing it by
validating the safety of object code requires trusting a large complex
verifier.

* See Norm Hardy's paper, "The Confused Deputy", which I believe is still
available through the EROS page at the University of Pennsylvania.


-------------------------------------------------------------------------
Bill Frantz       | Back from caving in Borneo.| Periwinkle -- Consulting
(408)356-8506     | Great caves.  We mapped    | 16345 Englewood Ave.
frantz@netcom.com | 25KM on the expedition.    | Los Gatos, CA 95032, USA
NODE fbb80440Re: Microsoft ammunition
Great news, Toto. 

The wisest people are already avoiding MS products and are using free
software like Linux to its fullest capacity.

Cc-ed to Bill Gates.

igor

Toto wrote:
> 
> >From Infoworld:
> 
> March 24, 1997
> 
>             Coda dependency may contribute to the fall of the
>             great Gates empire
> 
>             Last week's column demonstrated that Microsoft is
>             unable to respond to the network computer in its
>             usual "co-opt the technology" manner -- a fact
>             that may signal the turning point in the company's
>             history. (Why am I leaving Intel out of this
>             prediction, you ask? Because it is in a far more
>             flexible position than Microsoft. Its chips can
>             run anything. Microsoft needs them to run
>             Windows.)
> 
>             Add to this NC threat the mounting troubles for
>             Microsoft, and it's no wonder there's no joy in
>             Redmond tonight.
> 
>             Look at the trends. According to International
>             Data Corp., Microsoft SQL Server for Windows NT
>             has been losing significant market share for two
>             years to competing products that run on multiple
>             platforms. Microsoft's Wolfpack clustering
>             technology is turning out to be a Chihuahuapack.
>             (See "Toothless Wolfpack," March 17.) Seemingly
>             endless rapid-fire announcements by ISVs to
>             support standards such as Java, JDBC, LDAP, IMAP4,
>             and CORBA are shoving Microsoft's TAPI, MAPI,
>             ISAPI, "SLAP-HAPI," and a host of other
>             Microsoft-centric specifications right out of the
>             limelight.
> 
>             By now you have undoubtedly heard more than you
>             want to hear about the fellow in Germany who
>             demonstrated that a malicious ActiveX control can
>             secretly empty your bank account. Leaks, bugs, and
>             hastily cobbled service packs have been drawing
>             attention to the immaturity of Windows NT. And,
>             most recently, college kids have found more holes
>             in Internet Explorer than it takes to fill the
>             Albert Hall. (My apologies to those outside the
>             Beatles generation who don't get the reference.)
> 
>             Meanwhile, Microsoft has crushed or alienated
>             practically every potential partner that might
>             otherwise have helped it out of its current fix.
> 
>             Network hanky panky
> 
>             This latest Microsoft Internet Explorer security
>             dustup really isn't a bug, it's a feature.
>             Internet Explorer was built to make it easy to
>             launch a file, whether that file is on your hard
>             drive or sitting on a server somewhere in
>             Freedonia. Unfortunately, it took someone outside
>             Microsoft to realize last August that the file one
>             launches from Explorer could be a Word for Windows
>             document packing a malevolent macro.
> 
>             Then, in the past few weeks, .URL, .LNK, and .ISP
>             files were added to the danger list. Then it
>             surfaced that Microsoft's Common Internet File
>             System opens the door to network hanky panky. This
>             is clearly a company that isn't used to thinking
>             outside of the universe of the local LAN. The
>             Microsoft patches configure Explorer to ask your
>             permission before launching a potentially
>             dangerous file type (similar to Netscape
>             Navigator). OK, but this solution makes it
>             virtually impossible for Microsoft or anyone else
>             to integrate a browser seamlessly into the Windows
>             desktop.
> 
>             If seamless, safe desktop access to remote files
>             on the Internet is the goal, Microsoft is spinning
>             its wheels. There is really only one way to
>             provide these features without introducing a local
>             security risk. You have to eliminate the
>             possibility that anything you run can affect your
>             local drives. Better still, get rid of your local
>             drives.
> 
>             In short, a Java-based browser is a good way to do
>             it, but a Java-based network computer is best.
>             Which brings us back to the conclusion of last
>             week's column.
> 
>             But, if you're tired of the repetition, here's a
>             reason you should sit through another sermon:
>             RandomNoise's Coda. Coda lets you design entire
>             Web pages in Java rather than use a mixture of
>             HTML content, tags, and Java applets.
> 
>             Most pundits seem to be fixated on the fact that
>             Coda gives you a way to display fancy fonts that
>             HTML can't handle. Our own Bob Metcalfe is the
>             only one I know of who addressed the bigger
>             picture. (See From the Ether, March 10). He
>             pointed out that Coda may lead the way toward
>             replacing HTML with Java.
> 
>             A Java-based Web page removes the distinction
>             between application and data. It presents data
>             just as an HTML page would, but every element on
>             the screen has the potential to be an interactive
>             part of a sophisticated application.
> 
>             In other words, the Web page becomes both powerful
>             and safe enough to earn the right to be the new
>             desktop user interface to the world. But Internet
>             Explorer and Windows are nowhere in that equation.
> 
>             So is Microsoft in a batting slump, or is this the
>             beginning of the end? Personally, I think
>             Microsoft can pull out of this one. All it would
>             have to do to fully recover is turn Windows NT
>             into Unix, drop Distributed Component Object Model
>             for CORBA, phase out its Windows-centric protocols
>             for platform-independent standards, adopt
>             NetWare's Novell Directory Services, kill ActiveX,
>             port SQL Server to several different platforms,
>             and abandon the idea of integrating Internet
>             Explorer into the desktop.
> 
>             Well, I'm going to take a nap. Wake me when all
>             that happens.
> 



	- Igor.