NODE 5d0a6efeMicrosoft ammunition
Toto <toto@sk.sympatico.ca>Thu, 27 Mar 1997 14:11:44 -0800 (PST)
>From Infoworld:
March 24, 1997
Coda dependency may contribute to the fall of the
great Gates empire
Last week's column demonstrated that Microsoft is
unable to respond to the network computer in its
usual "co-opt the technology" manner -- a fact
that may signal the turning point in the company's
history. (Why am I leaving Intel out of this
prediction, you ask? Because it is in a far more
flexible position than Microsoft. Its chips can
run anything. Microsoft needs them to run
Windows.)
Add to this NC threat the mounting troubles for
Microsoft, and it's no wonder there's no joy in
Redmond tonight.
Look at the trends. According to International
Data Corp., Microsoft SQL Server for Windows NT
has been losing significant market share for two
years to competing products that run on multiple
platforms. Microsoft's Wolfpack clustering
technology is turning out to be a Chihuahuapack.
(See "Toothless Wolfpack," March 17.) Seemingly
endless rapid-fire announcements by ISVs to
support standards such as Java, JDBC, LDAP, IMAP4,
and CORBA are shoving Microsoft's TAPI, MAPI,
ISAPI, "SLAP-HAPI," and a host of other
Microsoft-centric specifications right out of the
limelight.
By now you have undoubtedly heard more than you
want to hear about the fellow in Germany who
demonstrated that a malicious ActiveX control can
secretly empty your bank account. Leaks, bugs, and
hastily cobbled service packs have been drawing
attention to the immaturity of Windows NT. And,
most recently, college kids have found more holes
in Internet Explorer than it takes to fill the
Albert Hall. (My apologies to those outside the
Beatles generation who don't get the reference.)
Meanwhile, Microsoft has crushed or alienated
practically every potential partner that might
otherwise have helped it out of its current fix.
Network hanky panky
This latest Microsoft Internet Explorer security
dustup really isn't a bug, it's a feature.
Internet Explorer was built to make it easy to
launch a file, whether that file is on your hard
drive or sitting on a server somewhere in
Freedonia. Unfortunately, it took someone outside
Microsoft to realize last August that the file one
launches from Explorer could be a Word for Windows
document packing a malevolent macro.
Then, in the past few weeks, .URL, .LNK, and .ISP
files were added to the danger list. Then it
surfaced that Microsoft's Common Internet File
System opens the door to network hanky panky. This
is clearly a company that isn't used to thinking
outside of the universe of the local LAN. The
Microsoft patches configure Explorer to ask your
permission before launching a potentially
dangerous file type (similar to Netscape
Navigator). OK, but this solution makes it
virtually impossible for Microsoft or anyone else
to integrate a browser seamlessly into the Windows
desktop.
If seamless, safe desktop access to remote files
on the Internet is the goal, Microsoft is spinning
its wheels. There is really only one way to
provide these features without introducing a local
security risk. You have to eliminate the
possibility that anything you run can affect your
local drives. Better still, get rid of your local
drives.
In short, a Java-based browser is a good way to do
it, but a Java-based network computer is best.
Which brings us back to the conclusion of last
week's column.
But, if you're tired of the repetition, here's a
reason you should sit through another sermon:
RandomNoise's Coda. Coda lets you design entire
Web pages in Java rather than use a mixture of
HTML content, tags, and Java applets.
Most pundits seem to be fixated on the fact that
Coda gives you a way to display fancy fonts that
HTML can't handle. Our own Bob Metcalfe is the
only one I know of who addressed the bigger
picture. (See From the Ether, March 10). He
pointed out that Coda may lead the way toward
replacing HTML with Java.
A Java-based Web page removes the distinction
between application and data. It presents data
just as an HTML page would, but every element on
the screen has the potential to be an interactive
part of a sophisticated application.
In other words, the Web page becomes both powerful
and safe enough to earn the right to be the new
desktop user interface to the world. But Internet
Explorer and Windows are nowhere in that equation.
So is Microsoft in a batting slump, or is this the
beginning of the end? Personally, I think
Microsoft can pull out of this one. All it would
have to do to fully recover is turn Windows NT
into Unix, drop Distributed Component Object Model
for CORBA, phase out its Windows-centric protocols
for platform-independent standards, adopt
NetWare's Novell Directory Services, kill ActiveX,
port SQL Server to several different platforms,
and abandon the idea of integrating Internet
Explorer into the desktop.
Well, I'm going to take a nap. Wake me when all
that happens.
NODE 0ca8b34dRe: Microsoft ammunition
Bill Frantz <frantz@netcom.com>Fri, 28 Mar 1997 12:48:33 -0800 (PST)
>From Infoworld:
>
> March 24, 1997
>...
> If seamless, safe desktop access to remote files
> on the Internet is the goal, Microsoft is spinning
> its wheels. There is really only one way to
> provide these features without introducing a local
> security risk. You have to eliminate the
> possibility that anything you run can affect your
> local drives. Better still, get rid of your local
> drives.
The author misses the point. Whether your personal files are stored on a
local disk or on a server doesn't matter. What matters is whether random
downloaded code (again, Java or ActiveX doesn't matter) can use your
authority to read/modify those files. The ActiveX model of, "It's signed
by XYZ Corp. Of course it's safe." is so much bullshit.* The Java
approach of running untrusted code in a safe box is better, but doing it by
validating the safety of object code requires trusting a large complex
verifier.
* See Norm Hardy's paper, "The Confused Deputy", which I believe is still
available through the EROS page at the University of Pennsylvania.
-------------------------------------------------------------------------
Bill Frantz | Back from caving in Borneo.| Periwinkle -- Consulting
(408)356-8506 | Great caves. We mapped | 16345 Englewood Ave.
frantz@netcom.com | 25KM on the expedition. | Los Gatos, CA 95032, USA
NODE fbb80440Re: Microsoft ammunition
ichudov@algebra.com (Igor Chudov @ home)Thu, 27 Mar 1997 16:21:29 -0800 (PST)
Great news, Toto.
The wisest people are already avoiding MS products and are using free
software like Linux to its fullest capacity.
Cc-ed to Bill Gates.
igor
Toto wrote:
>
> >From Infoworld:
>
> March 24, 1997
>
> Coda dependency may contribute to the fall of the
> great Gates empire
>
> Last week's column demonstrated that Microsoft is
> unable to respond to the network computer in its
> usual "co-opt the technology" manner -- a fact
> that may signal the turning point in the company's
> history. (Why am I leaving Intel out of this
> prediction, you ask? Because it is in a far more
> flexible position than Microsoft. Its chips can
> run anything. Microsoft needs them to run
> Windows.)
>
> Add to this NC threat the mounting troubles for
> Microsoft, and it's no wonder there's no joy in
> Redmond tonight.
>
> Look at the trends. According to International
> Data Corp., Microsoft SQL Server for Windows NT
> has been losing significant market share for two
> years to competing products that run on multiple
> platforms. Microsoft's Wolfpack clustering
> technology is turning out to be a Chihuahuapack.
> (See "Toothless Wolfpack," March 17.) Seemingly
> endless rapid-fire announcements by ISVs to
> support standards such as Java, JDBC, LDAP, IMAP4,
> and CORBA are shoving Microsoft's TAPI, MAPI,
> ISAPI, "SLAP-HAPI," and a host of other
> Microsoft-centric specifications right out of the
> limelight.
>
> By now you have undoubtedly heard more than you
> want to hear about the fellow in Germany who
> demonstrated that a malicious ActiveX control can
> secretly empty your bank account. Leaks, bugs, and
> hastily cobbled service packs have been drawing
> attention to the immaturity of Windows NT. And,
> most recently, college kids have found more holes
> in Internet Explorer than it takes to fill the
> Albert Hall. (My apologies to those outside the
> Beatles generation who don't get the reference.)
>
> Meanwhile, Microsoft has crushed or alienated
> practically every potential partner that might
> otherwise have helped it out of its current fix.
>
> Network hanky panky
>
> This latest Microsoft Internet Explorer security
> dustup really isn't a bug, it's a feature.
> Internet Explorer was built to make it easy to
> launch a file, whether that file is on your hard
> drive or sitting on a server somewhere in
> Freedonia. Unfortunately, it took someone outside
> Microsoft to realize last August that the file one
> launches from Explorer could be a Word for Windows
> document packing a malevolent macro.
>
> Then, in the past few weeks, .URL, .LNK, and .ISP
> files were added to the danger list. Then it
> surfaced that Microsoft's Common Internet File
> System opens the door to network hanky panky. This
> is clearly a company that isn't used to thinking
> outside of the universe of the local LAN. The
> Microsoft patches configure Explorer to ask your
> permission before launching a potentially
> dangerous file type (similar to Netscape
> Navigator). OK, but this solution makes it
> virtually impossible for Microsoft or anyone else
> to integrate a browser seamlessly into the Windows
> desktop.
>
> If seamless, safe desktop access to remote files
> on the Internet is the goal, Microsoft is spinning
> its wheels. There is really only one way to
> provide these features without introducing a local
> security risk. You have to eliminate the
> possibility that anything you run can affect your
> local drives. Better still, get rid of your local
> drives.
>
> In short, a Java-based browser is a good way to do
> it, but a Java-based network computer is best.
> Which brings us back to the conclusion of last
> week's column.
>
> But, if you're tired of the repetition, here's a
> reason you should sit through another sermon:
> RandomNoise's Coda. Coda lets you design entire
> Web pages in Java rather than use a mixture of
> HTML content, tags, and Java applets.
>
> Most pundits seem to be fixated on the fact that
> Coda gives you a way to display fancy fonts that
> HTML can't handle. Our own Bob Metcalfe is the
> only one I know of who addressed the bigger
> picture. (See From the Ether, March 10). He
> pointed out that Coda may lead the way toward
> replacing HTML with Java.
>
> A Java-based Web page removes the distinction
> between application and data. It presents data
> just as an HTML page would, but every element on
> the screen has the potential to be an interactive
> part of a sophisticated application.
>
> In other words, the Web page becomes both powerful
> and safe enough to earn the right to be the new
> desktop user interface to the world. But Internet
> Explorer and Windows are nowhere in that equation.
>
> So is Microsoft in a batting slump, or is this the
> beginning of the end? Personally, I think
> Microsoft can pull out of this one. All it would
> have to do to fully recover is turn Windows NT
> into Unix, drop Distributed Component Object Model
> for CORBA, phase out its Windows-centric protocols
> for platform-independent standards, adopt
> NetWare's Novell Directory Services, kill ActiveX,
> port SQL Server to several different platforms,
> and abandon the idea of integrating Internet
> Explorer into the desktop.
>
> Well, I'm going to take a nap. Wake me when all
> that happens.
>
- Igor.