McAfee update exterminates Excel

Found on CNet News on Sunday, 12 March 2006
Browse Software

For a brief period on Friday, McAfee's security tools killed more than viruses.

An error in McAfee's virus definition file released Friday morning caused the company's consumer and enterprise antivirus products to flag Microsoft's Excel, as well as other applications on users' PCs, as a virus called W95/CTX, Joe Telafici, director of operations at McAfee's Avert labs, told CNET News.com.

McAfee's antivirus software detected Excel.exe and Graph.exe, two Microsoft Office components, as well as other software, including AdobeUpdateManager.exe, an application installed alongside Adobe products that deals with software updates, Telafici said.

Can you say "whoops"?

Windows Live Search goes Live

Found on Slashdot on Tuesday, 07 March 2006
Browse Software

"Microsoft has launched the Windows Live Search. Among the reports, Microsoft Search Senior Product Manager, Justin Osmer says that "The beta, and a revision expected in a few months, will challenge market leader Google."" I like the more dynamic image searching tool. It seems really slow- I'm not sure if that's the dynamicness (is that a word?) or just standard launch lag.

It's not like I like to run MS down... but when I first tried to test it, I got a "Server busy" message only. Obviously Live got slashdotted pretty fast (the article was still on top). About 6 hours later, I gave it another try; it turns out you need Javascript and Cookies. But even with all that, it did not return any results, just the same site over and over (and all that was tested in IE5.5). Not to mention it's slow and sometimes just returned a blank page. Surprisingly, Live works in Firefox. I got quite a different layout than in IE and finally had the chance to test it. A quick search for "miserable failure" brings up rather different top hits; Live returns the homepage of Michael Moore, but Google lists Dubya's biography as number 1. Are those unaltered results? Only MS knows. To sum it up: I can challenge Google, you can challenge Google, MS can challenge Google; the success is the same.

AIM Now (Mostly) Open To Developers

Found on Slashdot on Sunday, 05 March 2006
Browse Software

Today is a historic day at AOL as we announced a software development kit for AOL Instant Messenger. Open AIM will empower you, as the developer, to write custom clients and plugins. For now, lets concentrate on the Open AIM SDK and get into what it can do for you.

We now have a solution to provide all AIM users and consumers to build their own IM clients and to extend the features of Triton via plugins. Of course all of this is free of charge.

Free as in totally limited. If you read their FAQ, you will find for example this: "Developers are not permitted to build Custom Clients that are multi-headed or interoperable with other IM networks". The user license adds more limitations: "Your Plugin shall not block, disable, or otherwise affect any advertising, advertisement banner window", "You may only offer your Plugin for download by users from a fixed HTML website located at a publicly available fixed URL address which you identify" or "You may not deploy or distribute your Plugin to any third party.". And because your development key is used during the connection, they can block your plugin at any time. All this really isn't free.

Maxxuss cracks Intel only code

Found on The Inquirer on Saturday, 04 March 2006
Browse Software

When Skype and Intel announced their joint collaboration at last year's IDF, a lot of journos recognized the deal as preparation of the terrain for Intel-only features. Indeed, with the latest version of Skype, a product of eBay Inc - enabled 10-way conference calls, but only if Intel hardware was used. AMD users were treated with "only" a 5-way option. Both Skype and Intel claimed that this was due to new, superior Intel marchitecture.

However, since 10-way works on old NetBurst marchitecture (Pentium D) as well, it was obvious that this was a marketing plot for a marchitecture world.

Of course, until Maxxuss came along. Well known enthusiast from the sphere of MacOSX86 project took a look at Skype, whacked the marketing code and enabled 10-way conference using other processors. The "protection" was actually a string in code that checks for "GenuineIntel" string inside the CPU. If the La Intella is detected, 10-way works. If string returns something else, like "AuthenticAMD", boom! Only 5-way.

Collaboration? Superior Intel architecture? Sneaky try, but not sneaky enough.

Windows bumps Unix as top server OS

Found on CNet News on Tuesday, 21 February 2006
Browse Software

Windows narrowly bumped Unix in 2005 to claim the top spot in server sales for the first time, according to a new report from IDC.

Computer makers sold $17.7 billion worth of Windows servers worldwide in 2005 compared with $17.5 billion in Unix servers, IDC analyst Matthew Eastwood said of the firm's latest Server Tracker market share report.

And in another first, fast-growing Linux took third place, bumping machines with IBM's mainframe operating system, z/OS. Linux server sales grew from $4.3 billion in 2004 to $5.3 billion in 2005, while mainframes dropped from $5.7 billion to $4.8 billion over the same period, Eastwood said.

And here's where I stop reading the article. If you rank operating systems by the sales, MS has of course a high chance to win. Compared to free systems, like Linux, BSD and Solaris, that's quite easy. They need to compare usage, not sales (for example 68.01% Apache vs 20.56% IIS).

Microsoft Plans Six Core Windows Vista Versions

Found on Microsoft-Watch on Saturday, 18 February 2006
Browse Software

After months of maintaining that it had not yet finalized its Windows Vista line up, Microsoft seems finally to have decided upon a half dozen core Vista versions.

On the line up are Windows Starter 2007; Windows Vista Enterprise; Windows Vista Home Basic, Windows Vista Home Premium, Windows Vista ultimate, Windows Vista Business, Windows Vista Home Basic N and Windows Vista Business N.

According to information on the Microsoft site, all of the planned Windows variants will include integrated games.

Lots of version for a system which is always delayed. If MS didn't make some fundamental changes to increase security, Vista won't be that much different from existing versions. And you will have games on every version, even the Enterprise release; I wonder who came up with this bright idea.

Microsoft details Windows anti-virus pricing

Found on The Register on Tuesday, 07 February 2006
Browse Software

Users running Windows will be charged almost $50 each year for having their PCs protected by Microsoft against attacks from hackers.

Microsoft underlined the advantage in using Windows OneCare in a statement, saying: "Research showed that most people's computers are insufficiently protected from threats... because users find the protection process confusing and frustrating." Windows OneCare Live provides a "just take care of it for me" service.

News of the pricing comes a week after exiting Windows chief Jim Allchin told Computer Reseller News (CRN) the long-awaited Windows Vista client would not feature anti-virus protection, and customers would need to subscribe to Windows OneCare Live.

Microsoft's decision to charge customers extra for anti-virus protection comes despite repeated claims by the company about the level of importance accorded to security in Windows Vista. Allchin last month said: "Safety and security is the overriding feature that most people will want to have Windows Vista for."

Does that mean users could sue MS for compensation if their machines are hacked even if they joined OneCare? If safety and security is the best feature, then obviously usability and stability isn't. Updates and fixes should always be free. An advocatus diaboli would say that MS could now add bugs to justify their security product.

DoS Flaw Flagged in IE7 Beta 2

Found on eWEEK on Thursday, 02 February 2006
Browse Software

An independent security researcher has pinpointed a denial-of-service flaw in Microsoft's brand new Internet Explorer 7 Beta 2 Preview just moments after installing the security-centric browser makeover.

Tom Ferris said could hardly believe his eyes when the new browser crashed less than 15 minutes after he started using a homemade fuzz testing tool to poke around for potential security issues.

"I've confirmed a denial-of-service at this point, but I'm sure someone malicious could research this some more to control memory at some point to cause code execution," Ferris said in an interview with eWEEK.

The Redmond, Wash. software maker typically downplays a denial-of-service browser bug that fixes itself when the browser is restarted, but Ferris said it's dangerous to assume the risk cannot be escalated with additional research.

Looks like nothing changed.

MS Won't Offer Patch Before Worm Strikes?

Found on Slashdot on Wednesday, 01 February 2006
Browse Software

"According to an article in Information Week, Microsoft is aware that the 'Kama Sutra/Blackworm/MyWife' worm will hit on Friday, overwriting office documents, but will not release a patch until its regular monthly patch release on February 14th. Unless, that is, you subscribe to one of Microsoft's pay security services, in which case your machine will have the worm removed in advance." From the article: "The blog offered no explanation why the tool wouldn't be updated earlier, nor did Microsoft immediately respond to questions. Each month, Microsoft pushes a revised tool to Windows users who have Automatic Update enabled for Windows Update or Microsoft Update. The Redmond, Wash.-based company has released the Malicious Software Removal Tool off-schedule once before, in August 2005, shortly after the Zotob worm began striking Windows 2000 systems."

That's another way to make people pay for your support.

WMF Vulnerability is an Intentional Backdoor?

Found on Slashdot on Thursday, 12 January 2006
Browse Software

Steve Gibson alleges that the WMF vulnerability in Windows was neither a bug, nor a feature designed without security in mind, but was actually an intentionally placed backdoor. In a more detailed explanation, Gibson explains that the way SetAbortProc works in metafiles does not bear even the slightest resemblance to the way it works when used by a program while printing. Based on the information presented, it really does look like an intentional backdoor.

Now this might be true, or Steve Gibson wears a tinfoil hat all day long. Still, the conclusions which lead him to this statement sound quite plausible. That's somehow disturbing.