Scott Granneman: Surprises Inside Microsoft Vista's EULA
622985
Surprises Inside Microsoft Vista's EULA &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
43197
Red tape vs Redmond...the never ending story The European Commission has hit back at suggestions it has got it in for Microsoft over security features built into the heavily-delayed Windows Vista.â¦
455233
Resistance to Vista was expected among the large companies that have leverage with large PC vendors, but even in the consumer and SMB ranks, the clamor for XP is significant. The beneficiaries? Possibly, "white-box" system builders and direct-sales channels.
697721
David Daoud ran into trouble when he  started using Vista, the new version of Windows that Microsoft  Corp. and PC makers have spent millions of dollars advertising  since it came out six months ago.
321704
Security-focused Windows XP update can be tough on applications. Guidelines are meant to help professionals "test and mitigate."
450389
Get a closer look at some of the new features in Vista Service Pack 1.
57813
Data released Thursday by a security executive at Microsoft appears to show that six months after Vista's release, the company has more vulns sitting open that it did at this point in XP's history. Jeff Jones' report was an effort to show how Microsoft's software development methodology, called the Security Development Lifecycle (SDL), is yielding dividends.
367071
Restrictive hardware and convoluted rights management crimp consumer choices.
220556
Know whether your copy of Windows is licensed? The software maker might ask you this next time you visit its download site.
662461
A Windows Vista feature designed to simplify computing for disabled users has security implications, according to a McAfee researcher.
682777
Developers of open-source Samba software will find their work a little easier thanks to an agreement with Microsoft, signed Thursday, that will give them access to previously secret data on how the Windows operating system works.Microsoft was compelled to make this information available following a March 24, 2004, European Commission antitrust ruling against the company. In July 2006, the EU fined Microsoft &#8364;280.5 million ($338.6 million at that time) for failing to provide documentation on Windows protocols to its rivals.&#160;Microsoft lost an appeal of that decision&#160;in September, setting the stage for the deal.The deal was signed with a nonprofit group called the Protocol Freedom Information Foundation, (PFIF) which negotiated on behalf of the Samba team because Samba is not represented by a corporate entity. PFIF will pay a one-time fee of &#8364;10,000 and, in return, will be able to allow open-source developers, including the Samba team, to access the documents.Developers will have to sign nondisclosure agreements and will not be allowed to redistribute Microsoft&#39;s documentation, but they will be able to write open-source software that implements the Windows protocols. The deal will also clarify which patents Microsoft believes are related to this technology, making it easier for open-source developers to avoid patent violations.Antitrust rulings forced Microsoft to set up protocol-licensing programs in the past, including the MCPP (Microsoft Communications Protocol Program) and the WSPP (Work Group Server Protocol Program), but these efforts were not compatible with open-source software licenses.That is apparently not a problem with the PFIF agreement.&quot;They&#39;re giving us all the documentation to make everything work,&quot; said Jeremy Allison, co-author of Samba. &quot;We will have no more excuses to suck &#8230; if we don&#39;t have something, we won&#39;t be able to say it&#39;s not our fault, we don&#39;t know how to do it.&quot;Samba is an open-source version of the file-and-print software used by Windows. It is a standard component of the Linux and Unix operating systems, allowing these systems to share data and work alongside Windows clients.But development of Samba has traditionally been back-breaking work. Developers would analyze network traffic to try and glean how Windows was working and then build their software based on that knowledge -- a process called reverse-engineering.With the new agreement, developers will have access to Microsoft&#39;s own protocol specifications and will be able to build their software based on those documents, Allison said. That, in turn, will accelerate the team&#39;s development of its next generation of software, which will implement the new Sever Message Block 2.0 protocol used by Windows Vista.Though the deal was reached on Thursday, developers were still waiting for the final technical aspects of the document hand-over to be settled, Allison said. He expects to get his hands on the technical specifications fairly soon. &quot;I&#39;m guessing that for my Christmas vacation I&#39;ll have some enjoyable things to read,&quot; he said.
708807
Blog: Researcher finds a basic cookie-handling error that could compromise Windows PCs.
674795
(InfoWorld) - Itâs not easy being Ben Fathi. As corporate vice president of Microsoftâs Security Technology Unit, Fathi took the place of longtime STU leader Mike Nash in March amid a larger management shake-up just days after Microsoft announced that the shipment date for Vista was slipping yet again. After Nashâs high-profile tenure, Fathiâs charge is more subtle: building what he calls a âtrust ecosystemâ around Vista and its new security features and promoting the companyâs secure development practices. But first he must help get Vista out the door. Fathi sat down to talk with InfoWorld Senior Editor Paul Roberts at the recent Security Standard Conference in Boston about Vistaâs progress, and the world after Vista. InfoWorld: Recently thereâs been some back and forth with Symantec about issues such as Vistaâs Kernel Patch Protection feature for 64-bit systems, as well as some public criticism of Vista code for having security holes. What should enterprise folks make of that? Ben Fathi: First, on the paper Symantec published: We thank them for their input. I think itâs unusual for a partner to go public with a paper like this on a beta product, but they did identify a few issues. To the best of my knowledge, all those were already fixed in more recent beta releases. We love to hear feedback on beta products. Thatâs why weâre in beta. Itâs a test. Weâll fix them as long as they report them to us. As for the kernel patching, we fundamentally believe that the current model of kernel patching is broken and not sustainable. We never recommended it or supported it on any version of our operating systems. As weâve been telling our vendor partners, this is the only chance we have, as 64-bit computing becomes available, to start with a clean architecture and build on top of that. We want to work with you to find ways to extend the kernel functionality by having a clean architecture, APIs, and filters. â¦ instead of patching instructions and data structures in the kernel. In the long term, what we want to do is move a lot of these functionalities to a hypervisor that sits under the kernel to make the kernel even smaller and the trusted computing base even more secure. We still have a window of opportunity here. â¦ and weâre working with two or three vendors in the space to come up with that kind of architecture. One of the other comments thatâs been made is that [Kernel Patch Protection] is anti-trust. That weâll go back in with our own products and get around it. Thatâs absolutely not true. Weâd never do that. IW: You recently patched a beta version of Vista. Is it a bad sign that youâre patching beta Vista? BF: I believe that Vista is significantly more secure than any version of XP or anything else weâve shipped in the past. Just SDL (secure development lifecycle) in general and the process of penetration testing and hardening kernel services. These all created a stronger, defense in depth strategy. What I would say is, Yeah, there will be patches and vulnerabilities as we move forward. What weâre hoping is that by creating these layers of defense, weâre giving customers, especially enterprise customers, a longer time to test and make sure things are not broken. IW: Do you see your job description and responsibilities changing after Vista? BF: There are six different areas that we call âBig Betsâ that have been identified in my division. I will mention two. The first, Application ID, is a way to identify an application that includes an executable, the library it uses, configuration files, registry settings, any patches that are applied to it. So youâll have a cryptographically signed version of the application, and youâll be able to identify that and whitelist or blacklist that. When we talk about a trust ecosystem today, the ability to trust people based on an ID and trust machines based on an ID, we canât do that with applications. If itâs called powerpoint.exe, we go and run it. So having strong IDs based on the application and [making] sure they havenât been tampered with after download is an important investment for us. The second area is isolation. Creating guest operating systems that sit on top of hypervisors allow us to create better isolation mechanisms so that even if malware comes in, it only affects one subset of the machine and not everything else. Weâve done some great work on server hypervisors and server virtualization. We need to extend that to the client. Weâre seeing partners do that already, and so weâre going to invest in that space.
103983
BBC Click investigates free security software and finds out who will protect PCs when Microsoft launches Vista.
677543
You rarely hear about a new OS causing people to panic. But IT consultant Scott Pam says that's exactly what his small-business clients are doing when they install Windows Vista on new PCs and run smack into compatibility or usability roadblocks.                                                    Pam's clients are not alone: Since InfoWorld launched its petition drive on Jan. 14 to ask Microsoft to continue selling new XP licenses indefinitely alongside its Vista licenses, more than 75,000 people have signed on. And hundreds of people have commented ? many with ferocious, sometimes unprintable passion. "Right now I have a laptop with crap Vista and I'm going to downgrade to XP because Vista sucks," reads one such comment.Where does all the vitriol come from?[ Get the big picture on  Windows XP's impending demise, from user reactions to licensing implications ? and sign InfoWorld's "Save XP" petition ]IT managers and analysts suggest a range of reasons, some based on irrational fears and others based on rational reactions to disruptive changes.Emotional effects "When we first deployed Vista, people told us it sucks, that it's not as good as XP," recalled Sumeeth Evans, IT director at Collegiate Housing Services, an 80-person college facilities management firm. A month later, he surveyed the staff to see if their views had changed, and they had: "They said it was very good, that they were getting used to it. We asked what was different, and they said they originally didn't like Vista because it was a change. That's human nature."Microsoft's overzealous schedule in replacing XP with Vista has exacerbated resistance to change, said Michael Silver, a research vice president at Gartner. The company had originally planned to discontinue XP sales on Dec. 31, 2007, just 11 months after Vista was made available to consumers and 14 months after it was made available to enterprises. The date for new license sales to end is now June 30.In practice, XP's consumer availability ended for many users even sooner ? just six months after Vista's release ? since storefront retailers  Best Buy and Circuit City and most computer manufacturers' Web sites stopped selling XP-equipped computers in July 2007. Typically, Microsoft has given customers two years to make such a transition, Silver noted.Burton Group executive strategist Ken Anderson suggested that the strong emotional identification with XP represented a fundamental shift in how people, including IT staff, now think of operating systems. They have become a familiar extension of what we do and how we work, thus not something  want to change often. "When technology becomes part of you, you don't want people to mess with it," he said.Anderson likened the reaction to XP's impending demise to what happened in the 1980s when Coca-Cola replaced its classic Coke formula with New Coke, causing massive protests by customers who had no reason to change what they drank. The protests forced the company to bring back what we now call Coke Classic. "XP has come to the point of being Coke Classic," he said, with Vista playing the role of New Coke.The further the better The Englewood (N.J.) Hospital Medical Center switched to Vista shortly after its enterprise release, since it had been in Microsoft's early adopter program. Most users ? mainly nurses and other medical staff ? didn't really notice the upgrade and had few complaints, noted Gary Wilhelm, the business and systems financial manager (a combination of CTO and CFO) at the 2,500-employee facility. That's because they don't really use the OS, but instead work directly in familiar applications that load when they sign in using their ID.Capacitor manufacturer Kemet saw a similar ho-hum reaction from most of its staff, says Jeff Padgett, the global infrastructure manager. And for the same reason: Users have little direct interaction with the OS. But the staff did push back on Office 2007, whose ribbon interface is a departure from the previous versions. They rebelled to the degree that Padgett has delayed Office 2007 deployment and may not install it at all.Back at the Englewood hospital, Wilhelm did hear anti-Vista grumbling from people in the administration department, who work more closely with the OS itself for file management and so on. And at Kemet, another group of hands-on users complained about the switch to Vista, noted Padgett: "The people who suffered the most were engineers and IT people."The phenomenon of hands-on users being the most resistant explains why so many small-business users and consultants have reacted so strongly against Vista, noted Gartner's Silver.Conversely, those enamored of the latest technology tend to be Vista enthusiasts, said David Fritzke, IT director at the YMCA Milwaukee, which has been adding Vista to its workforce as it buys new computers. "Some users bought Vista for home and then wanted it more quickly at work than we had initially planned to deploy it," he said. Fritzke also found that younger users adapted to Vista more easily.In search of ROI Users' personal reactions, positive or negative, ultimately impact the bottom line and help drive the business decision of whether to roll out Vista across an organization.It's all about basic cost-benefit analysis, says Gartner's Silver. In most businesses, Vista offers few compelling advantages for users while introducing challenges. The cost of change is too high for the perceived benefit. For example, users often complain about Vista's constant nagging about possible system threats, about applications that no longer run, or about files that appear to be "lost" because they've been moved to new places by the OS, Silver said."It's really hard to convince someone to go to a product that's not quite as stable or as capable as what they're already using," Silver noted ? and so they get frustrated and angry. While IT managers and analysts appreciate some under-the-hood changes in Vista, these improvements don't have an immediate, obvious benefit for users. "Vista's benefits are not about the users," concurred Collegiate Housing Services' Evans.Upgrades from Microsoft's past have also colored expectations, Silver said. Users tend to remember the straightforward transition from Windows 2000 to XP, even though technically it was a "minor" upgrade, he said. (Silver also noted that until XP Service Pack 2, XP had its own share of compatibility and security flaws that annoyed users, something that most forgot with SP2's release.)And while the path from Windows 95 and 98 to Windows XP was rockier, the benefits were clear enough at each stage for most customers to make the upgrade investment gladly, Silver said.Some users have decided to skip Vista altogether and instead wait for Windows 7, whose release date has been reported as anywhere between 2009 and 2011 "Why shoot yourself in the foot twice? Windows 7 will be out next year; I'll wait till then," said one InfoWorld reader. If Windows 7 arrives sooner rather than later ? or if a miraculous Vista service pack addresses all the major objections in one swoop ? then the uproar over upgrading to Vista will quickly fade into the hazy past of other Windows upgrade snafus.
98961
Bill Gates throws a huge party for Windows Vista. Was it the last of its kind?
49547
Blog: A developer writes that virtualization represents a threat to Microsoft's control of the desktop and licensing restrictions are one way to try to maintain its grip.