WinXP Security FlawPosted by timothy on Thursday December 20, @02:42PM
from the can-root-my-dad's-new-laptop dept.
Many readers have submitted word of the newest security hole in Windows XP. joshjs, for instance, writes: "Don't know if this is common knowledge at this point or not, but apparently some security researchers discovered that Windows XP's universal plug and play features contain a huge security flaw: 'A Microsoft official acknowledged that the risk to consumers was unprecedented because the glitches allow hackers to seize control of all Windows XP operating system software without requiring a computer user to do anything except connect to the Internet. ... Microsoft made available on its Web site a free fix for both home and professional editions of Windows XP and forcefully urged consumers to install it immediately.' Read more at the Washington Post's story."[/i] No OS is perfectly secure, but I bet a lot of new XP owners won't be too happy about this. Update: 12/20 20:05 GMT by T: fcrick submits a link to the same AP story at Wired, and several readers have pointed out that a patch is available. Update: 12/20 21:31 GMT by T: And as banuaba writes: "This hole also affects versions of 98 with XP File sharing installed and all versions of ME."

- wil

Another great reason why I should go down the Linux route! Thank you Microsoft for making my informed decision that much easier.

What a joke!



- wil

I don't believe anyone said XP is perfect and if they did that would be presumptuous. I would highly doubt that Microsoft would care which route you go anyway, but I'm also sure that just because not many holes have been exposed in Linux, that doesn't mean it's perfect, and it's definitely not perfect for an average computer user who just wants to go on the internet and get email.
Lavon Russell
LookHard Mods
lavon@lh.links247.net

I also like how this came out days after Microsoft's Chief of Security said XP was secure as they had done automated testing to remove buffer overflow errors, and sure enough, here's a buffer overflow error.

=)

Cheers,

Alex
--
Gossamer Threads Inc.

>>and it's definitely not perfect for an average computer user who just wants to go on the internet and get email.<<

As an XP/Mandrake user I have to admit that Mandrake is pretty efficient for Internet browsing. Infact Im using it now.

You can do most things you can do with Windows such as browse using a variety of browsers and collect email from your pop accounts.

You also have the benefit of a mod_perl server :)

Crappy Microsoft produces bug/security/error ridden software.
Steals ideas from smaller companies.
Small developers are closed because of their unfair business practices.


In the real world of the end user consumer...

Wow! This software is so easy to use!
All that for this price!
I did this with that today!
Keystrokes to remember? NO! just point and click!
Billy you did well with your homework - using Encarta are we?
Well done Microsoft for fixing security holes quickly and keeping us safe.

Which one matters?

The answer lies in the profits made every year by Microsoft.

~ ERASER

---

Free JavaScripts @ Insight Eye

I have no doubt that there are *nix os's that are just as good at average usage, but lets say a single mother wants to buy a computer for her kids and she knows nothing about computers. She'll most likely get a computer with Windows. Actually now that I think about it, I don't like the way Windows Os's come by default when you get a new computer. I wish there was somehow a way to have a choice, but I guess the computer makers figure they can charge more for a comp with Windows XP then one with Linux.
Lavon Russell
LookHard Mods
lavon@lh.links247.net

His a couple tips to completely disable Universal Plug and Play. Go into control panel and click on administrative tools and then click on services. Scroll down till you find "SSDP Discovery Service" right click on it and click properties and under startup type choose disabled. Click ok on the SSDP Discovery Service dialog and scroll down the services till you find "Universal Plug and Play Device Host" and do the same thing to it that you did to SSDP Discovery Service.

That's a simple fix. I tried downloading the patch but the connection keeps getting cut off or is really slow so I haven't been able to apply it yet.

Writing an OS is not like writing a Perl program. Millions of lines of code go into writing and trying to keep it secure is hard work. Some things do get overlooked. I'm not siding with M$ just saying that it is real easy to screw up. I'm working on a project right now written in C++ and WTL that's already up to 200,000 lines of code and it's becoming difficult to manage. I'm just one man, M$ has lots of programmers...so they should, in theory, be able to fix the problem.

Later,

Paul
http://www.fullmoonshining.com for Pearl Jam Fans