Yeah, I have been watching the GUIs in Linux try more and more to be like Windows, even though they don't care for the OS. Most of the exploits that you see in Windows haven't happened in the Linux world because:
A. MS is a much bigger target for the monkeys of the world, and
B. The exploits focus on features Linux servers don't have.
IIS buffer exploits have been focused on Index Server (for those that have used it properly, they know how much a$$ it kicks) and the web printing ISAPI filter (nice extension for monitoring printers online, especially via AD). MS puts a MAJOR amount of time into these extra features, but they become easy targets since they spent most of the overall project time in adding usable features, and not securing them and making sure admins that use them understand how to properly secure the server. It's getting better though, and I volunteer to test MS apps whenever possible. Currently, I am testing service packs for MS SQL Server 2000 and I am hoping to get IIS 6.0/.NET server pretty soon (just sent in my NDA on Wednesday) so I can play with all the new features, and see what needs to be done to harden them against attack.
I think I just get tired of these monkeys that find it easier to berate MS because so many other people do it, and yet they haven't actually TRIED to learn all the aspects of the software they are b1tching about. Case in point, the moron "expert" that was quoted about the lack of a password being allowed during setup. That a$$ should know what he is talking about BEFORE he blabs about it to an online publication. Plus, the editors didn't even bother to verify the statement, so they are just as stupid. These people should stop whining about the problem, and be a part of the solution instead. How many people have you seen whine about MS products, yet still use Windows, Office, and other MS products? Seems kind of stupid, doesn't it? The only person that I have ever seen complain about MS products that I have respect for is a friend of mine that got me into networking to begin with. He has moved from MS/Windows systems to Linux, and he is FULLY dedicated to the OS. He has made an effort to learn everything he could about MySQL, Apache, and other products that run on that OS. The main reason why I respect him, is that he actually KNEW what he was talking about when it came to most MS products, and he chose Linux due to its much more lax licensing and would use it as some of his client sites (he's a consultant now).
Most people that whine about "holes" in Outlook or IIS don't even realize what they were talking about. Case in point, there was this BRILLIANT piece of coding using CDO/ActiveX from MS, it was the Outlook Web Control object. You could write webpages that would actually show your current inbox, calendar, contacts, etc from Outlook (normally shown in "dashboards" for corporate Intranets) and allow the person to create, open, and delete emails and such from Outlook but through the webpage. Unfortunately, this led to issues where people would host the object and try to get email account info from an unsuspecting web surfer with low security settings and outdated web browser (old or unpatched). MS had to take the cab file offline because it was too hard to get people to simply update their web browsers and Office versions with simple patches. They eventually released a fix for machines that already had it installed, but I don't think they ever put the cab file back online (I still host it on my Intranet site for the Team Calendar app that MS released shortly after Office 2K came out). Now, you can't use these features anymore, and many people lose out. Same thing goes for Palm units connecting to Outlook 2K; people b1tched about how easy it was to "hack" into Outlook, and MS had enough of it. They released SP2 which locked it down HARD. Now, with SP2 (and Outlook XP), every time I sync I have to authorize the application to talk to Outlook and give it an amount of time that it can continue to do so. Also, in this same patch, it damn near kills most attachments that come through to prevent morons from opening VBS files and trashing their Exchange servers. So, do you hear "Thanks!" from the users? Hell no. They NOW whine that they can't "do" anything anymore in Outlook and that all of their attachments are hidden from them.
So yeah, I guess I have a beef with MS bashers at large. Oh well. Oh and sorry for the long post, I was just a bit pissed about the whole thing.
Help
