🚀 go-pugleaf

In article <pharmacy-0508952141310001@dialup-5-145.gw.umn.edu>,
pharmacy@maroon.tc.umn.edu (Patrick B. Parker) wrote:
> > I used the wizard once. It asked for permission and lets the user bail-out
> > and register nothing. It is optional. It is not required, there is a
> > postcard for conventional reqistration also. 
> In my opinion that's beside the point.  The whole premise of the system
> that MS incorporated into their OS is wrong from the get go.  Software
> that goes through your hard drive, building a file of all the applications
> and what not on your system to send off to another company is wrong wrong
> wrong.  Can you tell me any company yet that has believed that this was
> the 'right' thing to do?

Quite correct!

This is WRONG, WRONG, WRONG!

The registration file that is uploaded is generated in your Windows
directory. Take a look for yourself, it doesn't contain flamable material.

Again, we have yet another thread crossposted to various incompatible
groups, and yet again, frantic Linux and OS/2 users are bashing MS.

So let me fire one back:
MS have a complete operating system solution. They've got Win95 for
the various smaller computers on a LAN. Win95 is user friendly, reliable,
easy to install, stable and is an overall nice operating system that is
virtually free.

Incidentally, Win95 integrates real well with NT. Surprise. NT offer the
ultimate security, stability, performance, easy installation and is
also relatively cheap (whatever MS charges for it, you save during
installation and training). NT can be just the standard domain and file
server, or one could expand it to become a web server and perhaps a
remote access server (effectively making it possible to become an
internet service vendor). All this while still being able to run every
Windows and Win95 app out there...

The combination of the two is *hot*. We use it and it's definately
recommendable. If you want to get any work done, then this is the way
to go.


=\
 *=- R.Moberg, author of CD-Player Pro! ftp.cica.indiana.edu:
=/                                      /win3/sounds/cdppro45.zip

In article <401cq9$ktj@sundog.tiac.net>,
Jim Williams <williams@tiac.net> wrote:
> >I am surprised, as others who have already posted in this thread, that not
> >much has been made of this so far.  In my network, I have asked that no
> >copies of Windows 95 be placed on machines until I further investigate
> >this situation.
> Given Microsoft's demonstrated moral values, I'd be very worried about their other 
> Network oriented software as well....  There is no way anyone but Microsoft knows 
> what their software is capable of doing over the nets.

MS makes professional operating systems. They do not play around.

There's e.g. no telling what SUN might put into their operating systems
either, and I suggest the possibility that SUN's economical situation (when
compared to MS') might lead to the conclusion that they would gain most
from industry espionage. Just as an example...

I feel that a certain amount of Linux users are totally clueless about the
real world situation. Using a U*IX clone they probably caught this from
the various U*IX environments. These are the same guys that would spend
millions on solutions that could've been implemented using Windows NT for
a fraction of the price. These guys are money wasters. Bury them!

Why choose U*IX?
 - it's stable, well, NT is more stable.
 - secure? No, NT is more secure.
 - better performance? A real world example using a SUN Sparcstation and a 3D
   CAD package revealed that the NT based solution was cheaper and offered
   a faster more responsive environment. NT can definately cope.
 - NT's limitations are (if I remember correctly) 4GB memory space per process
   and (according to Windows Magazine, August) 408 million Terra Byte disk.
   Maybe some U*IX clone can handle more, but I'm sure MS will expand these
   limits.
 - (still quoting from Windows Magazine:) Maximum connections per server
   are 10,000+, maximum printers are unlimited and SMP support (of course).
 - NT exist for Alpha, Intel, MIPS and PowerPC CPU's. Rumour of a SUN
   Sparcstation and a HP PA-RISC port on the way. Start out with a 486DX50
   and scale it all the way to a dual Alpha RISC box e.g....
 - easy installation? No, NT is easier!
 - ah... Easy to maintain, then? No, actually, NT is as easy as it gets.
 - perhaps U*IX is easy to integrate with Win95 clients? Obviously not.
   Both Windows for workgroups and Win95 can access the NT Server without
   any additional drivers.

U*IX is doomed to a life in the scientific community, where they can waste
millions of dollars every year on projects that are clearly better solved
using different operating systems.


=\
 *=- R.Moberg, author of CD-Player Pro! ftp.cica.indiana.edu:
=/                                      /win3/sounds/cdppro45.zip

In article <400gtc$lv9@parsifal.nando.net>,
Aron S. Spencer <aspencer@nando.net> wrote:
>    Well, you get the idea. From a corporate security viewpoint, Win95
> _can not_ be used.

I guess this would include OS/2 Warp as well? Doesn't IBM offer an internet
on-ramp? Isn't there a software package included with Warp that will hook
up to this?

I bet no-one have seen so many paranoid people since the 70's...
"Fingerprint File" by The Rolling Stones suddenly got a new potentional
target group.


=\
 *=- R.Moberg, author of CD-Player Pro! ftp.cica.indiana.edu:
=/                                      /win3/sounds/cdppro45.zip

Jim Williams <williams@tiac.net> wrote:

>billman@centcon.com (William Rini) wrote:
>>Do you feel unable to answer "No" when the registration wizard asks if
>>you would like to register online?  That's all you have to do people,
>>just answer "No"  But it sounds as if people claiming to be everything
>>from super hackers to system administrators haven't figured out how to
>>use that button.
>>

>I know that I could very easily write a dialog with "yes" and "no"
>buttons and then do whatever I please based upon which button was
>pressed.  Maybe when you press YES it sends the data right away, but
>when you press NO it waits and dribbles the data back over time.

>Just because I'm paranoid doesn't mean that Microsoft isn't out to
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^...   
>get me.  That data would be extremely usefull to have, and I wouldn't
>put it past Microsoft to try to get it.

Paraphrazed from another Seattle giant ;p

If the wizard is that much of a problem, pull the phone cord.  Do you
really think that MS has come up with a method of sending your
computer's information without any connection.

BTW, Winfax does the same thing.

Brandon
Soleil@utxvms.cc.utexas.edu

porter@mu.enet.dec.com (dave porter) wrote:

>In <4006km$4os@questor.org>, sp@questor.org wrote about the Win95
> registration wizard.


>Once, I bought something from Microsoft by mail order.

>They sold my name on some list and now I get all sorts
>of crap in the mail that I don't want.  Worse, there's
>a credit bureau file with my name on it.

>How dare they do this?

>---

>Yes, this is supposed to be funny.  What I mean is, how come
>people get bent out of shape by odd rumours like the Win 95 registration
>wizard one, and don't seem to mind the more blatant invasions
>of privacy that go on every day?

>Apologies for the absence of any relevance to Intel processors
>here.  (Unless of course TRW runs on Intel...)

I wouldn't be so worried about TRW.  It is all the other, some less
reputable, credit agencies that are a pain in the ass.

Brandon
Soleil@utxvms.cc.utexas.edu

In <DCvFyp.Csp@agora.rdrop.com>, caf@agora.rdrop.com (Chuck Forsberg) writes:
>In article <400gtc$lv9@parsifal.nando.net>,
>Aron S. Spencer  <aspencer@nando.net> wrote:
>>In article <400emb$bnj@data.interserv.net> William Rini,
>>billman@centcon.com writes:
>>>I just read an article in Inter@ctive Week that tested the
>>>registration wizard in Win95.  The hooked up the system to intercept
>>>the message and read what was being sent.  Guess What?  It was the
>>>same info that the registration asked if it was ok to send.
>>
>>>You would think that if a couple of reporters working for a magazine
>>>could figure out how to test the registration wizard, someone at
>>>Motorola might be able to figure it out.  

Maybe Motorola isn't concerned with the possibility of Microsoft penetrating
their corporate secrets.  Maybe their security types are concerned that someone
at Microsoft will be comparing the number and type of software reported by
the Registration Wizards with the software purchases actually made by
Motorola, looking for unauthorized copies.  Maybe Motorola is afraid of getting
a nice big bill from Microsoft for all those unauthorized copies...

Of course, I could be wrong...

In <DCvFyp.Csp@agora.rdrop.com> caf@agora.rdrop.com (Chuck Forsberg) writes:

>In article <400gtc$lv9@parsifal.nando.net>,
>Aron S. Spencer  <aspencer@nando.net> wrote:
>>In article <400emb$bnj@data.interserv.net> William Rini,
>>billman@centcon.com writes:
>>>I just read an article in Inter@ctive Week that tested the
>>>registration wizard in Win95.  The hooked up the system to intercept
>>>the message and read what was being sent.  Guess What?  It was the
>>>same info that the registration asked if it was ok to send.
>>
>>>You would think that if a couple of reporters working for a magazine
>>>could figure out how to test the registration wizard, someone at
>>>Motorola might be able to figure it out.  
>>
>>   The people defending the Registration Wizard appear to have no concept
>>of corporate security. Functionally, Microsoft has built a back door in
>>to their operating system. The wizard may only send what you say is OK,
>>but it has the capability of doing much more. Whether Microsoft does it,

>Same could be said for every pppd and every internet connectivity package.
>Course it won't make much difference if Art Bell's comet (1995 o1) wipes us
>out in a few years.

Not so ... if you installed a SOM based security package you'd need the
password to access any potentially `dangerous' information.  9x offers no
such protection.

--
T |        Christopher Curtis       |    Those who would sacrifice     | O
E |   Sun Lab System Administrator  |      liberty for security        | S
A | Florida Institute of Technology |        deserve neither.          | /
M |       Melbourne, Florida       N|N            -Benjamin Franklin   | 2

In article <4046q6$2i0o@news.gate.net>, Adam L <adaml@gate.net> wrote:
>[ . . . ] Can you prove that America
>Online, Prodigy, Compuserve aren't sucking your hard drive away bit by
>bit with every keystroke you send over the modem?  How about netscape?
>[ . . . ] Maybe all
>the winsock companies are in on it, too, slowly leeching your private
>information, then selling it on the black market... 

No, one cannot be sure that any of the major online services, especially
those that use proprietary clients, like AOL and Prodigy, are not taking
advantage of their access to your files.  You will never know for sure.  The
same could be true of Netscape, though since it uses open protocols such
action would be much more easily detected.

>Give me a break.  It's not as if this was a 'hidden' feature of MSN...

Give ME a break.  The fact that the MSN installation procedure transmitted
details of the user's files back to Microsoft was not commonly known before
someone outside Microsoft discovered it.  You can be sure Microsoft was not in
any hurry for users to fully understand the meaning to the question.  The
exact content of these transmissions has yet to be actually documented any-
where that I know of and reports vary from poster to poster.  Since Windows/95
was in beta when this issue was revealed, Microsoft could easily have changed
the probe in post-discovery releases.  Only Microsoft knows for sure.

Max
-- 
.----------------------------------------+----------------------------------.
|  /\  /\/  Max Bell <mbell@europa.com>  | Help save the Net.  Support your |
| /  \/ /\  http://www.europa.com/~mbell | local Internet Service Provider! |
`----------------------------------------+----------------------------------'

Jim Williams (williams@tiac.net) wrote:
: I know that I could very easily write a dialog with "yes" and "no"
: buttons and then do whatever I please based upon which button was
: pressed.  Maybe when you press YES it sends the data right away, but
: when you press NO it waits and dribbles the data back over time.

That would be corporate suicide? It would be discovered. Sales would be
affected. The government might get involved. Lawyers would go wild with
lawsuits. MS Stockholders would lynch Bill. 

I don't think MS is suicidal.

Tony
-- 
------------------
Tony Tribelli
adtribelli@acm.org

In article <405anp$t3d@nntpd.lkg.dec.com>,
dave porter <porter@mu.enet.dec.com> wrote:
>In <4006km$4os@questor.org>, sp@questor.org wrote about the Win95
> registration wizard.
>>[Microsoft] sold my name on some list and now I get all sorts
>>of crap in the mail that I don't want.  Worse, there's
>>a credit bureau file with my name on it.
>>How dare they do this?

Given the fact that the Justice Department of the U.S. Government seems
unwilling to take on Microsoft, it will probably dare to do anything
it wants to since it apparently cannot be punished.  As the saying goes,
let the buyer beware!

>Yes, this is supposed to be funny.  What I mean is, how come
>people get bent out of shape by odd rumours like the Win 95 registration
>wizard one, and don't seem to mind the more blatant invasions
>of privacy that go on every day?

They may mind, but also realize there is little they can do about it.  They
will probably come to the same realization about Microsoft eventually after
it becomes too late to do much about it, assuming it isn't already.

Max
-- 
.----------------------------------------+----------------------------------.
|  /\  /\/  Max Bell <mbell@europa.com>  | Help save the Net.  Support your |
| /  \/ /\  http://www.europa.com/~mbell | local Internet Service Provider! |
`----------------------------------------+----------------------------------'

Dave Hwang (martus@mit.edu) wrote:
: Just thought I'd try to lighten things up on this thread. It would be
: scary if I found out this fiction did resemble the truth.

I enjoyed reading you post today.

Tomorrow, I'll be amused when some idiot sites your "experiment" as
evidence of the Great Microsoft World Domination Conspiracy (a conspiracy
which can only be stopped by linux). 

Next week I'll be disappointed when the Wall Street Journal reports that
"experts" are publishing a report, which plagarizes you, about Micorsoft
end-user espionage tools. 

Next month I'll be scared to learn that Microsoft has hired you as project
leader for Registration Wizard 2.0 :-). 

Tony
-- 
------------------
Tony Tribelli
adtribelli@acm.org

>>>>> "Tony" == Anthony D Tribelli <adt@netcom.com> writes:
In article <adtDCz6no.3xD@netcom.com> adt@netcom.com (Anthony D. Tribelli) writes:

        : Dave Hwang (martus@mit.edu) wrote: 
	: Just thought I'd try to lighten things up on this thread. 
        : It would be scary if I found out this fiction did resemble 
	: the truth.

   Tony> I enjoyed reading you post today.

   Tony> Tomorrow, I'll be amused when some idiot sites your
   Tony> "experiment" as evidence of the Great Microsoft World
   Tony> Domination Conspiracy (a conspiracy which can only be stopped
   Tony> by linux).

   Tony> Next week I'll be disappointed when the Wall Street Journal
   Tony> reports that "experts" are publishing a report, which
   Tony> plagarizes you, about Micorsoft end-user espionage tools.

   Tony> Next month I'll be scared to learn that Microsoft has hired you
   Tony> as project leader for Registration Wizard 2.0 :-).

It's a good thing I pulled the plug on the RW so they won't be able to
track me down. All communications will henceforth be encrypted via PGP.
I'll come back online when I've reached the safe house. Oh... gotta
go... 

Dave Hwang
martus@mit.adsfmda'mb a< 

In <406607$81k@news1.deltanet.com>, aa-2@deltanet.com@deltanet.com writes:
>Maybe Motorola isn't concerned with the possibility of Microsoft penetrating
>their corporate secrets.  Maybe their security types are concerned that someone
>at Microsoft will be comparing the number and type of software reported by
>the Registration Wizards with the software purchases actually made by
>Motorola, looking for unauthorized copies.  Maybe Motorola is afraid of getting
>a nice big bill from Microsoft for all those unauthorized copies...
>
>Of course, I could be wrong...

Or maybe Motorola does not like it that M$ could find out what kind of projects they
are working on by looking a their software and even their disks (filenames etc.). Maybe
this gives M$ the opportunity for some nice industrial espionage?

Of course, I could be wrong too...

Marcus Bonse                          email: m.h.w.bonse@wbmt.tudelft.nl
Delft University of Technology
Lab. for Micro Engineering

Previously adt@netcom.com (Anthony D. Tribelli) said:

>Jim Williams (williams@tiac.net) wrote:
>: I know that I could very easily write a dialog with "yes" and "no"
>: buttons and then do whatever I please based upon which button was
>: pressed.  Maybe when you press YES it sends the data right away, but
>: when you press NO it waits and dribbles the data back over time.
>That would be corporate suicide? It would be discovered. Sales would be
>affected. The government might get involved. Lawyers would go wild with
>lawsuits. MS Stockholders would lynch Bill. 

In fact it would be almost as suicidal as putting in functions to
other beta test windows to reduce performance when running on anything
other than MS-DOS?? That isn't as far as I know widely know, that took
a serious amount of reverse engineering to find. But it was there.

Of course I can't remember the name of the person who did the reverse
engineer, I can remember who told me and I could be lying. But there
you have it.

>I don't think MS is suicidal.

It wouldn't be suicidal remember this is the company that "forced"
computer manufacturers/suppliers to install thier DOS by charging them
for each machine regardless of what DOS was used. 

-- 

Slainte                                                      ______ 
Giolla Deciar                                                \   _/___
"I ache for the touch of your lips Dear                       \ \/   /
 But much more the touch of your whips dear" - T lehrer        \/\  /
"If I showed you my dark side would you still hold me tonight"    \/

In article <403avg$3tr@data.interserv.net>,
William Rini <billman@centcon.com> wrote:
>Jim Williams <williams@tiac.net> wrote:
>
>>I know that I could very easily write a dialog with "yes" and "no"
>>buttons and then do whatever I please based upon which button was
>>pressed.  Maybe when you press YES it sends the data right away, but
>>when you press NO it waits and dribbles the data back over time.
>
>Well considering the fact that it would have to dial up through a
>modem, I think it's a pretty good bet you would notice if the "no"
>button transmitted information.

I don't think that's such a good bet.

No information is going to get transmitted until you connect, which
does *not* occur at the instant after one clicks "Yes."  It happens
later in the process.

If a compressed file gets dribbled across the modem during "normal
operations" of MS Network, how are you to tell that it's not your
system configuration files?  Or your Quicken .QIF files?

Since they basically control things at both ends of the connection,
there's essentially no way to tell without using something like an
RS-232 sniffer, or disassembling the code.
-- 
Christopher Browne - Email:<cbbrown@io.org>, WWW:<http://www.io.org/~cbbrown/>
Q: How do you make Windows go faster???                  A: THROW IT HARDER!!!

In article <403bl5$45g@data.interserv.net>,
William Rini <billman@centcon.com> wrote:
>It's because the story is not true.
>This is probably the 8 - 10th time that I have heard the same story 
>with a different company or
>government office.  It's always covered by some small publication that
>only the poster subscribes to and it never makes it into the
>mainstream press.  Of course nobody who actually was supposedly
>involved ever is quoted in the piece (too easy to check out the
>story).  Why didn't the piece quote a Motorola employee by name?  Why
>is the source always anonymous?  Why can't anybody ever verify
>anything the original poster claims?  

I've been out of the country for a month, so I haven't seen the
Financial Post since early July.

I'll have to take a look to verify that the story was in there.

The Financial Post is *not* some "small publication that only the
poster subscribes to;" it's one of the three financial newspapers
that the multinational company that I'm currently consulting at
receives on a daily basis.  More particularly, it's one of the
top two national papers in Canada.  (The Globe and Mail being
the other one.  I prefer the Globe, myself.)

The fact that names at Motorola weren't named could just be that
the spokespeople prefer to get less harassment from outside.
-- 
Christopher Browne - Email:<cbbrown@io.org>, WWW:<http://www.io.org/~cbbrown/>
Q: How do you make Windows go faster???                  A: THROW IT HARDER!!!

cbbrown@io.org (Christopher B. Browne) wrote:

>Since they basically control things at both ends of the connection,
>there's essentially no way to tell without using something like an
>RS-232 sniffer, or disassembling the code.


No way to tell other than the fact that Inter@ctive Magazine and
several other publications have tried it and they all have come to the
conclusion that the info that was transmitted was the info the RW
asked if it could send.  Of course everybody keeps ignoring that fact
so that they can go off on these wild joyrides with reality.  

I said it before and I will say it again, post something new or quit
wasting bandwidth with the same old speculation on what MS might have
the capability to do.  What completely amazes me is that this thread
continues despite the fact that not one piece of information had been
presented that would even be lightly considered as evidence of
wrongdoing.  

I am not a MS defender, I am trying to defend critical thought. 



 billman@centcon.com   William Rini                      
 The Syndicate  http://www.centcon.com/~billman/syn.html 
                                                         
 PGP Fingerprint                                         
 9F FB EA C8 F6 46 29 45 A8 C3 7F B9 F8 E4 BD 70         
 Finger for public key                                   

Marcus Bonse (bonse@dutw215.wbmt.tudelft.nl) wrote:
: In <406607$81k@news1.deltanet.com>, aa-2@deltanet.com@deltanet.com writes:
: >Maybe Motorola isn't concerned with the possibility of Microsoft penetrating
: >their corporate secrets.  Maybe their security types are concerned that someone
: >at Microsoft will be comparing the number and type of software reported by
: >the Registration Wizards with the software purchases actually made by
: >Motorola, looking for unauthorized copies.  Maybe Motorola is afraid of getting
: >a nice big bill from Microsoft for all those unauthorized copies...
: >
: >Of course, I could be wrong...

: Or maybe Motorola does not like it that M$ could find out what kind of projects they
: are working on by looking a their software and even their disks (filenames etc.). Maybe
: this gives M$ the opportunity for some nice industrial espionage?

My opinion on why Moto have pulled Win95 is that their corporate
security dept suddenly realised that Win95 comes with the MSN and that
they were suddenly acquiring lots of internet access points into
their machines which were not being controlled/monitored etc.

I would assume that Moto probably have the same security considerations
as we (SGS-THOMSON) do and external connections to internet is a real
area of concern - part of the corporate security policy here is that
*no* "internal" machine is accessible from the outside world (via 
internet or otherwise) and all our external connections route through
a small number of firewall machines.

Whether or not Win9x or MSN actually sends any info the fact that it
is giving an internet connection from inside the "internal" network
is almost certainly sufficient to get it banned from installation.

I would expect that MS will probably have to produce a special version
of win9x which omits MSN for many corporate accounts!


--
--------------------------------------------------------------------------
                               david shepherd
 SGS-THOMSON Microelectronics Ltd, 1000 aztec west, bristol bs12 4sq, u.k.
        tel/fax: +44 1454 611638/617910    email: des@bristol.st.com
               www: http://www.inmos.co.uk/~des/welcome.html
       "whatever you don't want, you don't want negative advertising"

In article <406p5l$gt9@thetics.europa.com>, mbell@atheria.europa.com (Max
Bell) wrote:

> In article <4046q6$2i0o@news.gate.net>, Adam L <adaml@gate.net> wrote:
> >[ . . . ] Can you prove that America
> >Online, Prodigy, Compuserve aren't sucking your hard drive away bit by
> >bit with every keystroke you send over the modem?  How about netscape?
> >[ . . . ] Maybe all
> >the winsock companies are in on it, too, slowly leeching your private
> >information, then selling it on the black market... 
> 
> No, one cannot be sure that any of the major online services, especially
> those that use proprietary clients, like AOL and Prodigy, are not taking
> advantage of their access to your files.  You will never know for sure.  The
> same could be true of Netscape, though since it uses open protocols such
> action would be much more easily detected.

This seems correct.

> >Give me a break.  It's not as if this was a 'hidden' feature of MSN...
> 
> Give ME a break.  The fact that the MSN installation procedure transmitted
> details of the user's files back to Microsoft was not commonly known before
> someone outside Microsoft discovered it.  You can be sure Microsoft was not in
> any hurry for users to fully understand the meaning to the question.  The
> exact content of these transmissions has yet to be actually documented any-
> where that I know of and reports vary from poster to poster.  Since Windows/95
> was in beta when this issue was revealed, Microsoft could easily have changed
> the probe in post-discovery releases.  Only Microsoft knows for sure.

Correct again.

I think the difference between Netscape possibly getting information off
my system and MS getting information off my system is that I have never
questioned that AOL, Prodigy, Netscape, Apple, IBM, NCSA, etc. had any
interest in my system other than the one which they advertised. There
aren't too many people out there that haven't been bitten by MS at one
time or another. How many people get regular faxes from MS after they've
disclosed their fax number in a registration process? How many people get
faxes from Apple, IBM, etc. after providing the same information? 

The point is that MS is clearly aggressive with the information it
collects - I can't think of another company that I trust to transmit data
that has anywhere close to the level of aggression that MS puts forth. If
IBM puts me on a mailing list, I trust them to remove me when I ask. MS
doesn't offer me that service. If Apple asks me to register something, I
can disclose that I don't want my info sold to other companies, and they
seem to adhere to that quite nicely, MS does not offer me that.

It's a simple matter of trust, whether you call me paranoid or not, the
fact of the matter is that I, and a lot of other people, don't trust MS.
We are allowed to not trust MS and to complain when they invade our space
without our full concent. The fact that MS didn't disclose that info was
being sent certainly justifies that lack of trust.

-- 
Bob Cassidy
UC Irvine

Giolla Decair (giolla@maghmell.demon.co.uk) wrote:
: >I don't think MS is suicidal.

: It wouldn't be suicidal remember this is the company that "forced"
: computer manufacturers/suppliers to install thier DOS by charging them
: for each machine regardless of what DOS was used. 

But end users have to be agreeable or at least indifferent to
pre-installing DOS/Windows or Win95. If the end users feel they are being
spyed upon they would object, with enough objections a different OS might
become pre-installed. Hardware manufacturers are in the business of 
making customers happy, not Microsoft. Microsoft can only make deals with 
manufacturers if most customers have an interest in Microsoft.

Tony

-- 
------------------
Tony Tribelli
adtribelli@acm.org

>BTW, Winfax does the same thing.
>
>Brandon
>Soleil@utxvms.cc.utexas.edu
>

I printed my WinFax registration and put "white-out" on the bar code 
which the program placed at the bottom of the "registration" document.  
Of course this bar code existed even though I requested that NO 
information regarding my system be placed on the registration document.

HMMMMM

TWorks Syspro

Didn't Prodigy try this once and got in heap big trouble?

In <adtDCuMxJ.8yq@netcom.com>, adt@netcom.com (Anthony D. Tribelli) writes:
>[delete]
>    Other who have used the wizard will say it is not required, do not
>    use it if you are concerned.

This wis not the issue. The question is if *ONE* person in the company
says yes, does the Wizard access everybody else's Computer's via the
network they are on? If it is at all possible, it doesn't matter if MS will
or will not use it to violate the Network's security. The issue is that it
CAN be done, and the company has to worry about some hacker finding
a way to utilize this hole. Of course that Hacker just might be named
Bill...


>Tony
>
>-- 
>------------------
>Tony Tribelli
>adtribelli@acm.org

But the reality of the situation is that any program that makes an
outside connection can be accused of the same thing, the only
difference is there is no evidence that any other company has ever
tried it.....ooooppps I forgot, there isn't even any evidence that MS
has ever tried it either.  But because some people are sooooooo
paranoid that MS might collect some information about them, they go
off on wild joyrides with the truth and completely ignore facts (the
facts of course are that several publications have verified that the
only info being sent is the info the RW asks if it can send).






danielrg@smartlink.net wrote:

>This wis not the issue. The question is if *ONE* person in the company
>says yes, does the Wizard access everybody else's Computer's via the
>network they are on? If it is at all possible, it doesn't matter if MS will
>or will not use it to violate the Network's security. The issue is that it
>CAN be done, and the company has to worry about some hacker finding
>a way to utilize this hole. Of course that Hacker just might be named
>Bill...



 billman@centcon.com   William Rini                      
 The Syndicate  http://www.centcon.com/~billman/syn.html 
                                                         
 PGP Fingerprint                                         
 9F FB EA C8 F6 46 29 45 A8 C3 7F B9 F8 E4 BD 70         
 Finger for public key                                   

I am open to considering the possibilities, but I have not seen one
shred of evidence that supports on the conspiracy theories being
thrown around this thread.  Here are the facts my friend.

1.  Inter@ctive Week put a sniffer on the line and collected the data
transmitted.  Nothing out of the ordinary was transmitted during the
online registration.  This point is avoided by every single one of the
MS bashers.  And I am sure someone will cut up this post, omit this
part and continue with wild ramblings about MS and invasions of
privacy.

2.  Not one source of information given in the original post could be
verified.  Not one MOT employee was quoted, no particulars as to
anything or anybody are given.  But of course we should all just
believe anybody who claims that something happened, no ability to
confirm facts should exist?

What I am passionate about is the fact that I require more than the
rantings of some paranoid to convince me of something.  If this was
simply an exploration at what might happen, that would be a whole
other issue.  I could think of some really scary scenarios myself.  I
mean what if Bill Gates had a program that allowed him to read out
thoughts?

The other thing is that most o the rantings are coming from hypocrites
that see nothing wrong with Netscape, WinFax, FreeAgent, Prodigy, AOL,
etc. etc. but somehow think that the only product in the world that
even has the capability to transmit information about your system is
the MS Reg Wizard.  A fact I think is absurd since the easiest way to
calm your fears is to simply not use the online registration or sign
up for the MS Network. 

I am not saying anything is "alright" as you claim.  I am saying there
is no proof to support what you are saying.  I am saying that not only
is there no proof in what you are saying, but there is  proof that
what you are saying is wrong.  Why is this so disturbing to people?
Because I ask that you at least present something to support your
position?

I have supported my position with the fact that it has been tested and
does not do what people claim it is doing.  I have not seen any
evidence to the contrary.  I am not saying I believe in MS, I am not
saying that MS would not try to gain an unfair advantage (in fact I am
sure they would love to), what I am saying is that unless you can
present anything more than the rantings I have seen in this thread,
until you can refute those that have tested it and found it not the
ominious threat it is being made out to be, then anything else is just
speculation and paranoid fantasies running wild.




jjs@dostoevsky.ucr.edu (Joe Sloan) wrote:

>>I am not a MS defender, I am trying to defend critical thought. 

>If you are trying to defend critical thought, why are you so passionate
>about refusing to consider the possibilities? All I am hearing from you
>is "Don't worry folks, everything's all right", but you have not bothered
>to actually verify that, and indeed have no way to do so... 

>At most, you could say "I beleive in microsoft, or "I beleive that 
>microsoft would never try to gain unfair advantages"...

>Why not just leave it at that?

>Leave the guarantees to those who actually have the means...

>--
> Joe Sloan     jjs@engr.ucr.edu   http://dostoevsky.ucr.edu
>     Win95? No, none for me, thanks - I'm already running Linux...
> Microsoft is not the answer - Microsoft is the question; the answer is NO!

 billman@centcon.com   William Rini                      
 The Syndicate  http://www.centcon.com/~billman/syn.html 
                                                         
 PGP Fingerprint                                         
 9F FB EA C8 F6 46 29 45 A8 C3 7F B9 F8 E4 BD 70         
 Finger for public key                                   

In article <400kfm$5qj@sundog.tiac.net> Jim Williams <williams@tiac.net> writes:

>Can Microsoft prove that it is not possible, using Win95 and the Microsoft
>Network for Microsoft to upload whatever they want from your machine to 
Microsoft?  I also am beginning to wonder if it might be possible for 
Microsoft to download whatever they want from Microsoft into your machine 
without your knowledge...

Scary thought.  There's a precedent: AOL's Windows access software frequently 
pauses to download graphics and icons that "go along with" the various 
places an AOL user visits.  Over time, these accumulated icons grow to be 
quite a large file.  Also, Prodigy checks what version of software you're 
running when you connect, and downloads revised software into your machine 
without asking if it finds you need an update.  Now these are both 
well-behaved programs, and neither one is apparently interested in modifying 
your system in any way not connected with AOL or Prodigy.   Let's hope 
Microsoft is as benign.

+-----------------+-------------------+------------------------------+
|  Wayne Farmer   |  Kernersville,    |  wayne @ rbdc.rbdc.com       |
|                 |  North Carolina   |  72377.134 @ compuserve.com  |
| "a thing of beauty                  |  WayneOHere @ aol.com        |
|          is a joy forever" - Keats  |                              |
+-------------------------------------+------------------------------+
"We have arrived at the megabyte millenium, using our sophisticated
 worldwide communications system to talk dirty to strangers."
                                     - Ellen Goodman, The Boston Globe

In article <4092i1$mpl@data.interserv.net>, billman@centcon.com (William
Rini) wrote:

> But the reality of the situation is that any program that makes an
> outside connection can be accused of the same thing, the only
> difference is there is no evidence that any other company has ever
> tried it.....ooooppps I forgot, there isn't even any evidence that MS
> has ever tried it either.  But because some people are sooooooo
> paranoid that MS might collect some information about them, they go
> off on wild joyrides with the truth and completely ignore facts (the
> facts of course are that several publications have verified that the
> only info being sent is the info the RW asks if it can send).


The reason people are paranoid (and maybe rightly so) is that here we have
every component (OS, Networking software AND network) coming out of one
place - Microsoft.

I may have this wrong, but it seems to me that MSN is going to have a
single server architecture (terrorists of the world take note: this site
can be ransomed for LOTS of money). Every time you use MSN, Microsoft has
a chance to peek at your machine. I suppose the same thing is true for
CompuServ, eWorld or AOL (I don't know, just guessing). At least the
Internet is harder to spy on because of its distributed nature.

Note that they could just as easily write a MSN client for the Mac and
sneak a look at my Mac.

The thing that worries me about MSN is that it is a competition killer
(surprise, surprise!). Every PC user who upgrades gets access to MSN, so
why shell out money for an account with a different information provider?
Are Microsoft going to allow Wordperfect or Claris to publish upgrades and
sales material there? Hmmmmmm.....

BTW Take this thread where it belongs (wherever that is)

-----------------------------------------------------------------------------
Julian Russell                  julian_r@postoffice.utas.edu.au
Computer Science                http://www.cs.utas.edu.au/
University of Tasmania
(002) 202963
 'Information is not knowledge, knowledge is not wisdom, wisdom is not
  truth, truth is not beauty, beauty is not love, love is not music.
  Music is the best.'
         - Frank Zappa 1979
-----------------------------------------------------------------------------

In article <405h3k$u4k@sat.ipp-garching.mpg.de>, bds@ipp-garching.mpg.de
(Bruce Scott TOK ) wrote:

> And you can be quite sure that any available source code has been
> grepped by lots of competent C programmers for anything that might come
> to their minds... 

Yea, and the Internet Worm never happened, too. :-(
-- 
        Nevin ":-)" Liber       nevin@CS.Arizona.EDU    (520) 293-2799
                                                office: (520) 621-1815

In <adtDD0A2D.HAt@netcom.com> adt@netcom.com (Anthony D. Tribelli) writes:

>Giolla Decair (giolla@maghmell.demon.co.uk) wrote:
>: >I don't think MS is suicidal.
>
>: It wouldn't be suicidal remember this is the company that "forced"
>: computer manufacturers/suppliers to install thier DOS by charging them
>: for each machine regardless of what DOS was used. 
>
>But end users have to be agreeable or at least indifferent to
>pre-installing DOS/Windows or Win95. If the end users feel they are being
>spyed upon they would object, with enough objections a different OS might
>become pre-installed. Hardware manufacturers are in the business of 
>making customers happy, not Microsoft. Microsoft can only make deals with 
>manufacturers if most customers have an interest in Microsoft.

No problem, as long as the vendor doesn't _force_ any customer to get
a PC with preinstalled software and pay for the preinstalled software.
While this is OK for the majority of the users, it isn't for the minority
who will simply reformat the disk, because they want to use other OS than
the preinstalled one(s) on their computers.  Part of the bad name of
Microsoft is due to their "per cpu" licencing policy (now illegal),
which effectively forced you to pay for their software, whether you needed
it or not, unless you wanted to build your PC from scratch (not a 
particularly cost-effective solution, either).

Dan
--
Dan Pop
CERN, CN Division
Email: Dan.Pop@mail.cern.ch 
Mail:  CERN - PPE, Bat. 31 R-004, CH-1211 Geneve 23, Switzerland

All these people telling us, "don't worry, the user is asked permission
to transmit the data to Microsoft and if s/he says no the data are not
transmitted", are forgetting one very important point:  These days, not
only are the majority of personal computers running Windows by default
rather than choice, the majority of installations are either factory or
dealer installations.  Most of these will say "yes" when Microsoft's
Registration Wizard asks for something, because they will want to be
seen as cooperative.

The average user will not know that s/he has no privacy.

As several posters have stated, this monstrosity should not be allowed
to exist as part of an operating system.

--
Mach's gut!
Bruce Scott                                The deadliest bullshit is
Max-Planck-Institut fuer Plasmaphysik       odorless and transparent
bds@ipp-garching.mpg.de                               -- W Gibson

Previously adt@netcom.com (Anthony D. Tribelli) said:

>Giolla Decair (giolla@maghmell.demon.co.uk) wrote:
>: >I don't think MS is suicidal.
>: It wouldn't be suicidal remember this is the company that "forced"
>: computer manufacturers/suppliers to install thier DOS by charging them
>: for each machine regardless of what DOS was used. 
>But end users have to be agreeable or at least indifferent to
>pre-installing DOS/Windows or Win95. If the end users feel they are being

But a very high percentage of users ARE indifferent. Many don't even
realise that Windoze isn't an operating system. As far as many users
go windoze is pretty, and the speed etc problems are just the way
computers work.

>spyed upon they would object, with enough objections a different OS might

don't beleive it, read some of the don't bother using pgp threads that
surface from time to time on alt.security.pgp. There are a lot of
people who feel that large corporates/govt's will NEVER do anything
wrong and if they say that such and such is good for them then they'll
use it.

>become pre-installed. Hardware manufacturers are in the business of 
>making customers happy, not Microsoft. Microsoft can only make deals with 
>manufacturers if most customers have an interest in Microsoft.

Microsoft, could make thier OS a lot cheaper because they had a large
number of gauranteed sales, and there's nothing like saving money to
keep people happy.

/*BTW my home machine doesn't and never has run any M$ product and I
have the source for all the net software I'm using*/

Slainte                                                      ______ 
Giolla Deciar                                                \   _/___
"I ache for the touch of your lips Dear                       \ \/   /
 But much more the touch of your whips dear" - T lehrer        \/\  /
"If I showed you my dark side would you still hold me tonight"    \/

In article <4048mg$rkm@beyond.escape.com> stash@escape.com (Stash M.O. / Toadeater) writes:
>From: stash@escape.com (Stash M.O. / Toadeater)
>Subject: Re: Windows 95 testing halted at Motorola
>Date: 7 Aug 1995 05:35:12 GMT

>:>Is it ok if they run AOL, Compuserve, Prodigy, or any other
>:>communications program?  That modem sends info in both directions so
>:>all those scenarios people are imagining could just as easily be
>:>accomplished by any program that establishes a connection with your
>:>computer.  Hey, maybe as you are posting this your sysadmin is peeking
>:>at your files right now.  


>AOL did apparently have something like the Registration Wizard a few 
>years back, but removed this "feature" after receiving complaints.  M$ 
>will probably fight the issue for a long time, they don't like to admit 
>their mistakes.

	How is this a "Mistake". Microsoft is trying to make the registration 
process easier for you people and all you can do is bitch about stupid rumors. 
How much "important" data could they really get from this. There are easier 
ways to find out these things.

	Stephen Johnston

In article <4049v7$43r@gate.sinica.edu.tw> taob@gate.sinica.edu.tw (Brian Tao) writes:
>From: taob@gate.sinica.edu.tw (Brian Tao)
>Subject: Re: Windows 95 testing halted at Motorola
>Date: 7 Aug 1995 05:56:55 GMT



>    This is what I read:

>|    Motorola Canada Ltd. has issued a stern warning to its employees
>|    to stop testing Microsoft Corp's. new software system Windows 95.

>    I interpreted this as employees of Motorola installing and running
>pre-release versions of Windows 95 on their personal workstations at
>the company.  I don't not see any implication that this was in any way
>an official beta test cycle at Motorola.  I can't comment on
>Motorola's internal policies regarding the administration and
>maintenance of individual workstations, but LAN managers may have the
>authority to install OS's for the use of a select number of employees.
>-- 
>Brian ("Though this be madness, yet there is method in't") Tao
>taob@gate.sinica.edu.tw <-- work ........ play --> taob@io.org

	What your saying is that you don't know jack shit about th situation but 
since you think it's as good a time as any to bash Microsoft you might as well 
go ahead.  Maybe the people at Motorola were so pleased with theie betas they 
wouldn't stop using them after Motorola asked them to stop. So now they issued 
a "stern warning". Does this mean that MS is satan. I don't think those two 
lines refer to anything about a nefarious plot to overthrow the world or even 
to find out what your computer has on it.

	Stephen Johnston

In article <nevin-0908950249470001@mac-nevin.cs.arizona.edu>,
Nevin ":-]" Liber <nevin@CS.Arizona.EDU> wrote:
>In article <405h3k$u4k@sat.ipp-garching.mpg.de>, bds@ipp-garching.mpg.de
>(Bruce Scott TOK ) wrote:
>
>> And you can be quite sure that any available source code has been
>> grepped by lots of competent C programmers for anything that might come
>> to their minds... 
>
>Yea, and the Internet Worm never happened, too. :-(

If memory serves me correctly, unix hackers had a handle on the problem
within hours of it's outbreak, that being possible because of the open
nature of unix. Are you advocating "security thru obscurity"? That is a 
truly bogus (and naive) way of thinking...

Can you just imagine if this had occurred with nt?

The endless calls to ms tech support, the foot-dragging by clueless
support people, the "upgrade packages" you would have to buy from ms -

The outcome would have been different, to be sure...

--
 Joe Sloan     jjs@engr.ucr.edu   http://dostoevsky.ucr.edu
     Win95? No, none for me, thanks - I'm already running Linux...
 Microsoft is not the answer - Microsoft is the question; the answer is NO!

In article <403msr$6vk@data.interserv.net>, billman@centcon.com (William Rini) writes:

<etc.>

|> 3.  Why would Motorola just figure out what the registration wizard
|> does after a year or more of beta testing it?  It's not like it's a
|> hidden feature, it's part of the damn installation procedure.
|> 
|> 4.  Why has this same story appreared several times with the name of
|> the company changed?  Why is it whenever someone says they heard that
|> so and so wasn't going to buy Win95 because of the registration
|> wizard, they can never recall or give a specific person?

<etc.>

Perhaps someone at Motorola could tell us if the story is true.
Perhaps some of the folks who are so terribly concerned
about this problem would call Motorola and ask.
Perhaps instead this whole thread is just another childish spam.

Hmmm ... posted to:

comp.sys.powerpc
comp.terminals.tty5620
comp.os.linux.advocacy
comp.sys.mac.advocacy
comp.os.os2.advocacy
comp.sys.amiga.advocacy
comp.sys.intel
alt.2600
alt.destroy.microsoft

Yes, must be a spam.

"But daddy, it's only August!"
"Well son, it is always September somewhere on the net."

   ...  Hank

-- 

Hank Oredson @ Mentor Graphics             Library Operations
Internet     : hank_oredson@mentorg.com    "Parts 'R Us!"
Amateur Radio: W0RLI@W0RLI.OR.USA.NOAM

In article <4048mg$rkm@beyond.escape.com>, stash@escape.com (Stash M.O. /
Toadeater) wrote:

> :>Is it ok if they run AOL, Compuserve, Prodigy, or any other
> :>communications program?  That modem sends info in both directions so
> :>all those scenarios people are imagining could just as easily be
> :>accomplished by any program that establishes a connection with your
> :>computer.  Hey, maybe as you are posting this your sysadmin is peeking
> :>at your files right now.  
> 
> 
> AOL did apparently have something like the Registration Wizard a few 
> years back, but removed this "feature" after receiving complaints.  M$ 
> will probably fight the issue for a long time, they don't like to admit 
> their mistakes.

They don't make mistakes! They don't have to worry about it! All the MS
adocates will drowned any desenters!


Robert

In article <402mua$682@curly.cc.emory.edu>, sschwar@curly.cc.emory.edu
(Stephen A. Schwartz) wrote:

> William Rini (billman@centcon.com) wrote:
> : Do you feel unable to answer "No" when the registration wizard asks if
> : you would like to register online?  That's all you have to do people,
> : just answer "No"  But it sounds as if people claiming to be everything
> : from super hackers to system administrators haven't figured out how to
> : use that button.
> 
> Sorry, but it isn't OK for a company to put anything it pleases in its
> software as long as it asks you.  "Would you like to have your hard drive
> erased?"  Just press "No," for god's sake!  "Would you like to have all of
> the information in your credit report downloaded to Microsloth?"  Just
> press "No"!  The problem is that this RW has no business being there in
> the first place. 
> 
> Steve

I've worked user support, and it is a real pain in the ass to have to ask
basic questions about system configurations to complete morons.  "My
memory, that's my ROM, right?  Uhhh, '512 meg.'"

Microsoft can provide much better service to these fools if they have
their computer config and can just call it up if (and when) the fools
call.

If they're too stupid to know what type of system they're using, why do
you give a damn if microsoft knows?  At least somebody will.

Like the man said, just push "No."

 //=\   Matt Spolin
 \=//    Human Genome Sciences
  //=\    Rockville, Maryland            [standard disclaimers apply]
  \=//        
   //=\  email: Matt_Spolin@hgsi.com     
   \=//    www: http://metro.turnpike.net/A/automatt/index.html

In article <4094f0$nhf@data.interserv.net>,
William Rini <billman@centcon.com> wrote:
>I am open to considering the possibilities, but I have not seen one
>shred of evidence that supports on the conspiracy theories being
>thrown around this thread.  Here are the facts my friend.
>
>1.  Inter@ctive Week put a sniffer on the line and collected the data
>transmitted.  Nothing out of the ordinary was transmitted during the
>online registration.  This point is avoided by every single one of the
>MS bashers.  And I am sure someone will cut up this post, omit this
>part and continue with wild ramblings about MS and invasions of
>privacy.

They were probably only looking at clear text, and didn't keep checking to
see if the information was ever transmitted later on.  They could have       
encoded the information.  Don't tell me that Inter@ctive understood
exactly what *every* bit sent across the link was.  It's possible to
encode arbitrary data using completely unrelated normal-looking text.     
Just off the top of my head, they could take 100 pieces of legitimate
information and encode about 525 bits of illegitimate information just in
the order that they send the 100 pieces of legitimate information.  Now
imagine that those were 525 yes/no questions that Microsoft wanted the
answers to, or 20 yes/no questions and 10 numbers from 1-100.  And that's
encoded in just a few seconds worth of data.  Now imagine that they
encode a few bits with every single line you type or mouse click or
whatever.

There are so many ways to encode information they would want to send
without your knowledge that you would *never* find it even with a sniffer.
I'm not saying that they are really doing this, but if they were going to 
do that, you don't think they'd be stupid enough to put the unauthorized 
data in there as clear text right along with the stuff you said it was OK 
to send, do you?  Thus this little primitive packet-sniffing "proof" that 
they aren't doing anything is worthless.

--
Steve Kanefsky

Joe Sloan (jjs@dostoevsky.ucr.edu) wrote:
: Nevin ":-]" Liber <nevin@CS.Arizona.EDU> wrote:

: >Yea, and the Internet Worm never happened, too. :-(

: If memory serves me correctly, unix hackers had a handle on the problem
: within hours of it's outbreak, that being possible because of the open
: nature of unix. Are you advocating "security thru obscurity"? That is a 
: truly bogus (and naive) way of thinking...

Don't forget that the "open nature of unix" is what makes it so 
vulnerable to hacking by exploiting bugs.

You might also remember that the Worm took advantage of a *known* bug in 
sendmail, and that the systems that got hit by the Worm were the ones 
that hadn't addressed the problem... Makes you wonder just how many 
machines have been patched to fix sendmail.  I know that as of six months 
after the Worm, someone did an informal poll and found that over ten 
percent of the unix admins had fixed the sendmail bug on their machines.

"Computer Security" seems to be an oxymoron in the modern world.  The 
only way to get a really secure computer is to encrypt the hard drive, 
password-protect the machine in hardware, turn it off, unplug it, lock it 
in a closet, and burn down the building... and there's *still* no 
guarantees. 
-- 

Chad Irby           /    My greatest fear: that future generations will,
cirby@gate.net     /      for some reason, refer to me as an "optimist."

Giolla Decair (giolla@maghmell.demon.co.uk) wrote:
: >... Hardware manufacturers are in the business of 
: >making customers happy, not Microsoft. Microsoft can only make deals with 
: >manufacturers if most customers have an interest in Microsoft.

: Microsoft, could make thier OS a lot cheaper because they had a large
: number of gauranteed sales, and there's nothing like saving money to
: keep people happy.

My point is that saving money is a secondary concern when it becomes
publically know that the OS is spying on users. I think users would pay
extra to get a different OS if they had to.

Tony
-- 
------------------
Tony Tribelli
adtribelli@acm.org

kanefsky@datamagic.com (Steve Kanefsky) wrote:
>Thus this little primitive packet-sniffing "proof" that 
>they aren't doing anything is worthless.

Only as "worthless" as the speculation that they are doing something.






 billman@centcon.com   William Rini                      
 The Syndicate  http://www.centcon.com/~billman/syn.html 
                                                         
 PGP Fingerprint                                         
 9F FB EA C8 F6 46 29 45 A8 C3 7F B9 F8 E4 BD 70         
 Finger for public key                                   

julian_r@postoffice.utas.edu.au (Julian Russell) wrote:

>The thing that worries me about MSN is that it is a competition killer
>(surprise, surprise!). Every PC user who upgrades gets access to MSN, so
>why shell out money for an account with a different information provider?
>Are Microsoft going to allow Wordperfect or Claris to publish upgrades and
>sales material there? Hmmmmmm.....


Actually if you took a look at their new pricing structure it is very
obvious that many people will choose to stay with their current online
providers.  So far on the MSN bulletin board, it's running about 95%
the number or people who think the new pricing structure is a total
ripoff (including myself).  Not exactly a competition killer.





 billman@centcon.com   William Rini                      
 The Syndicate  http://www.centcon.com/~billman/syn.html 
                                                         
 PGP Fingerprint                                         
 9F FB EA C8 F6 46 29 45 A8 C3 7F B9 F8 E4 BD 70         
 Finger for public key                                   

Joe Sloan (jjs@dostoevsky.ucr.edu) wrote:
: >Yea, and the Internet Worm never happened, too. :-(

: If memory serves me correctly, unix hackers had a handle on the problem
: within hours of it's outbreak, that being possible because of the open
: nature of unix...

: Can you just imagine if this had occurred with nt?

Maybe it couldn't happen with WinNT, maybe NT is more secure than UNIX? 
Maybe without source code it is harder to find the security holes?

Open systems cut both ways. Some people have suggested that the Macintosh 
ftp and web servers are more secure because they don't have all this well 
known software that people already know how to exploit.

Just some things to think about, I'm not saying WinNT and Mac are more 
secure than UNIX. I'm just wondering if they might be.

Tony
-- 
------------------
Tony Tribelli
adtribelli@acm.org

cirby@news.gate.net (Chad Irby) wrote:
>Joe Sloan (jjs@dostoevsky.ucr.edu) wrote:
>: Nevin ":-]" Liber <nevin@CS.Arizona.EDU> wrote:

>: >Yea, and the Internet Worm never happened, too. :-(

>: If memory serves me correctly, unix hackers had a handle on the problem
>: within hours of it's outbreak, that being possible because of the open

if source for finger wasn't available to anyone, there would be nothing to
know. Also Internet Worm hapenned because regular u*ix doesn't have a powerful
enough security system. If finger wasn't running as root, worm wouldn't have
been possible.

>You might also remember that the Worm took advantage of a *known* bug in 
>sendmail, 

it was finger not sendmail.

the problem was that finger had a stack based array to accept the command from
the caller. Of course the size of the array was fixed "who would call finger
with more than  X characters?". What Morris did was to compile a piece of code
and send this code as text to a finger daemon. When fingerd read the command,
it overran the stack and Morris was able to take control of the fingerd when
that function tried to return. Voila you have a process running as root on
another system. Or something like this. Pretty cute hack if you ask me. But of
course if the moronic u*ix function which gets a string had an option to limit
the size of the buffer, maybe the programmer would have passed the size of the
array. I am not sure whether there was an alternative function doing the right
thing and whether it was the idiocy of the grad student who wrote fingerd
initially. 

Of course the response to Internet Worm was to not run fingerd instead of
fixing the bug.

Can you believe that the same type of bug has been found in more recent u*ix
daemons (one http server I believe). Just this shows how undisciplined the u*ix
crowd is. 

muzo

standard disclaimer

In article <Uhb9mq9V5MoM075yn@oslonett.no> you write:
>
>I bet no-one have seen so many paranoid people since the 70's...
>"Fingerprint File" by The Rolling Stones suddenly got a new potentional
>target group.
>

And... Has the motorola CEO asked for the head of the one who
announced to the world that Motorola uses Intel-based machines?  

  I, for one, am SHOCKED and APPALLED and even DISGUSTED.

  After all, this is M-O-T-O-R-O-L-A, the maker of the 68* machines.
  What are they doing, running WINDOWS?  This news ruined my day.
  If that's not the end of the Unix culture, I do not know what is.


g-r-a-t-e-f-u-l-l-y---[   email:<fishbowl@conservatory.com>   ]---l-i-v-i-n-g

Johnson's First Law:
	When any mechanical contrivance fails, it will do so at the
most inconvenient possible time.

d-e-a-d-i-c-a-t-e-d---[ http://www.conservatory.com/~fishbowl ]-----l-i-g-h-t

In article <40b1qq$suu@galaxy.ucr.edu>, jjs@dostoevsky.ucr.edu (Joe Sloan)
wrote:

> If memory serves me correctly, unix hackers had a handle on the problem
> within hours of it's outbreak, that being possible because of the open
> nature of unix.

Having OS sources doesn't help all that much when you are trying to figure
out what an application you don't have the source code to is doing.  The
only thing that works is sitting in a debugger, examining memory, and
stepping through the code, probably in assembler (since you probably have
no symbol information).  The run time characteristics are far more useful
than the compile time characteristics.  Once you've figured out what is
going on, having source code can be useful.

> Are you advocating "security thru obscurity"?

No.  I just don't buy the argument that things are more (or less) secure
because source code is available.  The holes exploited by the Worm were in
the systems for *years*.  Although others had claimed to have found these
holes before, no one bothered to fix them.  IMHO, a lot more of the
security problems are found by people having their systems attacked and
reacting than by pouring over the source code and proacting.

> Can you just imagine if this had occurred with nt?

Microsoft would rush to get a fix out.  Since they are constantly working
on the OS, they have the talent concentrated in one place.  Unlike the
free software crowd, they do have something tangible to lose (their
market, which they do care about having) if they don't fix the problem.
-- 
        Nevin ":-)" Liber       nevin@CS.Arizona.EDU    (520) 293-2799
                                                office: (520) 621-1815

On Thu, 10 Aug 1995, Nevin :-] Liber wrote:

> Microsoft would rush to get a fix out.  Since they are constantly working
> on the OS, they have the talent concentrated in one place.  Unlike the
> free software crowd, they do have something tangible to lose (their
> market, which they do care about having) if they don't fix the problem.

But since when did M$ ever worry about fixing bugs?!  Especially design
bugs.

---
R!ch

If it ain't analogue, it ain't music.
#include <disclaimer.h>                      \\|// - ?
                                             (o o)
          /==============================oOOo=(_)=oOOo=====\
          |  Richard Teer         rich@isltd.insignia.com  |
          |  Insignia Solutions                            |
          |                           Voice: 01494 453409  |
          |                           Fax:   01494 459720  |
          \================================================/

In article <40bim6$e6f@data.interserv.net>,
William Rini <billman@centcon.com> wrote:
>kanefsky@datamagic.com (Steve Kanefsky) wrote:
>>Thus this little primitive packet-sniffing "proof" that 
>>they aren't doing anything is worthless.
>
>Only as "worthless" as the speculation that they are doing something.

True, neither one proves anything.  But it's better to assume the worst 
when it comes to computer security and then prove that it's not true than 
to assume that nothing is wrong.  My point is that I haven't seen any 
proof that it's not true, and I actually doubt it's possible to prove it.
Thus I choose to avoid Microsoft's closed system where they own the 
operating system, the applications software, the communications software, 
and the network (and if they had their way they'd be running your 
financial transactions too).  I'll stick with a more open system that's 
easier to scrutinize.


--
Steve Kanefsky

In article <40d488$16h@datamagic.com>, kanefsky@datamagic.com (Steve
Kanefsky) wrote:

> But it's better to assume the worst 
> when it comes to computer security and then prove that it's not true than 
> to assume that nothing is wrong.

Then don't put yourself on a network.  Period.

Also, don't run any code that you yourself have not personally written,
and of course this includes all the tools to build that software, and all
that hardware from the ground up, and the tools used to design the
hardware, and the hardware those tools run on, etc.  You'd better not plug
your computer into the wall, either, as someone might be sending out data
that way.  Do you have RF shielding in your computer room?  Don't leave
the room either; someone might sneak in.  Don't blink or sleep. 
Hermetically seal it, so insects can't get in and steal your data.  Etc.,
etc.

Read Ken Thompson's "Reflections on Trusting Trust" Turing award lecture,
and hopefully you'll figure out that you really are trusting a whole lot
of stuff out there, whether you explicitly acknowledge it or not.

>I'll stick with a more open system that's 
> easier to scrutinize.

The real question is:  have you bothered to scrutinize everything (from
the tools on up), or are you trusting someone else to do it?
-- 
        Nevin ":-)" Liber       nevin@CS.Arizona.EDU    (520) 293-2799
                                                office: (520) 621-1815

In article
<Pine.OSF.3.91.950810150625.11404C-100000@blackdeath.isltd.insignia.com>,
R!ch <rich@isltd.insignia.com> wrote:

> > Microsoft would rush to get a fix out.  Since they are constantly working
> > on the OS, they have the talent concentrated in one place.  Unlike the
> > free software crowd, they do have something tangible to lose (their
> > market, which they do care about having) if they don't fix the problem.

> But since when did M$ ever worry about fixing bugs?!  Especially design
> bugs.

They have yet to have a problem which would stop most people from using
their product.  When enough large companies say that they won't use the
product because it is a security risk, I'm willing to lay odds that
Microsoft will fix it.  With the exception of security bugs and data /
filesystem corrupting bugs, just about everything else tends to be minor.
-- 
        Nevin ":-)" Liber       nevin@CS.Arizona.EDU    (520) 293-2799
                                                office: (520) 621-1815