Flaws threaten Microsoft

GlobalTechnology.com ^ | Friday, Nov. 7, 2003 | Associated Press

[zeugma]

Flaws threaten Microsoft

SEATTLE — Microsoft Corp.'s offer this week of cash bounties for informants who help it collar virus-writers reflects more than just an escalation of the war on those who would exploit the dominant power in software.

The campaign reveals just how much of a threat to Microsoft's bottom line security flaws now represent.

When the Blaster worm hobbled hundreds of thousands of computers around the world in August — only the latest plague to exploit a flaw in Windows operating systems — it also hurt Microsoft's ability to book new contracts with corporate customers.

For the first time, it seemed, flaws in Microsoft's software were translating into flaws in the company's business model.

"It's now starting to move from being a problem that they used to hear anecdotally to a problem they can now measure the impact of," said Michael Cherry, an analyst with Directions on Microsoft, an independent research firm.

The cost of patching up Windows computers, for instance, is diverting money from tech budgets that might otherwise have been earmarked for new software contracts, he said.

In its latest quarterly results, Microsoft said revenue from multiyear contracts dropped $768-million (U.S.) from the previous quarter. The drop in so-called "deferred revenue" — money received for contracts that will be counted toward its earnings over time — was about $450-million lower than the company anticipated.

Some of that was due to overly optimistic projections, said chief financial officer John Connors. But another reason, he said, was that Microsoft's sales people were so busy helping corporate clients shore up their networks that they could not close new deals.

Even before the Blaster attack, security was gnawing at Microsoft's stature. It had been cited among the reasons that various government agencies in the United States and abroad have become more serious about adopting alternatives such as the open-source Linux operating system.

Security, simply put, is beginning to play a larger role in decisions about what software companies buy.

Boscov's department stores are in the process of switching from Microsoft software on many of its servers to Linux-based offerings provided by IBM Corp. Harry Roberts, chief information officer for Boscov's, a regional chain based in Reading, Pa., said cost was by far the biggest reason.

But the company also had been hit hard by the Nimda worm in 2001, causing about $50,000 in staff time to repair damage to the network, he said. "We do have a bad taste in our mouth."

Analysts say Microsoft's software is targeted most by hackers and virus writers because it is so prevalent. But that's of little consolation to customers angry about the persistent security concerns.

"When enterprises have these big problems, they're very leery," said John Pescatore, vice president for Internet security at the Gartner consulting firm. That wariness could prompt companies to delay software upgrades from every third to every fourth year, for example, a threat for Microsoft. "That's what kills software companies," he said.

After the Blaster attack, Microsoft issued bulletins for another five critical flaws in versions of Windows. And it was not the only Microsoft-centric Internet plague this year. The Slammer worm severely clogged on-line traffic in January.

Mr. Pescatore likened the recent problems to the situation two years ago, when the Code Red and Nimda viruses exploited flaws in Microsoft software. The network pain produced by the twin scourges prompted Microsoft chairman Bill Gates in January 2002 to identify security as the company's top priority.

Among the recent steps Microsoft has taken to improve security is its announcement that it will have a free update to its flagship Windows XP desktop operating system next year. The improvements are to include disabling certain features that can allow hacker break-ins. The upgrade, or service pack, will also include an improved firewall.

As it adjusts, the challenge for Microsoft has been to alter its mind-set — from an emphasis on winning new customers to the need to satisfy its now-huge existing customer base, said Joe Wilcox, an analyst with Jupiter Research.

"Microsoft needs to sit back and kind of rethink how to operate in more of a maintenance market," Mr. Wilcox said. "And what that really means is that customer satisfaction has to be the number one priority."

[Bush2000]

Red Hat is changing their classic distro into a community project. It will be closer to Debian now in that it is developed by the community for the community. It will feature the more cutting edge features and be where r&d occurs. The Linux enthusiast doesn't demand production stability

One of the primary reasons why Linux has come as far as it has is because of corporate sponsorship from Red Hat, IBM, and many other companies. Without that sponsorship, the pace of "innovation" (if you can call copying innovative) is going to slow. That may be fine for cheapskates but won't cut it for many enterprises...

[lelio]

One of the primary reasons why Linux has come as far as it has is because of corporate sponsorship from Red Hat, IBM, and many other companies. Without that sponsorship, the pace of "innovation" (if you can call copying innovative) is going to slow. That may be fine for cheapskates but won't cut it for many enterprises...

And your point is? Software / service companies are shying away from investing in linux? Could of fooled me.

[Bush2000]

And your point is? Software / service companies are shying away from investing in linux? Could of fooled me.

This effectively spells the end of any hope that Linux had of becoming a desktop player.

[shadowman99]

Once again, wrong. Many of the Red Hat developers will continue on with Fedora. This is where new software will be introduced and refined. This has always been the case, but until now that project was call "rawhide". Rawhide's goals will be merged into Fedora.

Red Hat is not walking away from Fedora. They are going to cultivate the name brand "Red Hat" to be identified with the Enterprise. But that's just a marketing move. They have the most recognized name in Linux. They're going to more protective of that name now.

IBM and Novell re-committed their support to Linux this week with the announcement that Novell has purchased Suse Linux. IBM has invested $50 million dollars in this new venture. What is interesting here is that Novell is legally immune from the SCO lawsuit, and they now own a Linux distro.

The last thing you are missing is that Linux is just a kernel. A great deal of the other stuff in the distro has been developed by the GNU Herd project, Apache, MySQL, and countless independents. They aren't going away either.

If the Linux kernel died tomorrow in a courtroom there are alternatives that would be plugged in it's place. But of course, that means SCO has to prove their case in 2 separate court cases, and potentially more soon. IBM seems quite confident that no code theft has taken place - IBM is pushing 2 separate motions for discovery, and SCO has missed deadlines to deliver discovery materials. SCO is attacking the GPL as "illegal and unconstitutional" - but if by some slim chance they succeed, they still lose. SCO has distributed code under that GPL, and would suddenly be guilty of copyright infringement. The GPL was the only permission they had from scores of developers to sell code contributed to GNU/Linux.


You remind me of the Dems who underestimate Bush. They continue to lose ground in each election. Linux is here to stay. It's not trivial. There are and will be heavy hitters behind it's continued development.

[pctech]

All I can say is....

awwwwwwwwwwwwwwwwwwwwwwwwwww

[Robert_Paulson2]

as a matter of fact... yes... for three years.

[yhwhsman]

as a matter of fact... yes... for three years.

And I also, as of last night.

[Bush2000]

Once again, wrong. Many of the Red Hat developers will continue on with Fedora. This is where new software will be introduced and refined. This has always been the case, but until now that project was call "rawhide". Rawhide's goals will be merged into Fedora. Red Hat is not walking away from Fedora. They are going to cultivate the name brand "Red Hat" to be identified with the Enterprise. But that's just a marketing move. They have the most recognized name in Linux. They're going to more protective of that name now.

I suppose if you've gotta hold onto something, you might as well hold onto that delusion. Because that's what it is. RedHat is turning Fedora into precisely the same thing that Netscape turned Mozilla into: a marginalized, low-budget also-ran that few people use.

IBM and Novell re-committed their support to Linux this week with the announcement that Novell has purchased Suse Linux.

I actually give Novell a lot of credit for taking over Suse. If anybody has a chance of succeeding here, it's Novell, not Fedora. Investment dollars speak louder than lame-ass freeware promises.

The last thing you are missing is that Linux is just a kernel. A great deal of the other stuff in the distro has been developed by the GNU Herd project, Apache, MySQL, and countless independents. They aren't going away either.

So what. The thing that makes Windows pervasive is the fact that it integrates all of those elements well enough for the average person to use. Linux hasn't succeeded in that space because it's generally recognized as being immature from an integration standpoint. Fedora doesn't help its cause.

If the Linux kernel died tomorrow in a courtroom there are alternatives that would be plugged in it's place.

If SCO prevails, you guys will be relegated to selling disks on street corners. The corporate investment which got you here will dry up immediately, if that happens.

[AFreeBird]

... the pace of "innovation" (if you can call copying innovative)...

Bwhahaha... funny.

Isn't that how M$ "innovated"?

[Robert_Paulson2]

"If SCO prevails"

roflmao...

[Robert_Paulson2]

good for you.

[Bush2000]

"If SCO prevails" roflmao...

Said the wannabe lawyer...

[Liberal Classic]

If SCO prevails, you guys will be relegated to selling disks on street corners.

Even if as you say for the sake of argument SCO prevails in its suit against IBM, and IBM is forced to pay a large amount of damages to SCO and the Linux kernel is considered 'tainted' what happens? Now, I do not personally believe that this will be the outcome, and my professional opinion is that SCO's claims of ownership of NUMA, SMP, JFS, and XFS are unfounded. But for the sake of argument what if? Do you know what happens? Every body switches to BSD. Life goes on as usual.

[Nick Danger]

I see you are busily trying to re-direct the discussion here to something other than the subject of the article, which is how the flaws in Microsoft software are causing companies to abandon their products to find something better.

I understand why you might wish to re-direct a discussion away from the flaws in Microsoft software. You would surely prefer that people talk about SCO and stuff, but you know, there really are flaws in Microsoft software and that's really what this article was about. So to Hell with what you said, I insist on discussing the flaws in Microsoft software.

Did you see where the article talks about customers angry about the persistent security concerns? Can you blame them?

I think that instead of responding to your comments about linux, I'll just keep referring to the many documented flaws in Microsoft software, if for no other reason than to taunt you like a Happy Fun Ball.

[Stentor]

documented flaws in Microsoft software

Bump.

[Dimensio]

Every body switches to BSD.

Not really. If SCO prevails and is granted full ownership of Linux, then it's not a far stretch that the same lunatic judge would grant them total ownership of BSD as well.

[ezsmoke]

Please add me to your ping list, thank you.

[Liberal Classic]

I do not believe that SCO can make the same claims about BSD as it does now with Linux. I am sceptical of SCO's current claims, of course, but they have less bearing on BSD. Though BSD can run on multiprocessor computers it doesn't have files contaning the IBM copyright, which is the crux of the whole suit. If you recall the owner of UNIX (c) has settled with BSDi Unix-clone over trademark and copyright violations similar to the current case. USL/Novell vs. BSDi settled the question of whether Unix-clones have a right to exist. They do. They cannot contain copyright violations, but the current question seems to be: does IBM have the right to put files they own may be included in Linux if SCO doesn't want them to. The question is not whether Unix-clones have a right to exist. Now, SCO has hinted that is the question, claiming it fights 'unauthorized UNIX implementations' with this case, but that is just in press releases. Unauthorized UNIX implementations clearly implies BSD as well, but that's not the subject of the current case and due to a previous settlement I do not believe they can ignore precedent.

[af_vet_rr]

Don't worry, the UN wants to get involved with privacy and security on the internet, to help out companies like MS (not meant to be funny either).

[af_vet_rr]

Agreed, it will take a hit to MS's bottomline before they get really serious. These bounties are just the start, but MS is starting to feel the pressure.