MS07-010 Microsoft Malware Detection Exploit

The title is a mouthful, but I was trying to capture the irony of the problem. You know Microsoft still has not solved its core problems when they release security software that introduces security holes into the operating system it is meant to protect.

An attacker could exploit the vulnerability by constructing a specially crafted PDF File that could potentially allow remote code execution when the target computer system receives, and the Microsoft Malware Protection Engine scans, the PDF file.

They say there are no mitigating factors, which I find odd. They often say “do not read HTML-formatted text” is the mitigating factor for email flaws in Outlook. Perhaps they feel “block PDFs” is too strong a statement (stop the business?), but richly formatted email is merely a feature that can be turned off without losing content. Or maybe they do not want to upset their friends at Adobe yet there is no corporation to stand up for HTML formatted email. Interesting that the exploit apparently can escape the local user privileges and take over the complete system. Ooops.

This vulnerability, credited to Neel Mehta and Alex Wheeler, reminds me of a meeting I once had (well, dinner) with them. They are super nice guys and I found the message they sell very straightforward — don’t do dumb things like repeat simple mistakes when you write software. Quality, not quantity. That sort of stuff. It’s not rocket science, they said.

Did I mention that Vista is also affected?

Again we see that the stakes are so low in the rapid-release style of consumer software management that companies probably figure they can clean up things or tidy code later, perhaps even after it has reached millions of users. Bad for us, good for them as long as there is no backlash since the risks are captured mainly in externalities. Integer overflows on a rocket (speaking of science) may be a high profile explosive and expensive error, but my guess is that if you sum the number of incidents from an integer overflow mistake on desktop software you might come out with a similar total, just distributed. The cost accounting gets really messy when you find viruses written to spread via flaws in the antivirus tools themselves. Try to figure out the ROI on that one, Symantec.

70% of Dell Users Want Linux

I thought Dell made this commitment years ago (around the time I gave up on them for taking too long to support Linux) but I guess upper management is still not convinced and has only just realized they should have been pre-installing Linux all these years. A survey cited by the BBC shows just how far things have come:

Earlier this year, 100,000 people took part in a Dell survey. More than 70% of respondents said they would use Linux.

That is a lot of penguins!

Sad that it takes such a vast majority before Dell is comfortable announcing that they have “heard” their users. Wonder what percentage cited quality or security as their primary reason for the switch?

Speaking of ignoring reality, remember when Steve Ballmer compared open source to Communism and said Linux will never make it to the desktop? I find him to be an annoyingly ignorant fool when it comes to history and politics. Anyone that has used open source software must know that they are in the hands of not only the most brilliant minds but some of the most modest and caring hands in the world. Even Microsoft has to play catch-up by copying the ideas generated outside their halls. Vista is probably their closest attempt yet to copy Unix.

Good to hear Dell is finally trying to escape the choke-hold and embrace the free-thinking alternative to the Microsoft OS. So many years wasted, but at least Gates never succeeded in his plan to crush anyone who thought they could give something away for free. Let us not forget his ironically “open letter” from 1976, explaining the pogrom he was about to wage against American software developers that thought too openly or tried to share ideas without monetizing them:

One thing you do do is prevent good software from being written. Who can afford to do professional work for nothing? What hobbyist can put 3-man years into programming, finding all bugs, documenting his product and distribute for free? The fact is, no one besides us has invested a lot of money in hobby software. […] Most directly, the thing you do is theft.

I guess we can just say it is a good thing he only hated software “hobbyists” instead of turning his taunts towards some race or religion? And isn’t it funny how the Gates method has produced some of the worst software and most liabilities for the users while amazingly high quality software continues to grow from an open and free source. All the more reason why it is strange for Harvard to suddenly decide to give the guy a degree in their name, especially just after his philanthropy has been accused of ulterior motives:

After the LA Times reported that the Gates Foundation often invests in companies hurting the very communities Bill and Melinda want to help, the Seattle Times reported the foundation planned ‘a systematic review of its investments to determine whether it should pull its money out of companies that are doing harm to society’. Shortly after that interview, the Gates Foundation took down their public statement on this and replaced it with a significantly altered version which seems to say that investing responsibly would just be too complex for them and that they need to focus on their core mission

According to some friends in the investment community, this core mission could be to find a place their wealth can continue to grow without risk of consumer resentment, government regulation or taxes. Just like Gates’ aim to “help” the software industry, his aim to fix ailments could really just be another strategic money and power-grab that could have serious long-term negative affects (e.g. bolstering harmful business practices) on those who believe his story.

Meanwhile, back to the real world of philanthrophy:

Captain Ronnie Young of the United States Air Force says that Craigslist and Google Earth, both popular freebies, saved lives during the Hurricane Katrina disaster. “Just because it’s free, that doesn’t mean it’s not up to the task of doing great things,” Young says.

Revolutions in Poetry Taste

I found the conclusion of the story on the Grolier store not only uplifting because someone stepped in to help keep the doors open, but because the new owner clearly sees the value of a broad and diverse perspective:

“If there’s any man who knows anything about international poetry—and not just the kind that’s the flavor of the year—it’s Professor Menkiti.� The potential, she says, is huge; if Menkiti successfully harnesses his knowledge of world poetry, he could create “a revolution in taste.�

That’s some tall praise, especially from the former owner Louisa Solano who grumbles a bit about the late 1970s and how it was a time when poetry went through a “sea of change”. Wasn’t that true of America and its shift in popular culture as a whole?

“It made it quite clear that a poet has to have really good connections to get somewhere. It started getting kind of ugly, as people’s ambitions turned more toward—ambition.�

This sounds strangely familiar, like something Thomas Frank has hinted towards in his book What’s the Matter with Kansas? I mean for a minute there I was sure Solano was talking about the general conservative shift in the US, rather than something unique to poetry, and in fact she probably was. Another example of this kind of effect was in European poetry compared with American poetry in the late 1930s as I have mentioned before. It seems to me that true poets have traditionally been a canary-like indicator of the culture and times around them.

So, I suspect that when Menkiti seeks poets to fill his shelves he will be thinking in far more broad and diverse strokes of life for a much larger potential yet less-affluent audience than what the average American bookstore chain executive might have in mind. That should help him avoid trying to appease or succumb to what Solano found so ugly — the long-term effects of US popular conservatism starting in the late 1970s, or ambition for ambition’s sake. His mission seems nicely grounded.

“I have a strong sense of hope and belief that poetry can help our world,” he said. “The sense of a world together has formed a very important part of my own poetry, and I’m hoping the Grolier can organize programs to keep that spirit alive.”

[…]

It seems that poetry requires direct human contact to succeed. “In my view,” said [executive director of Poets House] Briccetti, “live readings and gatherings have become the most important means of selling poetry. There is no real marketing. You don’t see ads for poetry books.”

That’s one of the reasons Menkiti took the plunge. He is brimming with ideas for readings and events and hopes to rebuild and broaden the Grolier’s inventory, including poets from around the world in English translation, and possibly hold bilingual poetry readings.

Reminds me of the ongoing efforts of the Poetry Translation Centre at SOAS and the Poetry International Web. It shouldn’t be revolutionary to think about poetry in a global sense…