NWA-PCUG Newsletter Article
President's Column
by Dale Oliver, President, March 2002
d_oliver@swbell.net
(click to email author)


NEWER = BETTER? Hmmmm...maybe we should take a closer look at this seemingly simple equation.

When it comes to PC software, many unaware users assume that the latest software release must be better than the last one they bought. After all, the last one had so many bugs and problems this release HAS to be better! Unfortunately, many have found out in the past few years that this is not necessarily the case.

Microsoft has been particularly guilty of releasing software riddled with bugs, glitches and downright flagrant security flaws that make hackers and miscreants practically squeal with delight with each new release. It seems that the "first to market" mindset has replaced the philosophy of getting it done right the first time. To add insult to injury, uninformed software users continue to unknowingly encourage this practice by latching onto the latest software versions as soon as they are available, all the while having no idea of the potential benefits and shortcomings of the latest software. Aside from what they are brought to believe by sycophantic marketing, that is. Since I wrestle software systems for a living, I am constantly amazed at how often people will "upgrade" to a new version of software simply because it is new.

Since Microsoft's software products are more and more interwoven in design and functionality, a problem in one software product can easily cause problems in another seemingly unrelated software product. Consider Internet Explorer 6, for example. Most of us are painfully aware of the security problems that have existed in past releases of Microsoft's browser and e-mail software. Yet it seems like users can hardly wait to download the latest versions as soon as they are available. My question is simply, "Why not let someone else be a guinea pig until most of the kinks get worked out?" That's my strategy. It's simple, and it works.

One of the most talked about problems in the recently released Internet Explorer 6 includes a security flaw that could be easily capitalized upon by someone with modest programming skills. Basically, Microsoft provided non-protected space in one of their registry keys that would allow Web sites other than Microsoft's to insert their domain names into the registry key and gain access to all e-mail addresses and contact information stored in Microsoft Messenger by using relatively easily written Visual Basic scripts. Worse yet, this gaping security vulnerability also allows unscrupulous sites to read information stored in cookies from any other sites you have visited. (More about cookie vulnerability can be found in a previous newsletter article located at http://pcgroup.nwark.com/pres--a1.htm). The security vulnerabilities in recent versions of Internet Explorer even allow hackers to read your personal MIME-encoded e-mails, browse HTML files on your system, direct you to a bogus Web site in order to collect personal information such as credit card numbers, execute rogue executable files on your computer without your knowledge, run malicious scripts on your computer even when you have scripting disabled, etc., etc. This is scary stuff!

Although Microsoft did eventually issue bulletin MS02-005 that addresses some of these security problems (http://www.microsoft.com/technet/security/bulletin/MS02- 005.asp) not all reported shortcomings were addressed. And there are most likely others lurking around just waiting to be found. Most users have learned the dangers of blindly downloading and running executable programs sent to them via anonymous e-mail messages. Why, then, do consumers line up to be the first to obtain commercial software that poses at least the same level of threat to their computer's safety and security?

Maybe the equation is more correctly written as: NEWER = SCARIER. Be informed and don't install software on your computer until you really know what it does!

Click here to return to top



==================================================================