Some thoughts about Windows Server 2008

MSDN Blog Postings » Some thoughts about Windows Server 2008

MSDN Blog Postings » Some thoughts about Windows Server 2008 — Wed, 05 Mar 2008 07:46:49 GMT

PingBack from http://msdnrss.thecoderblogs.com/2008/03/05/some-thoughts-about-windows-server-2008/

Securitate in Windows Server 2008

Weblogul lui Zoli — Wed, 05 Mar 2008 12:36:56 GMT

Când am lansat Windows Vista și Office 2007 în decembrie 2006 , am amintit că dacă m-ar întreba cineva

re: Some thoughts about Windows Server 2008

Mark Sowul — Wed, 05 Mar 2008 16:03:03 GMT

I've mentioned this before elsewhere, but very rarely, if ever, do security bulletins mention the impact of DEP as a mitigating factor for those who have it set to OptOut (the only problem app I have is a plugin for Outlook, which means Outlook has it disabled). For example, the infamous WMF exploit from a few years ago was blocked by DEP but that was never mentioned.

re: Some thoughts about Windows Server 2008

michael_HOWARD — Wed, 05 Mar 2008 19:49:30 GMT

Mark, you should read a blog post that touches on this subject http://blogs.msdn.com/michael_howard/archive/2007/03/08/how-i-will-judge-windows-vista-security.aspx

re: Some thoughts about Windows Server 2008

NicoAtMicrosoft — Wed, 05 Mar 2008 21:25:06 GMT

There's still a chance to attend one of the launch events in various cities, too! The LA Event was fun, and Steve Ballmer's keynote was particularly nice to watch.

**************

Nico del Castillo

Microsoft 2008 Joint Launch Team

http://www.microsoft.com/2008jointlaunch

re: Some thoughts about Windows Server 2008

Mark Sowul — Thu, 06 Mar 2008 07:59:38 GMT

Oh, I absolutely agree with you on judging Vista not just on vulnerabilities but the defense-in-depth mentality - I am just speaking in terms of "am I susceptible to this vulnerability given that it does exist" and rarely is DEP mentioned as a mitigating factor.

What made me think of this particularly is the new Facebook/MySpace image uploader ActiveX vulnerability - I suspect the combination of IE7 in protected mode plus the fact that it runs under DEP means I would not be vulnerable to it, since it's your usual run-of-the-mill stack buffer overrun, but rarely are these kinds of things pointed out in vulnerability notices.

re: Some thoughts about Windows Server 2008

Osama Salah — Thu, 06 Mar 2008 18:58:43 GMT

"...making it the most secure version of Windows Server to date"

how can someone make such a claim if its barely being used? You can prove its secure only by failing to break it and for that it hasn't been adopted long enough.

You can only theoretically hope it is more secure because you improved your development process, but that's speculative again. Maybe the SDL implementation at MS is flawed, etc.

so be careful with such statements.

In all cases I do sincerely hope that Windows 2008 will offer superior security.

re: Some thoughts about Windows Server 2008

michael_HOWARD — Fri, 07 Mar 2008 06:02:14 GMT

Osama. by looking at new security bugs that get reported to us, and noticing that they don't affect the product!

re: Some thoughts about Windows Server 2008

Osama Salah — Fri, 07 Mar 2008 09:44:43 GMT

that makes sense to see a trend there and make such a prognosis.

In all cases I do expect a new product to be more secure than a previous one, the benchmark would be the incremental improvement achieved and judging from the new features and architectural improvements it is very promising. It will of course have a few security problems that will affect it, but such is life. Besides you need something for Windows 2010 ;-)

rgds

Osama Salah

re: Some thoughts about Windows Server 2008

Alistair Railton — Sat, 15 Mar 2008 04:03:51 GMT

Yes Micheal it is a fine looking product. And I haven't bumped into your name for at least 20 years !!! Damn you must be old now :p

I was suprised to see how easy it blue screened when remote administration is used. This is easy to rectify by not using vista themes on the server, however it does trigger a thought or two.

If you want more information on the blue screen problem then yell out, but it seems to only happen if the aero theme is turned on, the administrator is logged into the server console and a rdp connect is performed by the administrator.

re: Some thoughts about Windows Server 2008

michael_HOWARD — Mon, 17 Mar 2008 08:33:36 GMT

Bloody Hell, Railton!! How're you? Email me your contact info. You can send it by selecting This Blog --> Email at the top right of the blog.