SharePoint External Collaboration Toolkit moved to Codeplex

rhalbh — Wed, 14 Oct 2009 11:20:59 GMT

Quite a while ago I blogged about the SharePoint External Collaboration Toolkit. I just wanted to make you aware that this toolkit is now moved to Codeplex and can be found here: http://cks.codeplex.com/

Roger

Google Chrome and Silent Patching

rhalbh — Mon, 11 May 2009 04:58:49 GMT

This morning I opened one of the Swiss Sunday newspapers and Google Chrome made it to the front-page with a “best practice approach” for deploying security updates. In the article itself it was claimed that Chrome is one of the best browsers with regards to security as the deploy patches silently, without letting the user know, even if Chrome is not running and there is no way to disable this. Here are some of similar stories:

Give me a break here.

I am really tired of hearing those things. When Chrome shipped, three things actually hit my inbox:

Chrome was shipped (in a Beta) with a few pretty significant vulnerabilities in, which were known for quite a while (like the carpet bombing flaw). The excuse by Google was “it is just a beta”. Tell me please, how you would comment if we would have done the same with Windows 7.
I got quite some mails by angry customers and journalists telling me that Chrome found a way around User Account Control as Chrome installs without UAC kicking in. Journalists called as they claimed to have found “a severe vulnerability”, customers called as they were angry with us as Chrome simply popped up all over the place in their network even though their user were non-admin. Well, well, Chrome simply installs an executable in the user context. Directories which the user has write permissions. So, for sure Chrome can install – really bad practice in my opinion.
There was a pretty strange paragraph in the EULA which was then removed later.

And now the silent patching. A few years back, when we designed Windows XP SP2 we talked about switching Automatic Updates on by default. This caused a lot of people screaming and telling us that it is unacceptable to switch AU on by default (which we actually do in the meantime). We recently updated the Windows Update client – and it caused a lot of you to scream and tell us that it is unacceptable for us to silently update a component on Windows. And we heard you loud and clear. And now I hear that Chrome is best practice because they silently fix security vulns? And you cannot even switch this off? So, what is the policy the industry shall follow?

I agree that the most secure way for consumers would be to automatically fix security vulns. This is actually what I tell my parents: Simply install security updates. This is for consumers and there is an option. Not having an option is unacceptable – at least for me. Additionally, again for the consumer, having Anti-Malware being part of the Operating System out of the box and enable by default would be desirable. However, this is not acceptable today for competition reasons.

So, what I do not get is why people do not look at these problems holistically and more from a policy perspective rather than from a company by company perspective. Silently installing components without even giving me the option to choose is not acceptable today for me – but I want to have the option to do it if I want.

And finally: I would question the enterprise-readiness of such software. At least, I would never deploy it in an enterprise environment.

Roger

Mozilla Patches Fastest. NOT!

rhalbh — Mon, 09 Mar 2009 12:08:58 GMT

I only believe the statistics I forged myself

So, once more, there is a debate on which browser is the most secure, who fixed which vulnerabilities how fast. The Secunia Report 2008 was just published and it seems that this injects once more the fire about browser security.

Out Jeff Jones just posted at CIO.com his view on the statistics. If you like looking into figures, there you go: Mozilla Patches Fastest. NOT!

Roger

Converter from Office Binary files to OpenXML

rhalbh — Sun, 17 Feb 2008 17:59:23 GMT

We are supporting a project on SourceForge to write an OpenSource translator for Office Binary files (doc, xls, ppt) to the OpenXML specification. See the initialization here.

Roger

Roger's Security Blog : OpenSource

SharePoint External Collaboration Toolkit moved to Codeplex

Google Chrome and Silent Patching

Mozilla Patches Fastest. NOT!

Converter from Office Binary files to OpenXML