The Open Sourcerer

Is Microsoft ‘Buying-Off’ Linux Netbook Vendors? [Updated]

There seems to be something of a military campaign afoot. One that surely shows signs of desperation and anxiety on behalf of the instigator.

First we had Asus telling it’s potential customers that “It’s Better With Windows” using phraseology such as:

“Windows helps you easily get online and connect to your devices and services – without dealing with an unfamiliar environment or major compatibility issues.”

And now we hear that PC World (IMHO probably the worst place to buy a PC or get technical advice anywhere in the UK) are dropping Linux netbooks too. And why?

… because Windows makes it easier to share content, and provides customers with a simpler, more familiar computing experience on the move,

Share content huh? Does Ubuntu (or any other Linux distro of choice) work with Facebook, Twitter, Flickr, Google Apps, or anywhere else where we “share” content? Does email work? Does OpenOffice.org allow me to share stuff with those unfortunate enough to have spent hundreds of pounds on another Office suite? (Hint: The answer is Yes.)

Simpler… Hmmm, I wonder how much truth there is in this? How hard is it to install software on [say] Ubuntu vs Windows. Wander over here and take a look. (It’s pretty funny really).

familiar – Well, OK I’ll give them that. But I could make Ubuntu blue and have big child-like buttons if I really wanted to. Other than that though – what’s the big deal? I have a mouse, keyboard, screen. Yep, check. I move the mouse and click (or double click) on things and I type stuff. Yep. Check. Ahh no I’ve got it. The familiarity is with the dear old BSOD. Now I don’t get that. In fact my PC doesn’t really crash at all. It doesn’t need defragging (whatever that is), it doesn’t need disinfecting, it doesn’t require frequent re-builds because it gets so slooooooooow after a few months of use. Now I see. That’s what users want and are familiar with.

And how about all those Drivers we have to install and update and search the ‘net for? Hey? Drivers? What are they?

And how often do you update your Anti-virus software? You do have AV software don’t you? Oh of course, sorry I forgot. Nope. Viruses are not really much of an issue with a proper operating system. Take a look at the Wildlist.org (the list of “Active” computer viruses) All 451 from March this year target the Win32 API.

And how about all those strange licenses that many people don’t read, but that “protect” you from doing something illegal – like helping your neighbour perhaps?

This whole thing reminds me of the stupid and cringe-worthy adverts you see in the press where Vendor X says that they “Recommend Proprietary OS Home Premium”. Do they hell. Do you think they really believe that? Or do you think they have been given incentives to say so? I often wonder if there could be a case here with the Trades Description Act (if that still exists). IANAL so don’t really know but it seems as though many vendors’ adverts are not being totally honest when they make these recommendations. It’s bloody obvious they are being paid in some form or another to say that.

So, it seems to me that Microsoft are getting a bit fed up with all these really cool little netbooks running Ubuntu or Android or something else that isn’t Windows. They have very deep pockets and can afford to buy off some of the people some of the time. But I do not think they can afford to buy everyone all of the time and some vendors probably have a bit more integrity in the first place.

I suggest that you shop around and – even if you buy a PC with Windows for some weird reason – you go to a vendor or supplier who has not been bought off. At least you can have some level of trust in them.

Of course, you could always visit Naked Computers.org and find a vendor that will sell you a computer without an operating system at all. You can then install Ubuntu or something else on it. You almost certainly have a legal CD of XP lying around somewhere. I have several and don’t even use it anymore, so why should I be forced to buy more of their crap, unsafe, bug-ridden software?

Phew. Well. I’m glad I got that off my chest.

[UPDATE] How coincidental is this? Asus, suddenly pull their Android netbook and can’t really say anything about it…

A day after an Asus Eee PC running Google’s Android operating system was shown at Computex Taipei, top executives from the company said the project will be put on the backburner. …

… “Frankly speaking, the first question, I would like to apologise that, if you look at Asus booth we’ve decided not to display this product,” he said. “I think you may have seen the devices on Qualcomm’s booth but actually, I think this is a company decision so far we would not like to show this device. That’s what I can tell you so far. I would like to apologise for that.”

He declined further comment on the subject.

Yeah right. Of course he did.

OOXML: Nobody knows (or cares) what it is for or why.

I’ve not penned much on OOXML for quite a while mainly because there really doesn’t seem to be much interest in it outside of a small circle of Microsoft lackeys and puppy dogs. Even MS themselves are making more noise about implementing native ODF support with the just-released SP2 for Office 2007.

Anyway – two blog posts crept on my radar today that are worthy of mention and the cause for my writing at all.

This one from the ever vigilant and articulate Glyn Moody about how no-one seems to be that interested in OOXML any more and some possible reasoning behind the apparent apathy.

The other quite literally had me in hysterics (ROTFL). It’s not the post so much as the comments attached to it. Apparently those few who remain interested in OOXML enjoy nothing more than discussing between themselves what OOXML is for and how various versions of the notorious specification should be augmented/updated or even simply maintained.

The debate is on such things as should the “Transitional” format be forward or backward looking and if the later then it shouldn’t be Transitional but Strict. Hmmm – yes I hear you say gripping stuff. Here’s a snippet from one of the comments just to whet your appetite:

So, ECMA-376 (1ed) is “looking back”, but ISO-29500 Transitional is not simply “looking back”: it is a “mutant”, that is both looking backward and looking forward. ISO 29500 Strict is indeed “looking forward”.

For those readers who “have a life” and missed all the excitement of 2007/8 a brief synopsis of the history goes something like this:

Microsoft implemented OOXML (their XML based file format which is essentially a binary dump of the memory footprint of your document wrapped in an amazingly obscure and illegible XML schema) in Office 2007. You may have even received the odd file with a .docx or .xlsx extension. Then some kind of panic happened in MS and they decided that because Governments and other public bodies were asking for ODF (ISO/IEC 26300 Open Document Format supported by many applications including OpenOffice.org) they’d better get OOXML standardised too. So in a rush job, Microsoft’s specification publicist ECMA took the format used on Office 2007, got the developer documentation and wrote a bit more stuff around it and published it as ECMA 376. It then got submitted to the ISO for “fast tracking”. Oh yes, did I mention the “specification” was over 6000 pages long? Needless to say there was lots of argy bargy back and forth, the document got changed quite a bit, lots of money changed hands, loads of small countries from the developing world suddenly got very interested in XML Document Specifications and decided to become paid up members of the standards bodies and the specification scraped through about a year ago to become probably the worst example of a supposed International standard the world has ever seen (IMHO).

Do be advised also that today, as far as I am aware. there is no currently available end-user product (free or commercial) for reading and writing ISO IEC 29500 (OOXML) files. Microsoft Office 2007 doesn’t; it supports something similar to the first edition of ECMA 376 but probably not quite the same and I’m not sure anyone really cares anyway.

But do go and read the discussion on this blog post. Even if you don’t really understand it, the discussion of such irrelevant minutiae and semantics really does show to me that even those who support and think it is a useful and worthwhile specification don’t really know what it is for…

Here’s a bit more just to highlight the trouble they are all having:

Thanks for the clarification. “Transitional”, at present, is definitely looking like the superset of “Strict” the way you explained. The word “transitional”, however says to be that it is temporary. If we insist “transitional” will always be the superset, then there is no way “Transitional” will ever be a temporary thing.

Moreover, with the superset definition, it means anything that makes it into “strict” will automatically make it into “transitional”, which will make Brown’s statement that the working group is considering mirroring new features into “transitional” moot.

I will say “transitional” is the superset of “strict”, with a time limit imposed. Therefore, for a limited time only, it can be “looking forward”. What is happening is someone forgotten to specify the time limit, which leads to the discussion whether new features in “strict” should be mirrored into “transition”.

To me, it does not make sense to put new features introduced in Office 14 into “Transitional”. “Strict”? Yes, but not “transitional” since it unnecessarily extended the time frame for “transitional”.

One question still remains, how does one add new features to Transitional or Strict given the charter can be read to exclude new features introduced in future version of MS Office, including Office 14?

OOXML Fataly Flawed?

Thanks to Roy’s tenacity and constant vigilance, I have learned how it now appears the MS Office binary format that is wrapped in XML and is now known as IS 29500 (OOXML), an ISO Standard Office Document Specification (ROTFL), is giving hackers everywhere a field day.

It is now official and also confirmed that OOXML files are not just insecure but there are also persistent attacks against new flaws (without any security patches being available, i.e. zero-day).

There are some good links and sources to this article so recommended reading for anyone who is considering using Office 2007 or receives an OOXML document (the ones ending in x, e.g docx, pptx and xlsx). IMHO your automatic response should be to return it directly to the sender, do not attempt to open it, and ask for them to send it to you in an open format such as ODF or PDF or even plain text. I would also suggest that you provide a link to OpenOffice.org in the reply.

In the last few scant months, there have been several major and very serious security flaws and attack opportunities with Microsoft’s software. Surely, it must be becoming clear to everyone by now:

If the foundations are weak, the walls crumbling, the windows broken and the roof collapsing; it’s time to move.

Yet Another Microsoft Worm [Conficker] Runs Amok

According to the BBC today,

Infections of a worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is “skyrocketing”.

The malicious program, known as Conficker, Downadup, or Kido was first discovered in October 2008.

Anti-virus firm F-Secure estimates there are now 8.9m machines infected.

This is yet another major outbreak. At least the coverage of this one is pretty clear that it is just Windows PCs that are affected, but jeez, how come people are still putting up with this crap:

“Microsoft did a good job of updating people’s home computers, but the virus continues to infect business who have ignored the patch update.

“A shortage of IT staff during the holiday break didn’t help and rolling out a patch over a large number of computers isn’t easy.

“What’s more, if your users are using weak passwords – 12345, QWERTY, etc – then the virus can crack them in short order,” he added.

“But as the virus can be spread with USB memory sticks, even having the Windows patch won’t keep you safe. You need anti-virus software for that.”

Sorry. What? Microsoft did a good job patching another hole. People just don’t get it do they? It’s a bit like trying to plug the holes in a sieve using a knitting needle. You might block one, but hey, there are hundreds more holes just next door.

I love the bit about having the Windows patch is not enough. So that only protects you from network born infections? And not from other sources? Or so it would seem. Be afraid. Be very afraid…

According to Microsoft, the worm works by searching for a Windows executable file called “services.exe” and then becomes part of that code.

It then copies itself into the Windows system folder as a random file of a type known as a “dll”. It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.

I know that for most of the readers of this blog this is teaching your granny to suck eggs but please:

just try doing something like this on a proper operating system.

But of course the malware-that-masquerades-as-an-operating-system^TM isn’t so robust.

If you find it hard to convince the great unwashed why it is that “proper operating systems” don’t really get viruses, this article is quite a good, and not too technical, explanation of the main reasons.

For a Linux binary virus to infect executables, those executables must be writeable by the user activating the virus. That is not likely to be the case. Chances are, the programs are owned by root and the user is running from a non-privileged account. Further, the less experienced the user, the lower the likelihood that he actually owns any executable programs. Therefore, the users who are the least savvy about such hazards are also the ones with the least fertile home directories for viruses…

… A computer virus, like a biological virus, must have a reproduction rate that exceeds its death (eradication) rate in order to spread. Each of the above obstacles significantly reduces the reproduction rate of the Linux virus. If the reproduction rate falls below the threshold necessary to replace the existing population, the virus is doomed from the beginning — even before news reports start to raise the awareness level of potential victims.

The reason that we have not seen a real Linux virus epidemic in the wild is simply that none of the existing Linux viruses can thrive in the hostile environment that Linux provides. The Linux viruses that exist today are nothing more than technical curiosities; the reality is that there is no viable Linux virus.

Now please go and upgrade someone you love from Windows to a proper operating system.

Vietnam: Will be 100% Open Source

I know this isn’t exactly “new” news, (it’s 2 days old and has appeared on /. I understand) but to me it is really important and should be shouted from the rooftops.

VietNamNet Bridge – The Ministry of Information and Communications has issued an instruction on using open source software products at state agencies.

Accordingly, by June 30, 2009, 100% of servers of IT divisions of government agencies must be installed with open source software; 100% of staffs at these IT divisions must be trained in the use of these software products and at least 50% use them proficiently.

Get that! 100% of servers be installed with FOSS (I wonder if they will use Ubuntu?) by the middle of this year.

I mean WOW! Somebody tell Gordon will they?

The article goes on to discuss the desktop, although I guess some of the clarity has been lost in translation but:

Open source software products are OpenOffice, email software for servers of Mozilla ThunderBird, Mozilla FireFox web browser and the Vietnamese typing software Unikey.

The instruction also said that by December 31, 2009, 70% of servers of ministries’ agencies and local state agencies must be installed with the above open source software products and 70% of IT staff trained in using this software; and at least 40% able to use the software in their work.

The above agencies are requested to increase the number of documents and information exchanged among them processed by the above software. By December 31, 2010, all staff at these agencies must be able to use open source software in their jobs.

This is pretty amazing. A sovereign government, mandating the use of FOSS and open standards for document exchange too. And let’s not forget that will bring massive benefits to the Vietnamese citizen. No longer will they have to go and buy, or possibly pirate (see below about cracked software), copies of proprietary software to exchange documents. They can all happily go and use Free Software safe in the knowledge that their government will be able to accept their documents.

I’d like to see what happens if you sent Gordon a letter in ODF?

There is a final, short sentence to this news item that also made me sit up and take note:

The instruction also requests that computer traders not sell PCs installed with cracked software, but open source ones.

BANG goes the Microsoft TAX in Vietnam.

Congratulations to every one who made this happen – I dread to think how much lobbying must have gone on behind closed doors before they got to this point. Can you imagine how M$ must have reacted???

And please pass this story on. I believe this is an announcement worthy of spreading far and wide.

Here’s the URL in it’s full glory: http://english.vietnamnet.vn/tech/2009/01/822425/.

And again…

Here’s yet another story of yet another Microsoft hole being exploited. This time it’s in their SQL Server product. Seems like there are more exploits being – well – exploited than in something that’s extremely exploitable.

Microsoft is now warning users of a serious bug in its SQL Server database software, just days after patching a critical flaw in its Internet Explorer browser…

However, for me, the most telling comment of this – yet another – security hole in Microsoft’s code was the last sentence on Techworld’s article:

It was publicly disclosed on 9 December by SEC Consult Vulnerability Lab, which said it had notified Microsoft of the issue in April.

See that? M$ were informed back in April. Somehow I don’t think the FOSS community would wait that long to fix a major security hole in a very widespread product. Do you?

(Thanks to Techworld for keeping us abreast of these important news items)