Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

h30499.www3.hp.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

#11

Post by cm2187 »

Already__Taken wrote: post #6
UnoriginalGuy wrote: post #5

Earlier quoted context omitted.

Windows has a bug which was likely a design decision made in Windows 95 development (maybe earlier, Windows 3.1 had CPL applets also). Security wasn't taken as seriously in that era. While evidently their bug fix was a little hacky, I guess re-designing how Control Panel applet icons are rendered was considered too big of a change for what was essentially a security patch. Hopefully they kill classic Control Panel co…

Windows needed to kill the legacy control panel for a long time. They've put some new (worse)) front ends to it over time but once you click down to it there's some ancient non-resizable textarea to read something important in. They should rebuild it in something powershell can poke so every single windows setting can be done from the command line, slap a gui on top of that and manage it all with DSC. Much like how a…

I agree on powershell. But I am less enthusiastic about their "metro" style which look extremely oversimplified from the samples I have seen (and all full screen, which replaces the frustration of the non-resizable grey boxes with another!).

Re: Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

#12

Post by Already__Taken »

cm2187 wrote: post #11
Already__Taken wrote: post #6

Earlier quoted context omitted.

Windows needed to kill the legacy control panel for a long time. They've put some new (worse)) front ends to it over time but once you click down to it there's some ancient non-resizable textarea to read something important in. They should rebuild it in something powershell can poke so every single windows setting can be done from the command line, slap a gui on top of that and manage it all with DSC. Much like how a…

I agree on powershell. But I am less enthusiastic about their "metro" style which look extremely oversimplified from the samples I have seen (and all full screen, which replaces the frustration of the non-resizable grey boxes with another!).

UI aside I am referring to applications like the new server manager that are literally a front end to PS cmdlets.

Full screen only metro is gone as of W10 it seems. It's just a flatter art style and I think the metro stuff something else again, it's not some powershell driving layer.

Re: Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

#13

Post by cm2187 »

SirHobo wrote: post #10

Its still so surprising to me that human error is still occurring in security. Surely, companies/organisations should provide training to stop them form being insecure.

I think the problem with something like Windows is that it is too big to be secure.

Re: Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

#15

Post by yuhong »

UnoriginalGuy wrote: post #5
upofadown wrote: post #4

So Windows can run code simply by browsing to a directory with the default shell? I have no words...

Windows has a bug which was likely a design decision made in Windows 95 development (maybe earlier, Windows 3.1 had CPL applets also). Security wasn't taken as seriously in that era. While evidently their bug fix was a little hacky, I guess re-designing how Control Panel applet icons are rendered was considered too big of a change for what was essentially a security patch. Hopefully they kill classic Control Panel co…

I think it dates all the way back to Win3.0.

Re: Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix

#16

Post by yuhong »

TazeTSchnitzel wrote: post #9
UnoriginalGuy wrote: post #5

Earlier quoted context omitted.

Windows has a bug which was likely a design decision made in Windows 95 development (maybe earlier, Windows 3.1 had CPL applets also). Security wasn't taken as seriously in that era. While evidently their bug fix was a little hacky, I guess re-designing how Control Panel applet icons are rendered was considered too big of a change for what was essentially a security patch. Hopefully they kill classic Control Panel co…

It probably wasn't an intentional design decision. Storing icons in DLLs and referencing them is completely normal in Windows. I assume the error was that they somehow allowed the DLL to execute.

Look up CplApplet.
Post reply on HN