Microsoft: Word 2007 crashes aren't a bug, they're a feature
-
Microsoft: Word 2007 crashes aren't a bug, they're a feature[^] Yes sir. I understand that Word crashed and you've lost all your work; but we protected you from harmful content sir, that could have, uh, deleted all ... your ... work. :doh:
:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTL -
Microsoft: Word 2007 crashes aren't a bug, they're a feature[^] Yes sir. I understand that Word crashed and you've lost all your work; but we protected you from harmful content sir, that could have, uh, deleted all ... your ... work. :doh:
:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTLWhen asked to clarify that statement, she acknowledged Microsoft won't classify the flaws as security problems. Rather, the behavior of Word 2007 is a feature, not a bug. "In fact, the behavior observed in Microsoft Word 2007 in this instance is a by-design behavior that improves security and stability by exiting Microsoft Word when it has run out of options to try and reliably display a malformed Word document," the spokeswoman said. She went on to suggest that it is no big deal if Word 2007 did crash under those circumstances, a scenario that could lead to the loss of any unsaved data. "The sample code in [Aharoni's] postings cause Microsoft Word to crash, and users can restart the application to resume normal operations." And you wonder why I was arguing that Microsoft is dead? With a spokeperson like that? :rolleyes: Marc
People are just notoriously impossible. --DavidCrow
There's NO excuse for not commenting your code. -- John Simmons / outlaw programmer
People who say that they will refactor their code later to make it "good" don't understand refactoring, nor the art and craft of programming. -- Josh Smith -
It is better to crash rather than execute malicious code.
________________________________________________ Personal Blog [ITA] - Tech Blog [ENG] - My Photos ScrewTurn Wiki 2.0.3
I've got some material for you and your new career. Ed: Bob! What the hell happened to your arm? Bob: Damned power-saw took it off! Ed: No ways! That musta hurt. Bob: Yeah but like Black & Decker say, when the blade flew off it was designed to avoid vital organs. Ed: Good feature that! The timing needs some work but there you go.
regards, Paul Watson Ireland & South Africa
Shog9 wrote:
And with that, Paul closed his browser, sipped his herbal tea, fixed the flower in his hair, and smiled brightly at the multitude of cute, furry animals flocking around the grassy hillside where he sat coding Ruby on his Mac...
-
When asked to clarify that statement, she acknowledged Microsoft won't classify the flaws as security problems. Rather, the behavior of Word 2007 is a feature, not a bug. "In fact, the behavior observed in Microsoft Word 2007 in this instance is a by-design behavior that improves security and stability by exiting Microsoft Word when it has run out of options to try and reliably display a malformed Word document," the spokeswoman said. She went on to suggest that it is no big deal if Word 2007 did crash under those circumstances, a scenario that could lead to the loss of any unsaved data. "The sample code in [Aharoni's] postings cause Microsoft Word to crash, and users can restart the application to resume normal operations." And you wonder why I was arguing that Microsoft is dead? With a spokeperson like that? :rolleyes: Marc
People are just notoriously impossible. --DavidCrow
There's NO excuse for not commenting your code. -- John Simmons / outlaw programmer
People who say that they will refactor their code later to make it "good" don't understand refactoring, nor the art and craft of programming. -- Josh SmithMarc Clifton wrote:
With a spokeperson like that?
Same guy who drew the Zune rabbits.
regards, Paul Watson Ireland & South Africa
Shog9 wrote:
And with that, Paul closed his browser, sipped his herbal tea, fixed the flower in his hair, and smiled brightly at the multitude of cute, furry animals flocking around the grassy hillside where he sat coding Ruby on his Mac...
-
When asked to clarify that statement, she acknowledged Microsoft won't classify the flaws as security problems. Rather, the behavior of Word 2007 is a feature, not a bug. "In fact, the behavior observed in Microsoft Word 2007 in this instance is a by-design behavior that improves security and stability by exiting Microsoft Word when it has run out of options to try and reliably display a malformed Word document," the spokeswoman said. She went on to suggest that it is no big deal if Word 2007 did crash under those circumstances, a scenario that could lead to the loss of any unsaved data. "The sample code in [Aharoni's] postings cause Microsoft Word to crash, and users can restart the application to resume normal operations." And you wonder why I was arguing that Microsoft is dead? With a spokeperson like that? :rolleyes: Marc
People are just notoriously impossible. --DavidCrow
There's NO excuse for not commenting your code. -- John Simmons / outlaw programmer
People who say that they will refactor their code later to make it "good" don't understand refactoring, nor the art and craft of programming. -- Josh SmithI assume she's not the User Experience Evangelist.
Deja View - the feeling that you've seen this post before.
-
It is better to crash rather than execute malicious code.
________________________________________________ Personal Blog [ITA] - Tech Blog [ENG] - My Photos ScrewTurn Wiki 2.0.3
But Dario, they are making an assumption that a malformed document contains some kind of malicious content; a malformed document being one, by their description, is a document that fails to load when "Word has run out of options to try and reliably display " the document. So, even if I have a document that, say, was on a bad CD, that now fails to read into Word ... this will cause Word to crash; and any unsaved work I have will be lost!?!? If you ask me, and I know you're not, but this sounds more like they've turned every potential 'bad' document into a malicious one instead. That's not a protection scheme I would subscribe to ... Just a thought.
:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTL -
But Dario, they are making an assumption that a malformed document contains some kind of malicious content; a malformed document being one, by their description, is a document that fails to load when "Word has run out of options to try and reliably display " the document. So, even if I have a document that, say, was on a bad CD, that now fails to read into Word ... this will cause Word to crash; and any unsaved work I have will be lost!?!? If you ask me, and I know you're not, but this sounds more like they've turned every potential 'bad' document into a malicious one instead. That's not a protection scheme I would subscribe to ... Just a thought.
:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTLGiven that years of history go to show that users won't be smart enough to respond intelligently to a prompt that says "This document appears malformed and was either corrupted or deliberately altered to hack your machine. Open file anyway? Yes/No" I really don't see any other alternative. You know, and I know, and MS knows that given that option 99% of users would always click yes and MS would be blamed for deliberately allowing every single malformed .doc exploit to run unimpeded.
-- CleaKO The sad part about this instance is that none of the users ever said anything [about the problem]. Pete O`Hanlon Doesn't that just tell you everything you need to know about users?
-
I've got some material for you and your new career. Ed: Bob! What the hell happened to your arm? Bob: Damned power-saw took it off! Ed: No ways! That musta hurt. Bob: Yeah but like Black & Decker say, when the blade flew off it was designed to avoid vital organs. Ed: Good feature that! The timing needs some work but there you go.
regards, Paul Watson Ireland & South Africa
Shog9 wrote:
And with that, Paul closed his browser, sipped his herbal tea, fixed the flower in his hair, and smiled brightly at the multitude of cute, furry animals flocking around the grassy hillside where he sat coding Ruby on his Mac...
Flawed analogy. It's not the blade flew off itself (the software didn't crash automatically), the user did something the tool was not designed to handle (like plugging the power saw into a 1000Kv line) and instead of the power saw going haywire, it just shut down. Or did I miss the funny part?
Regards Senthil [MVP - Visual C#] _____________________________ My Blog | My Articles | My Flickr | WinMacro
-
Flawed analogy. It's not the blade flew off itself (the software didn't crash automatically), the user did something the tool was not designed to handle (like plugging the power saw into a 1000Kv line) and instead of the power saw going haywire, it just shut down. Or did I miss the funny part?
Regards Senthil [MVP - Visual C#] _____________________________ My Blog | My Articles | My Flickr | WinMacro
... if a power saw shuts down, you don't lose your wood.
We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
My first real C# project | Linkify!|FoldWithUs! | sighist -
Flawed analogy. It's not the blade flew off itself (the software didn't crash automatically), the user did something the tool was not designed to handle (like plugging the power saw into a 1000Kv line) and instead of the power saw going haywire, it just shut down. Or did I miss the funny part?
Regards Senthil [MVP - Visual C#] _____________________________ My Blog | My Articles | My Flickr | WinMacro
I didn't say it was an analogy. I said it was material for his new career in pedantic comedy, which you seem to be heading for as well. :P We could modify the material to say "blade hit a knot of wood and flew off" but seriously, the original point is that anybody trying to excuse a company for this kind of response to a flaw in their product is NUTS. BTW most power saws now have an instant-off feature. If something goes wrong they stop. The blade doesn't fly off, it doesn't ruin the block of wood and it doesn't cut peoples arms off.
regards, Paul Watson Ireland & South Africa
Shog9 wrote:
And with that, Paul closed his browser, sipped his herbal tea, fixed the flower in his hair, and smiled brightly at the multitude of cute, furry animals flocking around the grassy hillside where he sat coding Ruby on his Mac...
-
Given that years of history go to show that users won't be smart enough to respond intelligently to a prompt that says "This document appears malformed and was either corrupted or deliberately altered to hack your machine. Open file anyway? Yes/No" I really don't see any other alternative. You know, and I know, and MS knows that given that option 99% of users would always click yes and MS would be blamed for deliberately allowing every single malformed .doc exploit to run unimpeded.
-- CleaKO The sad part about this instance is that none of the users ever said anything [about the problem]. Pete O`Hanlon Doesn't that just tell you everything you need to know about users?
dan neely wrote:
I really don't see any other alternative
Don't open it and tell the user Word cannot open it. If absolutely neccesary then there can be a further button on the dialog that says "Detailed reason" for us geeks. Don't freaking crash. Come on Dan, don't defend this kind of poor application programming. It only encourages further obscenities on users.
regards, Paul Watson Ireland & South Africa
Shog9 wrote:
And with that, Paul closed his browser, sipped his herbal tea, fixed the flower in his hair, and smiled brightly at the multitude of cute, furry animals flocking around the grassy hillside where he sat coding Ruby on his Mac...
-
... if a power saw shuts down, you don't lose your wood.
We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
My first real C# project | Linkify!|FoldWithUs! | sighistYes, it would be wonderful if Word didn't crash, but as one of the guys quoted in the article said, crashing is a lesser evil than allowing malicious code to run further. The powersaw did not go up in smoke, you could atleast use it to cut other pieces of wood.
Regards Senthil [MVP - Visual C#] _____________________________ My Blog | My Articles | My Flickr | WinMacro
-
It is better to crash rather than execute malicious code.
________________________________________________ Personal Blog [ITA] - Tech Blog [ENG] - My Photos ScrewTurn Wiki 2.0.3
And it is better to show a "The document could not be loaded" error than crash. We're not talking about offering the chance to load the document. We're talking about completely rejecting the malformed document and ensuring your other documents already loaded (and potentially unsaved) are OK.
cheers, Chris Maunder
CodeProject.com : C++ MVP
-
dan neely wrote:
I really don't see any other alternative
Don't open it and tell the user Word cannot open it. If absolutely neccesary then there can be a further button on the dialog that says "Detailed reason" for us geeks. Don't freaking crash. Come on Dan, don't defend this kind of poor application programming. It only encourages further obscenities on users.
regards, Paul Watson Ireland & South Africa
Shog9 wrote:
And with that, Paul closed his browser, sipped his herbal tea, fixed the flower in his hair, and smiled brightly at the multitude of cute, furry animals flocking around the grassy hillside where he sat coding Ruby on his Mac...
"file789-1.doc - Unspecified Overflow in word 2007 - Crash in wwlib.dll . Code execution is not trivial." - that's how the guy who discovered the problem described it here[^]. My guess is that he specifically manipulated the document file to attempt to exploit security issues in the document parser and get code (possibly malicious) to execute. And as the last paragraph of the article states
"The company said it will continue to investigate, in case earlier editions of the word processor, which don't include code that purposefully crashes the app, are found to vulnerable.
Microsoft explicitly wrote code to crash the app if it detected exploitation of a security issue (like overflow). I think it is a perfectly reasonable approach.
Regards Senthil [MVP - Visual C#] _____________________________ My Blog | My Articles | My Flickr | WinMacro
-
"file789-1.doc - Unspecified Overflow in word 2007 - Crash in wwlib.dll . Code execution is not trivial." - that's how the guy who discovered the problem described it here[^]. My guess is that he specifically manipulated the document file to attempt to exploit security issues in the document parser and get code (possibly malicious) to execute. And as the last paragraph of the article states
"The company said it will continue to investigate, in case earlier editions of the word processor, which don't include code that purposefully crashes the app, are found to vulnerable.
Microsoft explicitly wrote code to crash the app if it detected exploitation of a security issue (like overflow). I think it is a perfectly reasonable approach.
Regards Senthil [MVP - Visual C#] _____________________________ My Blog | My Articles | My Flickr | WinMacro
S. Senthil Kumar wrote:
I think it is a perfectly reasonable approach.
No, it isn't. I demand more from software. Keep making space for excuses and you'll keep getting excuses.
regards, Paul Watson Ireland & South Africa
Shog9 wrote:
And with that, Paul closed his browser, sipped his herbal tea, fixed the flower in his hair, and smiled brightly at the multitude of cute, furry animals flocking around the grassy hillside where he sat coding Ruby on his Mac...
-
Microsoft: Word 2007 crashes aren't a bug, they're a feature[^] Yes sir. I understand that Word crashed and you've lost all your work; but we protected you from harmful content sir, that could have, uh, deleted all ... your ... work. :doh:
:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTLDouglas Troy wrote:
aren't a bug, they're a feature
A feature to test Crash Analysis application or webservice?:laugh:
Vasudevan Deepak Kumar Personal Homepage Tech Gossips
-
But Dario, they are making an assumption that a malformed document contains some kind of malicious content; a malformed document being one, by their description, is a document that fails to load when "Word has run out of options to try and reliably display " the document. So, even if I have a document that, say, was on a bad CD, that now fails to read into Word ... this will cause Word to crash; and any unsaved work I have will be lost!?!? If you ask me, and I know you're not, but this sounds more like they've turned every potential 'bad' document into a malicious one instead. That's not a protection scheme I would subscribe to ... Just a thought.
:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTLIf you are opening the document how could you have made changes to the document before it opened?
Matt Newman
-
But Dario, they are making an assumption that a malformed document contains some kind of malicious content; a malformed document being one, by their description, is a document that fails to load when "Word has run out of options to try and reliably display " the document. So, even if I have a document that, say, was on a bad CD, that now fails to read into Word ... this will cause Word to crash; and any unsaved work I have will be lost!?!? If you ask me, and I know you're not, but this sounds more like they've turned every potential 'bad' document into a malicious one instead. That's not a protection scheme I would subscribe to ... Just a thought.
:..::. Douglas H. Troy ::..
Bad Astronomy |VCF|wxWidgets|WTLIf you are opening the file, how can that instance of word crashing affect unsaved work. By definition if you are opening the file your work has already been saved (and malformed).
Matt Newman
-
If you are opening the file, how can that instance of word crashing affect unsaved work. By definition if you are opening the file your work has already been saved (and malformed).
Matt Newman
You can have multiple files open, no?
This statement was never false.
-
Yes, it would be wonderful if Word didn't crash, but as one of the guys quoted in the article said, crashing is a lesser evil than allowing malicious code to run further. The powersaw did not go up in smoke, you could atleast use it to cut other pieces of wood.
Regards Senthil [MVP - Visual C#] _____________________________ My Blog | My Articles | My Flickr | WinMacro
I just wanted to point out that our analogy is as flawed as the original (soory for spelling errors - I'm ethanolizeerated)
We are a big screwed up dysfunctional psychotic happy family - some more screwed up, others more happy, but everybody's psychotic joint venture definition of CP
My first real C# project | Linkify!|FoldWithUs! | sighist