The Register®

Biting the hand that feeds IT

Comments on: Microsoft releases security tool for Office 2003

Too little too late 

Posted Tuesday 22nd May 2007 22:55 GMT

Now the question is, why in the hell did they allow for executable content in their file formats in the first place?

Also, what does it mean: "or the tool will crash". I suppose we are to assume that it will crash in a way that is not a potentially dangerous buffer overflow?

Security tools crashing does not bread confidence.

I am amazed! 

Posted Wednesday 23rd May 2007 04:12 GMT

I had to read that twice :

"During the conversion of an unsafe file, MOICE will fail to convert the file, create a safe version of the file, or the converter itself will crash ," ....

"The mere process of conversion and achieving one of three possible outcomes is what protects customers."

So, if I write an app that 'achieves' the outcome of crashing, that protects the user of my app? Or is it the fact that the app 'achieves' one of three defined states that protects the user?

I've written lots of apps that crash so maybe I can present myself as a safety critical software programmer.

Macros 

Posted Wednesday 23rd May 2007 06:22 GMT

If I understand correctly, they're stripping out ALL the macros and VBScript, good or bad.

If so, how do you preserve beneficial macros?

One of the standard points made by M$ whenever someone wants to rip out Office and replace it with e.g. StarOffice, is that all that company's wonderful corporate macros will have to be re-written.

If their new official position is that macros are more trouble than they're worth, then they've shot down one of their own selling points!

The next step 

Posted Wednesday 23rd May 2007 08:07 GMT

I'm now eagerly awaiting for the inevitable patch that corrects a vulnerability in the MOICE tool. Either that, or the revelation that a virus has been found in the wild that takes advantage of MOICE crashing to insert itself into the code.

After all, it wouldn't be realistic to suppose that they've managed to program a simple tool without another buffer overflow vulnerability, now would it ?

Wonderful... 

Posted Wednesday 23rd May 2007 10:49 GMT

... so now I can expect about a zillion spam e-mails with MOICE.exe attached, ready for me to run, or even (gasp!) a helpful link to MOICE.exe somewhere on the Internet, also ready for me to run to "secure" my system...?

I will file details of this helpful new software tool under "Useful", next to "Phlogiston meters" and "Fireguards (chocolate)"...

:-(

Unstable by design 

Posted Wednesday 23rd May 2007 11:38 GMT

"...or the converter itself will crash...",

Oh yeah, give it to me baby, now I really have heard it all and can die happy. MS finally 'fesses up to what the rest of the world new for years. Nurse ! Nurse ! I need resuss

Oh look 

Posted Wednesday 23rd May 2007 12:36 GMT

A tool which takes you office documents and converts them to a format unreadable with older versions ! So no pressure then to stop using old versions (ie to stop NOT paying more money to Microsoft).

Link to wrong download? 

Posted Wednesday 23rd May 2007 14:08 GMT

I was going to have a look see, but the link you provided goes to a "Microsoft Office Compatibility Pack" - which I don't think is what you intended.

Quick searches for MOICE and the acronym spelled out didn't turn anything up

Am I missing something?

Don’t Miss

Warning: roadworksNetbooks and Mini-Laptops

Buyer's Guide They're little and we love 'em. But which ones are best?

SSL covers security embarrassments with EV figleaf

Whitepaper Helping you know scammers from Adam

Emails show journalist rigged Wikipedia's naked shorts

Overstock's Byrne vindicated amidst economic meltdown

Warning StopYours truly, angry mob

Book extract Bringing Nothing To The Party: Cleaning up the net, one satirical vigilante page at a time