Windows 7 Bug could Kill Your MP3s Permanently

[Ichingcarpenter]

Microsoft is warning users of the new Windows 7 Beta of a flaw that can permanently impair your MP3 files, including purchased MP3 tracks. Microsoft said, “every time that metadata is edited in an MP3 file that already contains lots of metadata in the file header, some audio at the beginning of the track may be lost permanently,”

Microsoft is urging users to download a simple fix for Windows Media Center and Windows Media Player for Windows 7 to avoid compromising your music collection. Microsoft just recently uncapped downloads for Windows 7 until Jan 24 2008. You can download it here. At CES, Microsoft CEO Steve Ballmer said, “we are on track to deliver the best version of Windows ever…and working hard to get it right.” Windows 7 should hit shelves by late 2009 at the earliest, or early 2010.


http://business2press.com/2009/01/14/windows-7-flaw-could-kill-your-mp3-files/

[lapfog_1]

1. You would think that with all the resources that M$ has...

somebody would have noticed this one before the beta version was released.

sigh.

[midnight armadillo]

17. it's beta

this is why software companies DO beta releases.

[lapfog_1]

20. I've been writing software for 40 years...

Operating systems.

I know what alpha and beta releases are. This error should not be in a beta release. Period.

[boppers]

39. Hi, I'm a QA programmer.

(Side note: "QA programmer" is a strange job, basically I live to help teach programmers how to avoid typical bugs, but I don't audit only at a UI level, I audit every line of code, every cvs/svn commit, that ships.)

This looks to me like a straight up buffer management issue when unexpectedly large amounts of data are being submitted in file meta-data (which, in MP3, is part of the file).

While I agree that this shouldn't be in a Beta, it's possible that they had never accounted for, oh, modern data-hiding techniques such as storing a 2Mb encrypted document inside of an MP3's meta-data (something of a corner case), and thus, didn't test for it in their normal process.

If you take a look at the last few years of MS bugs, it's pretty clear that their whole process for testing meta-data (of all kinds of media) is broken.

Examples:
JPG bug/exploits.
WMF bug/exploits.
GIF bug/exploits.
...

All in the last 5 years. They keep issuing individual patches, but it's quite clear to me that this is not merely a "code bug". It's a "process bug", or a "culture bug", where they aren't asking themselves (on a constant basis) what would happen when any given variable or variable set suddenly has, oh, 2TB shoved into it, or when *all* variables get 2TB of data.

Basically, they seem to be running QA/test loops for alpha/beta that expect "common use", and release patches and upgrades for "uncommon use".

[trotsky]

46. I think you are correct.

That has been a very common theme among Windows bugs.

[rufus dog]

24. Vista is Beta too!

[Angleae]

19. Beta for MS is like alpha for everyone else.

[lapfog_1]

21. yeah, I know.

still, some pretty minimal internal testing (they DO have a QA group, right?) and this one would have been found.

[Angleae]

44. QA group?

Oh, the semi-trained chimpanzees. Then again, that might be an insult to chimpanzees.

[Cessna Invesco Palin]

49. It's also an insult to educated, highly-skilled QA engineers.

Yes, these actually do exist. You just have to pay for them, which is why a lot of companies try to slide along with monkeys and beta testers.

[Greyhound]

51. A lot? I'd like to know which don't anymore.

The whole industry is nothing but twenty-something tool monkeys that were never given any education, don't understand what they're doing and have no mentors because they all were fired in the 90s to suppress wages.

[Ichingcarpenter]

2. Meanwhile Today: Worm infects 2.4 Million Windows PCs in 24 hours

January 14, 2009 (Computerworld) The computer worm that exploits a months-old Windows bug has infected more than a million PCs in the past 24 hours, a security company said today.

Early Wednesday, Helsinki, Finland-based security firm F-Secure Corp. estimated that 3.5 million PCs have been compromised by the "Downadup" worm, an increase of more than 1.1 million since Tuesday.

" we still consider this to be a conservative estimate," said Sean Sullivan, a researcher at F-Secure, in an entry to the company's Security Lab blog. Yesterday, F-Secure said the worm had infected an estimated 2.4 million machines.

The worm, which several security companies have described as surging dramatically during the past few days, exploits a bug in the Windows Server service used by all supported versions of Microsoft Corp.'s operating system, including Windows 2000, XP, Vista, Server 2003 and Server 2008.

Microsoft issued an emergency patch in late October, fixing the flaw with one of its rare "out of cycle" updates.
The soaring number of infections by Downadup -- also called "Conficker" by some security companies -- prompted Microsoft to add detection for the worm to its Malicious Software Removal Tool (MSRT), the anti-malware utility that the company updates and redistributes each month to Windows machines on Patch Tuesday. The MSRT scans for known malware, then scrubs the system of any it finds.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9125941

[cliffordu]

6. Don't fear the Penguin.

Linux Rules.

Followed by OSX, of course...

LOLOLOLOLOL

[Fearless]

7. IF everyone in the world used either, the same number of flaws would be found

Minus of course the versatility.

[cliffordu]

10. Wrong on both accounts, of course, but that's alright.

Licensing hoggishness keeps any software from running on LINUX, nothing else.

All Microsoft would have to do is run LINUX behind a M$ looking interface and they'd have something solid, flexible, and they wouldn't have to worry bout the fact that NO ONE at Microsoft knows exactly what everything in the Registry does, anymore.....


There are more LINUX/UNIX based servers between you and your final destinations on the innernet than M$...maybe by multiples in the double digits.

Ask Google what they run...

[Fearless]

16. Enjoy it while it lasts. I mean that.

[cliffordu]

23. Enjoy what while it lasts?

I've been using Linux since 1995.

I'll be using it for the rest of my life.

[Greyhound]

18. You couldn't be more wrong. Every windoze OS is fundamentally flawed at it's core,

this has been known since it's inception and M$ was informed and refused to go to the trouble of redesigning to fix it so now we have 25 years of propagation of this inherently unstable and unsound architecture. It cannot be fixed, only patched and plugged.

Of course malicious software can be written for any OS, but in any well designed system the damage is isolated to the specific directory and application it entered through. Only windoze allows any and all entities unrestricted root access.

[boppers]

40. OS flawed at the core?

I disagree, but hear me out.

The NT (later XP and Vista and 7) core, that is, the kernel, is probably one of the best ever written (it's based on VMS). They did make questionable decisions about putting graphics at Ring 0 (something they can, and should, rip out now, GDI shouldn't ever cause a machine to halt), but for the most part, the *core* is not the problem.

The problem is all the crap they dumped on top of it, and how they implemented it, in such a way that the "core" looks bad because they took a solid engine and then asked it to do things.... wrong.

Perhaps a good agreement point between us is that "every windoze OS is fundamentally flawed as implemented". ....Their basic error/assumption being that a desktop computer is a single user device, not a multiple, concurrent, user device.

[Greyhound]

50. Based on, but not nearly as well implemented and VMS itself is/was not

the best design. It was pretty cool, what with the whole virtual memory thing, in it's day and is/was reasonably fast and very stable, but what M$ did with it is at least a shame and probably should be a crime.

I don't disagree with what you said and when I used the term core, I was not referring to the kernel specifically, after all this is not a tech board and this little exchange is more esoteric than 99.9% of DU can handle or is interested in, let alone a full blown geek-fest. The whole M$-OS architecture is a kludge and it shows every time they run up against competition.

We (well you anyway) are race car drivers and M$ makes mini-vans.

[boppers]

37. The same number of flaws? Nope.

You see, *nix has been getting continually improved for over 40 years.

The current Win32/64 (NT related stack) family barely have more than a decade of testing and improvement.

Big difference, there.

Windows still has the same kind of flaws that *nix fixed in the 70's.

[Belial]

8. There are just too many stupid ppl out there..

Not that I am a big fan of M$.. but damn.. first they started offering updates.. ppl didnt download them.. then they made them automatic for all the idiots that couldn't figure out how to download.. those ppl turn off the auto updates because they feel they are intrusive.. sigh

[JackRiddler]

14. Yes, the ones who allow themselves to be treated this way.

Left MS after 15 years and it's been better since!

[Fearless]

27. Hehe

[NYC_SKP]

15. Anti virus software makers must be loving it.

Sometimes, rarely, I use a PC, but since moving to mac I can't imagine going back.

[Fearless]

28. So they fixed it right? I fail to see where the problem is then. People are stupid.

It updates by itself for heaven's sake.

[Mojambo]

3. LOLOLOLOLOL. n/t

[cliffordu]

4. That's a feature, not a bug.....

:sarcasm:

[PM Martin]

5. That's why it's called "Beta".

I don't make myself a guinea pig for these things. Feel free to do so yourself, we greatly would appreciate it.

[Canuckistanian]

9. Why is an operating system invading and altering user files?

Why does it alter the metadata on MP3 files?

This has gone too far. I'm using Ubuntu on my other PC. Think I'll switch this one, too.

[cliffordu]

11. Maybe that DRM thingy went nuts before the blackmail could begin by the

companies that own the licensing on the toons.....M$ is huge on the DRM....

[greyl]

30. It happens when users choose to edit the metadata(tags). nt

[Hugabear]

12. It's time to shut Microsoft down for good.

They've done their part for the computer business, now they've just become an ever-expanding monopoly, bent on controlling every aspect of our lives. They've been sued enough times, broken enough laws, I say it's well past time to shut them down for good.

[mudesi]

13. Why would anyone store data when TESTING a BETA OS?

Only an idiot would actually have important data on his hard drive while testing an early version of an operating system.

[Poll_Blind]

22. Well, when the beta is from Microsoft- it's going to happen quite a bit.

:shrug:

PB

[Posteritatis]

33. Storing and retrieval of data is part of the testing process

Also, mp3s generally aren't "important data."

[FedUpWithIt All]

36. I brought over some copied data from another computer so i could play around with the OS.

I found and reported a small glitch where copy/paste is not working properly. Otherwise i think the system runs nicely.

[okiru109]

25. clever - the record executives are probably counting on replacement orders :P

well, sounds like they are off to a typical windows start... if they keep this up they are gonna get a bad rep.

[baldguy]

26. Win 7 will be ready

just about the time they start shipping Win 8

[shanti]

29. thank dog for macs! n/t

[busybl]

31. geez do they ever make anything right?

I'm glad they don't make medical supplies.

[CRF450]

32. I though their was an update that fixed it already recently. Windows 7 user here.

My music collection and videos have been playing fine.

On edit: This fix came out around Dec 29. Not as in today, as this blog has just reported it.

[slutticus]

34. People actually use WMP?

[CRF450]

35. Forget my last post.

I just checked the update menu and it had the fix for this problem show up earlier today. I'll go ahead, download and install it.

[TTUBatfan2008]

38. And this is why...

I bought a Macbook almost 2 years ago and I rarely use my Dell Desktop for anything. And I don't have Vista loaded on it. Vista sucks from my experience with it.

[pinniped]

41. Wow. It's a good thing they found this during beta testing.

M$ would never unleash buggy software to the general public.

I'm sure Ballsmer said this about the previous iteration of windoze.

“we are on track to deliver the best version of Windows ever…and working hard to get it right.”

[kenny blankenship]

42. Just delete MicroShit instead, permanently

[Leftest]

43. Thanks, but I use iTunes

;)

[acmavm]

45. Gotta give MS kudos for consistency. They've consistently released

flawed and defective products since its inception. And raked in profits on it all. Amazing.

[BlooInBloo]

47. hahahha! Ooopsy.

[Cessna Invesco Palin]

48. Why is Windows 7 fiddling with the metadata in the first place?

This is an extremely dangerous thing to do unless the user is specifically intending to modify the data themselves.

Also, what sort of half-assed quality assurance team lets something like this slip by? Having worked for several years on MP3 players, this is a ridiculous oversight. MP3s and the associated metadata are almost like snowflakes - no two are alike. Hell, when I was doing QA on MP3 players I had a suite of files from just about every encoder in history to check for exactly this sort of problem.

End rant.