|
What should MS do about leaked code (realistically
Microsoft is ensuring that the leak leads to the worst of both worlds: any potential good guys are being intimidated by Microsoft's cease-and-desist letters, while the bad guys will continue to share and find vulnerabilities in the code anyway.
Or to paraphrase the gun lobby:
"With leaked code outlawed, only outlaws will have leaked code."
At first I thought the situation with the leaked code would be similar to open source, where both the good guys and the bad guys are able to find vulnerabilities in the code.
If MS were smart, they would immediately authorize everyone to examine the leaked code, solely for the purpose of finding and immediately reporting vulnerabilities.
David B Rosen
New York
David B Rosen
Thursday, February 19, 2004
I don't think Microsoft would be too happy about the resulting torrent of bad news.
Thursday, February 19, 2004
Well.. throwing their weight about and threatening people will only keep the story news worthy longer, which will result in more downloads. I bet they know this.
Try as they might, they have a snowballs chance in hell of containing the spill, and they probably know it.
So, what are they doing? I suspect a great deal of spin doctoring is going on.
Eric Debois
Thursday, February 19, 2004
Buy back or reprice shares to keep their employees happy.
hoser
Thursday, February 19, 2004
Microsoft has thousands of top engineers developing and verifying its software. What makes you think 20 year old students are going to do anything useful?
Thursday, February 19, 2004
You know I am amazed this hasnt happened before. Any MS intern could have grabbed this, plenty of in house vendors had access and there are/were certainly a number of disgruntled developers who could have leaked the stuff. Heck it was common for devs to take their checkout harddrive home ( on an external scsi disk ) and work from home. Sure VinodV got fired, but thats hardly a deterrent right? I wonder if PR had a contingency plan for the inevitable leak. I guess they are glad the link was from a vendor.
B
Thursday, February 19, 2004
"Microsoft has thousands of top engineers developing and verifying its software."
That's why Windows ME was such a technical success.
hoser
Thursday, February 19, 2004
> Microsoft has thousands of top engineers developing and verifying its software. What makes you think 20 year old students are going to do anything useful?
To argue against this loaded question is something I don't want get into. Are Microsoft engineers top of the line? There's little doubt they are probably not the worst in the industry. Are the tools they use and the environment they work in conductive towards writing secure operating systems? According to some top administrative guys at Microsoft--they weren't. That's why they have this big loud security initiative (which, to the best of my knowledge, I have no idea whether it's working or not). Alas, it happened 2 years ago, after Microsoft Office 2000/2001/2002, Windows NT, Windows 98/ME, and Windows 2000, Visual Studio 6.0 and Visual DotNet Version 2002/2003 was developed and released. And if you look around, that's THE INSTALL BASE OUT THERE.
So if someone starts a thread like this, it's because there's real worry that most anyone interested in infiltrating your machine in the pass IS becoming better equiped than ever to do so.
Li-fan Chen
Thursday, February 19, 2004
The big thing is that MS argued in the anti-trust trials that it shouldn't be obligated to open up its source code because it would cause security problems.
So, either they were lying then, or there's some pretty poor code in the codebase.
The big thing is that, in the days before WinNT, security wasn't even on the spec sheet. People don't, by default, code for security and the C standard library makes it easy to screw up. So it's not an entirely implausable notion that a bunch of reasonably bright folks could produce a codebase riddled with potential security holes.
Flamebait Sr.
Thursday, February 19, 2004
I'll fall back on the open source thingy that knowledge is power in source code. We will hear about these various bugs that, I guess, army's of people are looking at on their own time. They will probably be given attention via virus and other security warnings. In the end, there will be a lot of lost time, but a more secure operating system. Will this be a net-positive? Yes, from the operating system's perspective. No, from the admin's perspective (which in many cases is the casual user).
MS, per their licenses, is obligated to slap everybody in the wrist who violates their agreement. The cost of doing business I guess. The alternative would be for them to willingly let people violate their license or change it. Probably not likely.
m
Thursday, February 19, 2004
This whole thing is such a non-issue, other than the media hype and Linux-zealot snickering.
Mr. Fancypants
Thursday, February 19, 2004
And the stock price.
glub glub ...
Thursday, February 19, 2004
<snicker>
glub glub ...
Thursday, February 19, 2004
The MSFT stock price is at 26.77-- it hasn't been this low since, uh, hmm, let me check -- December 2003, eight weeks ago. Hardly a precipitous decline.
I am unconcerned about the impact of a source code leak on the stock price.
Eric Lippert
Thursday, February 19, 2004
I have told this before, so if you are tired of hearing it ... well ... close your eyes.
Security coding is really hard. Why? Anything that you missed, anything that you didn't know or think of can kill you.
Cracking is far, far easier. Why? Anything that you missed, anything that you didn't know or think of is just a missed opportunity. Nothing more.
Even if the "defending" coder is 100 times better than the "attacking" coder, the defender is still disadvantaged. He has to find every last single issue to succeed. All the attacker has to find is one single "missed a spot" for success.
Nobody disagrees that giving an attacker less information, e.g. by withholding the source, is a good thing. Everybody agrees that relying on "security through obscurity" is a bad thing. Read those two last sentences again if you have to.
It is best to keep your source close to your chest, but always assuming that your enemies have full access to it.
As for the "many eyes" thing: who needs 1.000.000 monkeys on a typewriter. Just give me a handful of Shakespeares.
(also, I'd really like to know how much different the eye count really is for some OSS code vs. let's say MS or Oracle stuff. Not the "potential" eyes, but the actual pro-skilled people scrutinizing the code).
Just me (Sir to you)
Friday, February 20, 2004
It would be a non-issue of course if MS had not spent the last three years spread FUD about Open Source.
Stephen Jones
Friday, February 20, 2004
Here's what the experts say about the quality of the code: http://www.kuro5hin.org/story/2004/2/15/71552/7795.
In case you don't care to RTFA, the summary is that the new code is very good, and the old code is patch upon patch to make things work with the multitudes of possible configurations of Windows PCs. The source code comments are an interesting read and there are explicit comments about supporting various MS software and undocumented APIs (the wall the MS says seperates O/S from apps development is a myth).
I plan to fire up my WinMX and try to find it, but don't tell anybody. Here's where MS sent a C+D letters to a P2P user: http://slashdot.org/article.pl?sid=04/02/19/1919216&mode=thread
Bathmophobic skier
Friday, February 20, 2004
"there are explicit comments about supporting various MS software and undocumented APIs (the wall the MS says seperates O/S from apps development is a myth)."
Anyone reading Raymond Chen's "the old new thing" blog http://weblogs.asp.net/oldnewthing/ knows that the systems people have to go to extreme lenghts to support old programs, both MS and 3rd party, that against all warnings still used "undocumented" features.
Since MS is extremely committed to backward compatibility, they put in the extra work to keep the apps from hell running on the next releases. This keeps the customers happy, since they don't care that it is the bloody app's fault. All they care about is "either Dohickey 0.9 runs on Windows 5000 or we don't upgrade". In many cases the Dohickey enterprise long since folded or stopped supporting Dohickey, or even the Dohickey sources have been lost forever.
"undocumented" stuff is ominipresent in programming. Modern programming languages explicitely support and encourage "undocumented" coding. It is considered best practice. What else are interface, private, friend, final etc. but tools to facilitate hiding stuff? The whole OO paradigm preaches encapsulation.
But there are always the herous that think they need to bypass these intentions. Do they care it is guaranteed to fail once the underlying representation changes? No Sir!
All your "experts" seem to find is that some poor sods on the windows team have to clean up the resulting ugly mess. It says nothing, neither positive nor negative, about the soundness of the "chinese wall" IMHO.
Just me (Sir to you)
Friday, February 20, 2004
I agree with Just Me, and this ties into Joel's don't rewrite article. Sure, maybe the 'old' code sucks but it probably sucks because it has to suck to deal with everything that comes along with being overly backwards compatible and any attempt to rewrite it to be 'good' would result in the loss of all those years of ugly but needed fixes.
Mr. Fancypants
Friday, February 20, 2004
I agree completely with Just Me. I'm sick and tired of seeing posts like "why don't they just fix their code." Why don't YOU go scour through the 100 million or so lines of code written over the past 10 years and find every possible buffer overflow or security flaw. It's just not that simple.
As for the comments "proving" that the OS people made special concessions to the MS apps... I'm sorry but I just don't get that from the reading. IMO if that's your opinion after reading that stuff then you are previously biased against MS. Numerous comments mention having to do hacks for backwards compatibility of outside products. It just so happens that MS Office is one of the major products that they absolutely could not allow to break, due to its prevalence in the market.
MikeMcNertney
Friday, February 20, 2004
 Recent Topics
Fog Creek Home
| 
