Microsoft: Trust and Antitrust

Microsoft is in the news for two reasons today: the continuing saga of the antitrust cases, and Microsoft's public relations push for "trustworthy computing". A selection of links: Microsoft claims two months of code reviews and half-day seminars surpasses everything ever done by the open source community; Salon talks about the problems with a monoculture; SBC, an abusive telecom monopoly, complains about Microsoft's behavior, an abusive OS monopoly; and Microsoft responds, claiming that SBC is merely being self-serving.

Comments

Brainwashed geeks?

[Maskirovka]

"Geeks like learning new things, and when they pop out at the end of the process they're entirely brainwashed," he said.

No comment needed.

Re:Brainwashed geeks?

[Zapman]

This quote struck me as odd as well, but I got to thinking about it, and I think I see at least where he was going.

We geeks tend to be facinated by "the newest thing", and rush to try it, and then preach it's merits to anyone who will listen. I know I'm generalizing, and there are people still happily running 2.0 kernels, but look at the general trend. We don't mind using version 0.0.7b6 of products that are cool without thinking twice about it.

Once we learn something new, we tend to make great use of it. And we seem to think of little else. That's probably what he was aiming for in that quote.

And remember, he's knocking his own geeks too.

The telling statement

[SuiteSisterMary]

In a memo in January, Bill Gates, the chairman and co-founder, instructed Microsoft to shift its top priority from adding new features to ensuring that software is secure. Executives said that the memo was the most significant strategy paper from Mr. Gates since one in December 1995, "Internet Tidal Wave."

In 1995, Microsoft couldn't care less about the Internet. Gates had said, publicly and repeatedly, that he didn't think it was going anywhere. Then he realized he was wrong. Within a year, the entire product line had Internet features. Now, 7 years later, people publicly lament that Microsoft has virtually taken the Internet over. Microsoft's greatest strengths have always been the ability to see which way the ship is headed, and when it turns out they're going in the wrong direction, to turn on a dime. Obviously, I'll nod politely at their words, and watch their actions. But the last time they made this big a deal about something, they delivered.

Re:The telling statement

[dachshund]

Microsoft's greatest strengths have always been the ability to see which way the ship is headed, and when it turns out they're going in the wrong direction, to turn on a dime.

You're giving them a lot of credit for essentially catching onto something that was about as difficult to ignore as, say, Woodstock going on in your backyard. With the billions of dollars and expectations pouring into companies like Netscape, it would have required nothing short of a deliberate act of self-destruction for MS to ignore what was going on.

Purchasing and developing a web browser in order to compete with a company that had very publicly vowed to put you out of business and buying web services like hotmail (for embarassingly high prices) do not brilliant business strategy make. Even today IIS is not the dominant web server, despite years of aggressive marketing.

As far as I can see, all Microsoft has done is react and trade on their already tough-to-beat desktop monopoly and cash reserves like they were going out of style. With .NET, they're just doing more reacting, at least so far, by implementing what is essentially a Java lookalike and backing it up with Microsoft monopoly and marketing clout.

Re:Two months? Get real.

[Derkec]

True, but in a very real way, Microsoft has a point. The Open Source community has never really taken time to say, "ok let's stop development and everyone will go check code extremely carefully." Now, why that hasn't been done or if it isn't needed because of how well the open community works, is a wholly differant question. But MS can fairly say it has just done some the open community hasn't matched.

Personally, I think both sides have code review procedures which are legitimate. MS is bragging because the open source community can't match what it did within its own procedure. It would be like waterfall method people bragging that they got a product out the door in fewer milestones than an extreme team did. An answer to this is, "Ok, good for you but saying you are better than me is a non-sequitor."

Re:Windows XP SP1

[ansible]

And why do I need IE and Media Player on a server that's only running a database?

Step #1 of security, remove and/or disable everything to don't need to get the job done.

MSFT has been ignoring that for years, but maybe they are finally starting to learn.

Remember who we're talking about...

[InThane]

Microsoft most likely is doing code reviews OF FUTURE PRODUCTS, I.E. .NET, .NET Server, Windows XP, Office NGO, etc.

You want security? Fine, buy our subscription products.

Re:Bad Idea for Microsoft

[BurritoWarrior]

Microsoft really does brainwash their employees. I went to your site about the "myth" of open source software being more secure, and I see where you point to the Security Focus table to try and prove your point. For the *thousandth* time, that table takes into account every single application that ships with a distribution. Can we lump in all the vulnerabilities for MS Office/Outlook, MS Works, SQL Server, and Exchange into the NT/2000 group?

And even with those misleading statistics, the only distro above NT/2000 (42) is Red Hat (54).

Your lack of objectivity renders your entire article irrelevant.

Re:Key to user security...

[_Sprocket_]

Before you feel all high and mighty I think I should point out that something likely 75% of all redhat boxes are rooted in the first 24 hours.

I've seen you, and others, bandy about this type of statistic for some time. But I have not found a single reference to back it up. Can you back this statistic up with a valid reference?

Re:Key to user security...

[_Sprocket_]

Keep in mind their past history, as well. The article mentions that this latest push - Gates' latest memo - is only one of three. Take a look at those last two.

...

The first was to get Windows onto every desktop.

...

The second memo? The Internet.

One of the amazing things about Microsoft is its ability to turn on a dime. They almost missed the Internet. Then they played an amazing game of catch-up.

But that does not mean they will be able to do it every time.

There is a major difference in the nature of Microsoft's first two challenges (desktop and internet) and its current one (security). The first two were really exercises in marketing. The third is a technical challenge.

Re:Bad Idea for Microsoft

[jgerman]

Of course some people will complain about why this has taken so long while others will probably say "better late than never" but either way it should be noted that a code review/security audit on this scale is probably unprecedented in software development history.

Then again probably not, FreeBSD has had every line of code reviewed before, and if you count the fact that it has more functionality pound for pound.

Some may chime in about how Open Source is supposedly a constant large scale code review but I've previously written on the fallacy of this kind of thinking .

Oh well QE- fucking - D then, if YOU wrote on it we must be wrong. Let me clue you in, no developer, company, or whatever can prepare for every eventuality, once past a certain threshold no code can be 100% secure. There's always the possibility, that something will come along to break it. And when that thing comes, it's the OSS that gets fixed quicker, and better than any commercial offering.

Re:Key to user security...

[_Sprocket_]

Cool. Finally something that comes CLOSE to backing up these claims. Of course, its an older distro with known vulnerabilities. In comparison, the same document notes that a Win98 install was compromised in under 24hrs. Unfortunately it doesn't talk about other architectures (even though a Solaris machine is mentioned in another context).

Still, this statistic is hardly a good indication that all Linux installations "in the wild" are being compromised within X hours. And this is the claim that is constantly made, complete with bogus statistics.