Slashdot Mirror
MS Cites National Security to Justify Closed Source
guacamolefoo writes: "It was recently reported in eWeek that "A senior Microsoft Corp. executive told a federal court last week that sharing information with competitors could damage national security and even threaten the U.S. war effort in Afghanistan. He later acknowledged that some Microsoft code was so flawed it could not be safely disclosed."
(Emphasis added.) The follow up from Microsoft is even better: As a result of the flaws, Microsoft has asked the court to allow a "national security" carve-out from the requirement that any code or API's be made public. Microsoft has therefore taken the position that their code is so bad that it must kept secret to keep people from being killed by it. Windows - the Pinto of the 21st century."
When in doubt, raise concerns about terrorism, or inappropriately use 9/11 as a crutch. The new coin of Washington (both east and west it seems).
Nothing will ever be the same again indeed.
Worrying isn't it?
If the code is so bad as to be dangerous, shouldn't the government make them recall the code and return a properly functioning version?
If a car was dangerous enough to possibly cause death, wouldn't the government require a recall? Wouldn't the media jump on them like rabid wolves like they did Firestone? Wouldn't people avoid the things like they did Firestone?
So they think that just because they are Microsoft, they deserve to be treated differently? If they made crap software that is full of bugs, and it gets released to other companies who my possibly take advantage of those bugs, then it's their own fault. If a product is meant to be remotely secure, the software company should employ QA teams to *TRY* and break into it, at the VERY LEAST. Writing poor code is no excuse for avoiding your punishment, MS. Perhaps those using the buggy software should be informed of this, and given a grace period to switch to another system before MS is made to open their source.
Follow me
The DOJ was pressuring MS to release it's APIs etc., in the interest of fair trade. Now MS claims that doing that would put national security at risk.
What's the solution for the DOJ (who holds the reigns now)?? Simple: force MS to adopt open standards and open code modules in the future. Given that the MS business model is based on leveraging its "secret" elements, this could force them to abandon nearly all of their anticompetitive practices.
-3Suns
~~~~
The Revolution will be Slashdotted
"We'll security is our top priority (http://slashdot.org/article.pl?sid=02/01/17/02592 34&mode=thread&tid=109) but until it improves, our source is a threat to national security"
Three things need to happen in order for people to start getting serious about software security and reliability:
1) A software system with 1 or more serious _known_ flaws must be used on a worldwide scale by a government agency or large company.
2) That software must then fail.
3) The failure must cause thousands of deaths or hundreds of billions of dollars in loss or damage.
The result will be like the 9/11 of software...when the world wakes up and realizes that we have become so dependent on software systems for our daily lives that we actually have to start caring whether or not they work correctly. We need to start taking an engineering approach to software and KNOW (not think) that it will operate as advertised.
I'm actually hoping that this will occur sooner than later. The later it happens, the more catastrophic the result will be and the less time we'll have to rectify the problem before it happens again.
Though I know the knee-jerk reaction is to scoff, M$'s statement does bring up an interesting issue. Given how porous M$ security is, just how much worse would/could it be if the source code were available? To be honest, and flame away if you must, I think that M$ does have an interesting practical point (not that I agree with how their applying it, but that doesn't make their point any less valid).
So the obvious question arises, is Linux/BSD (and any other software that has source available) more exposed to "serious" attacks. By "serious" I mean being launched by somebody who knew enough to be able to look at the source and find security flaws, vs a script kiddie who takes a virus toolkit and modifies the virus name and subject line. Theoretcially, it should be more vunerable than a picece of closed source software that was written with a similar level of "quality".
Again, I AM NOT DEFENDING OR SUPPORTING M$'S POSITION, only bringing up what I think is an interesting question.
They may just confirm Judge Jackson's assertion that any sort of compromise short of a breakup will be insufficient. Here's hoping that Kollar-Kotelly's nose is as good as Jackson's.
I'm curious. As someone who's been programming against the win32 API for a long time now, what precisely in your opinion is not properly documented by any of the SDK's?
Granted I don't use all aspects of the API, so perhaps parts of it are poor, but the parts I use are highly documented, examples given, and all sorts of other goodies. This is what dragged me, and many hundreds of thousands of other developers into the MS world where we make a good living building solutions to business problems.
-me
-Malakai
A Dragon Lives in my Garage
In this pleading, Microsoft themselves admit that their stuff is widely installed on Federal Interest Computers.
Microsoft's use of so-called operating system patches to disable user mail applications and replace them with the Outlook mail server application is unauthorized hacking of Federal Interest Computers, a Federal felony under US Code Title 18 Section 1030 (the COMPUTER FRAUD AND ABUSE STATUTE: see http://www.cpsr.org/cpsr/privacy/crime/fraud.act.t xt).
Microsoft's pervasive practice of using their upgrade/patch excuse for hacking Federal computers and replacing relatively secure software like Eudora with nightmares like Outlook (which is itself responsible for something like 80% of the viruses and worms on the net!)is a violation by my reading of the Act (but IANAL). I think that Paragraph (b)(1)(B) ought to be applied!
"My opinions are my own, and I've got *lots* of them!"
Microsoft is resorting to desperation tactics... they know they've lost.
Actually, this is entirely consistent with MS's strategy all along: it has been arguing that it and its products are so profoundly important to the American economy and security that any remedy which interferes with its ability to act as it pleases should be struck down by the court. Otherwise, everyone will suffer at least as much as MS will.
It's the exact equivalent of a mob boss saying that he shouldn't be imprisoned for running a protection racket, because then he wouldn't be able to protect his customers. Moreover, he wouldn't be able to provide for his innocent wife and children (even though it's been shown he abuses them as well).
Microsoft isn't at all desperate; they're just so arrogant, and so blind to basic security principles, that they don't really see a problem with what they're saying.
In the wrong hands, sanity is a dangerous weapon.
Let me get this straight. The product that Microsoft's monopoly rests upon, the monopoly that they illegally maintained and expanded, is so flawed that it threatens US national security. Did someone from Microsoft REALLY say this? If so, it is clear they have gone mad in Redmond. What do they expect the millions of companies and government agencies to do? Wait until Longhorn, or whatever is ready? And hope all the holes are fixed by then?
"Uhh, sorry Mr. President, the NSA can no longer monitor international communications. Our systems are just too vunerable to hacking to be used. Jim Allchin assured us that a comprehensive fix would be available within 18 months."
"In other news, the US Navy has ordered all AGEIS cruisers into port indefinatley. The AGEIS computer systems were deemed too risky for combat use. The Pentagon would not comment on reports the entire US fleet would require software overhauls before any offensive combat operations could be contemplated."
"World stock markets are today in freefall as most major international corporations raced to secure information systems based on Microsoft's Windows operating system. Some experts estimate that the expense of fixing or replacing mission critical software to provide an adequate level of security would dampen the World economy for a decade."
This goes so far beyond a computer industry issue. Its a staggering admission of guilt. What CIO would be caught dead installing an MS system unless they have absolutly no alternative?
There is also the legal issue. If someone has sustained an economic loss due to "flawed code", that they are using because MS illegally supressed competitive alternatives, then they have a really good case for compensation. And the hardest part, proving that MS illegally manipulated the market, is already done. And they have some tens of billions just sitting around, waiting for the right lawyer to just take away.
How many of you kids remember a.out to elf? Or the switch from libc to glibc? Any of you try to upgrade through that yourself without reinstalling a new distribution? Think of both of those, multiply it by 10000 and throw a couple major security holes in that the entire world may not be privy to. Then you are starting to scratch the surface of how large this problem is. On top of that why not factor in some bullying from the MS sales force, how many larger MS customers have been bullied at one point or other? Probably enough that if they were told they have to replace everything some of them would get really pissed off and seriously think about shopping elsewhere.
MS fucked up and they fucked up bigtime. They need more time too, they've got
A long time ago I had a sig line -
... I'll have grounds
__________
Microsoft - The Number One Manufacturer of 'Tools for Terrorism (tm)'.
__________
This was inspired by the then almost weekly anouncements about security problems with the design of and use of Active-X, macro-viruses, IIS, etc.
Now their lawyers have concurred.
Guess I was right all along !
- Mchummer
__________
More relative than this: the play's the thing
Wherein I'll catch the conscience of the king.
Hamlet. Act ii. Scene 2
__________