Slashdot Mirror
Taiwan Asks Microsoft To Open Windows Source
Andy Tai writes "According to this China Times article (in Chinese), the Republic of China government has asked Microsoft to open Windows source code. The official, Lin Jua-Cheng, in charge of the 'e-government' initiative, says many other countries have also sent similar requests to Microsoft. Lin explains that without Windows source code, the government cannot add custom firewall functionalities to Windows based systems in wide use, and that is very bad for the information security of Taiwan. Microsoft refused to publicly release the source in the past using reasons of copyright protection, but Lin emphasizes this request is reasonable since it is based on (government users') necessity." Read on for a bit more, too. (Can anyone suggest an online Chinese English translation engine that produces other than gibberish?)
Andy continues "Lin points out that GNU/Linux systems, because of their freeness and high security (due to the availability of the source code, which can be modified to add firewalls and other security measures), have become widely used in government computer systems (especially in militaries and intelligence agencies) of many nations and the Pentagon, the FAA, and the air force of the U.S. Lin says the government cannot rely on a single vendor, and to promote the alternatives, the government has set up a 'Free (libre) Software Steering Committee' directing government efforts. The two aims of the ROC government's current software policy is making Windows source code openly available and the development of Free (libre) Software in Taiwan."
See here for more discussion.
Remember, folks. Taiwan is the Republic of China (ROC) and mainland China is the People's Republic of China (PRC).
This is dealing with the ROC, not the PRC. The PRC claims the ROC is a renegade province, the ROC is just sitting back with the US covering its ass waiting to be able to truly flip the PRC off.
My own pointless vanity vintage computing page
ok, that's not funny; it's just stupid.
the spy plane crashed on the chinese island of hainan, which is nowhere near taiwan (relatively speaking). secondly, taiwan is not china, and vice versa. that's like mixing up the us and mexico. big difference, people will get insulted on either side if you fail to see the distinction.
"I DARE you to make less sense!"
The Federal Ministry of the Interior in Austria is the first government body in Europe to be granted the source code for Windows XP under Microsoft's Shared Source Initiative
(This is taken from slashdot comments from awhile ago.)
;-)
So it must be true, right?
(Relax, I'm kidding. I don't doubt what you're saying. Your citation, however, cracked me up.)
More famously, there was a version of a very popular C compiler
"Reflections on Trusting Trust," Communications of the ACM, August '84. Read it here.
I write in my journal
"More famously, there was a version of a very popular C compiler that would put in a back-door whenever it noticed itself compiling a common bit of Unix login code,"
Nope. This was a theoretical attack presented by Ken Thompson. It was never out in the wild, to the best of anyone's knowledge.
The point still remains that you can't trust code unless you can personally verify it at any level, because the moment you give any important code trust, the code can potentially use that as a way of subverting the entire system.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
You're right, except for the reference to communism. Just because China claims to be 'communist' doesn't mean that they are.
By very nature, 'communism' cannot exist alongside 'dictatorship' because the two are anathema to each other. The US is a much more communist state than China is (the US has many and powerful unions, the DeLeonist perspective, while in China unions are either nonexistent or impotent).
But you're right, the Chinese government is not helpful to its citizenry at all.
STOP . AMERICA . NOW
Pretty entertaining reading...
Bruce
Bruce Perens.
Having said that, they're a pain in the ass to write. There's quite a dearth of information on this type of driver, which means you have to rely a lot on MS sample code -- never a good thing IMHO. I'm not sure how having the source would remedy that, though.
There's also some kind of IP stack hook independent of MS made specifically for this type of thing. Last I checked, though, it could only be hooked by a single caller.
Roving Web-Teleoperated Robot
Uhhhh, you speak for yourself. I, the people I work with, and many, many others DO use a custom firewall in Windows. My personal choice is Tiny Personal Firewall. It installs itself in the Windows network layer as the orignal poster said. From watching traffic with sniffers and scanning it with things like nmap it is easy to confirm that it indeed is doing its job. Only trafic as per its rules gets passed.
Tiny Software is not affiliated with MS and the product is theirs alone. Also, they aren't the only ones that have a firewall that operates like this. There is plenty of verification that Windows will not interfere with a custom firewall and has no backdoors around one (the way the network stack is built it really couldn't).
This is a non-issue.
You don't understand. You can design any kind of firewall (or any other addition you like) and sitkc it in the network stack. The APIs are well documented for doing so. You can even add your own protocols if you like.
So, you write your firewall, and then install and test it. Simple as that. Even if I was using an OSS OS, I'm not oging to trust a matter of national security (or even the security of my own computer) to hoping it's all working and nothing is interfering with it. I'll scan the thing with scanners like nmap, and sniff the packets it is passing. Only once I am convinced that it works right am I then confident.
I'm not sure when OSS gives peopel such a warm, fuzzy, feeling. As the famous C-compiler trojan proved, there is no way to be sure just because you have the source. You need to do some kind of external verification to REALLY make sure your system is secure. I don't trust my firewall for any reason other than that I have tested it, and confirmed it works.
P.S. Major enterprises, universities, government instutions, etc trust Cisco firewalls and their source is not open.
But I dont see how that self replicating program
in your link works.
I'll explain just the compiler half first, then the password half.
BACKDOOR CODE:
Scan source code while it gets compiled, if it looks you are compling a compiler then insert BACKDOOR CODE into the source. (You don't actually change the source file, you just read the source as if it was there.)
Now you take compiler source and put in the BACKDOOR CODE and compile it. You now have a compiler EXE with BACKDOOR CODE. Now take clean compiler code, make improvements and compile. The infected compiler invisibly inserts the backdoor into it and your clean source produces infected compiler EXE.
Now you can hand everyone the compiler EXE and the clean source without the backdoor. Even if they write a compiler from scratch it will still get infected if they use your compiler to compile it.
Now that we have a an invisible self perpetuating backdoor, we add a payload to it. Add in a another secotion to the BACKDOOR CODE: Scan to see if you are compiling LOGIN source, if so insert a backdoor root level password. Now any any version of Linux complied from perfectly clean source will have a backdoor root login, and an infected compiler.
It is extremely insidious. Everyone looks at the source and thinks everything is fine. The only way to detect the problem is to actually read through the EXE, and that's an extremely long, laborous, and error-prone process. You THINK you know what's in there already, so why would you do it? The only way to FIX the problem is to create a new compiler EXE BY HAND. That's an extremely long, laborous, and error-prone process as well.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Ummm... so the government of China says MS needs to open its source because it stops them from doing firewall stuff for Taiwan?
Taiwan is a separate country not owned by China, so what the hell does China have to say about anything? The headline should be CHINA asks MS to open its source. If the guy from China actually mentioned Taiwan, he was probably talking about how China has been itching to bomb the crap out of them and take it over for decades now.
Esperandi