Slashdot Mirror
Microsoft Opens Source to China
angst7 writes "ZDNet is reporting that Microsoft has signed an agreement which would allow the Chinese government access to Windows source code. This is part of an effort to curb the shift toward Linux in China due to that country's concerns regarding the security of closed source software." Reader NZheretic points out that less than a year ago, Jim Allchin swore under oath that disclosing the Windows operating system source code could damage national security.
not opens source to China.
just using its own form of open source - you just need to yell "Hey were going to use Linux!" and you get the source ;-)
And this hurts the US National Security?!? WTF!?!
Well, it looks like terrorists are gonna be the first to see the source... :/
You are great player! Present you with points!
Now that China has the source code we can look forward to some really nasty ones.
I have heard people discuss this and say something like "Oh boy, I wonder if the code will be leaked and we can be free to modify windows! Yaaaay!" Not. Who would want to modify windows? I mean, you can make workarounds for problems that exist already without having source. If you want a fully modifiable OS, why don't you just go with Linux?
if the Chinese can't recreate the shipping binaries from the source that MS shows them? The last time the question came up (the Caldera suit) Microsoft finally had to admit that even they couldn't reproduce the distribution binaries from source.
Lacking <sarcasm> tags,
can they type: ../configure;make windows;make install?
If not -- then how do they know that the code they are looking at is the same version that goes into the build on their desktops?
(+1 Funny) only if I laugh out loud.
Just curiously... if all the linux users care about is open source, wouldn't the functionality of windows compared to linux IN SOME ASPECTS cause a flux of *nix users to use windows if they could fiddle with it as they liked? I mean besides server issues, windows is the way to go if your computer is really just a PC.
When he swore under oath that opening the source for Windows would be a threat to national security, I completely agreed. The number of security holes in Windows with the source remaining closed was bad enough. Now China gets to see the source, and we don't? Wouldn't that put them at an advantage over US companies that can't audit the code for security holes?
What's the corporate punishment for treason?
What's this Submit thingy do?
Sorting through gigabytes of Microsoft legacy code that was written under the pretense that nobody would ever see it. Now there's a scary thought. I'd hate to be the guy with THAT job...
--sex
Very popular slashdot journal for adul
less than a year ago, Jim Allchin swore under oath that disclosing the Windows operating system source code could damage national security.
So, does this open the door for a purjury investigation? I would think that a number of companies would look upon this with great interest.
Visit Jonesblog and say hello.
This must be a covert attempt from Microsoft to destroy China by weakening its national security!
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
They often releases it to schools with various NDA's, as well as businesses under various agreements, but that's usually for educational or development reasons.
The deal with China seems to be a combination of PR and sales, rather than education and development.
frob.
//TODO: Think of witty sig statement
I cant wait to put my hands on that baby, i know, is an ugly one but would be very intersting to look the sources. This make me wonder, with all the security issues that Windows has isnt a bit dangerous to give the source to only one country who could find several bugs and holes by looking at the codes?, isnt it scary?, say bye-bye to Windows on sensitive servers.
Sigs are for morons... Wait a minute...
So the US government needs to either arrest Jim Allchin for perjury or Bill Gates for treason.
Unless the ability to compile the source and run the resulting binaries is there, this is a meaningless gesture as there is absolutely no way of knowing whether a given version of the OS matches up with the allegedly corresponding source.
It's just that M$ can't go after China with an army of lawyers. When a school or corp breaks their NDA, they end up in court. I wonder what happens when China breaks NDA.
Learn from the mistakes of others. There isn't enough time to make them all yourself.
I think what he MEANT to say was that compiling the Windows operating system source code could damage national security.
Trade secrets: Beyond a doubt there are piles of things in the source code that could be considered trade secrets. One way to protect trade secrets is to make certain that they are widely available but not legally available. In the cynic's view (i.e. mine) M$ wants the code to be leaked by China.
If the code is illegally leaked, it is very easy for M$ to accuse other products (future Linux apps?) of using illegally acquired trade secrets. How can the authors, living in countries around the world, prove that none of them have ever seen illegally leaked material?
Based on what I have read about the development of the clone of the IBM BIOS, it appears that the burden of proof de facto lies on the defendant to show that they are not using trade secrets illegally.
This may give M$ a very big gun to point at any colloboratively developed code that they don't care for.
Although I've always felt that "cyberwar" scenarios were rather overblown attempts at giving backroom geeks frontline roles, the military certainly takes it seriously; one well-received military paper a few years ago warned that America's IT defenses were on a par with the ability of Task Force Smith (whose ignominious retreat from Korean forces showed how woefully unprepared America was for the Korean conflict).
As we know, China has been touted as the first great cyberwar enemy; allegedly, China does have a "hacker brigade" tasked with disrupting American networks and computer systems in times of war, to rectify the strategic imbalance between the two nations. Now, Microsoft plans to open to a strategic rival of the U.S. the internal code that will power the Navy's upcoming CVN-77 aircraft carrier, plus other "smart ships."
This raises an interesting question for the Administration: although, as Vann H. Van Diepen (Director of the Office of Chemical, Biological, and Missile Nonproliferation) told Congress, export controls to China are not enforced in "areas where the technology is widely available as commodity items ... such as low-level computers," the source code to a mission-critical operating system used by military C4 systems is certainly not a "commodity item," nor is it "widely available." Will the White House put national security over Microsoft's profits? Les Kinsolving, call your office!
"Freedom is kind of a hobby with me, and I have disposable income that I'll spend to find out how to get people more."
"All warez copies of Windows actually fake versions distributed by the Chinese"
"Microsoft Source Code leaked world-wide"
"Microsoft discontinues entire software division and focuses full force on their Mouse and Keyboard division"
1- China Gets Source
2- China uses Message Queing to break or break into asian corps, and small countries which have little security
3- China now has massive espionage in 2nd/3rd world countries, and united states corporate subsidiaries in those countries
4- China invests heavily in US stock market
5- Profit!
At least that is what an Evil empire would do...
In case you didn't know, the "People's Republic of China" has an entire department(ie Air Force, Navy) dedicated to Information Warfare. Which does in fact, include computer viruses.
From an Infoworld article on the subject:
"Governments signing up to the security program will be able to build systems that offer the high levels of security required for national security, Microsoft has said. However, government users will not be allowed to make modifications to the code or compile the source code into Windows programs themselves, according to Microsoft."
Yeah, real 'open'.
"Gold still represents the ultimate form of payment in the world." - Alan Greenspan, 1999
Actually some versions of code red did have code to detect the language that a site's web pages were in and trashed the site if it wasn't in Chineese. Then a few days after this was discovered a second verison of the same worm appeared which did the opposite. Code Red hit at the time that the US spy plane was forced down in China.
There are plenty of examples of politically motivated hacking, the Palestinians and Israelis have been having an ongoing proxy war for some time. However almost all the events appear to be the work of independent agents working on their own rather than being coordinated cyber-warfare.
The only example of state sponsored cyberwarfare I am aware of is the attacks on Usenet by Hasan B-) Mutlu and Serdar Argic who roboposted thousands of anti-armenian propaganda messages. Mutlu and Argic were both pseudonyms used by an officer of thr turkish intelligence service which was concerned that reports on the Turkish massacre of Armenians during world war I were circulating on Usenet and damaging the image of Turkey abroad at a time when the post USSR CIS was fragmenting into racial warfare. So they roboposted claims of a bogus masacre of turks by armenians repeatedly in order to drown out and discredit the genuine claims that the turks massacred the armenians.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
I tried to write something that was quick to read, but to the point. Who knows, maybe someone will notice. I'm not holding my breath, though.
=====
Despite the fact that Microsoft's software is widely known to contain many security vulnerabilities, the U.S. government and military heavily rely on Microsoft's Windows operating system to peform vital government functions.
It is relatively easy to find security vulnerabilities in software when you have access to the source code of that software (source code is what defines software; people read and write source code).
In light of this fact, Microsoft has claimed that sharing information about its software with competitors could damage national security.
More important than any competitor to Microsoft, China now has the source code to Microsoft's Windows operating system.
Shouldn't the U.S. government move in the direction of open software that is not ultimately controlled by any one entity? As a concerned and informed citizen, I would wholeheartedly suggest Senator Warner support open source software and vote against bills like the DMCA that stifle the progress of open source software.
I understand that China is not allowed to compile the program. That being the case how can they be sure that they have the complete source.
The only way that I can see a government feeling warm and fuzzy about this would be if they were allowed to examine all 500 million lines of code and to compile it themselves and distribute that.
Even doing this they will have to do the same thing to every update and every proprietary piece of software that they run on government computers.
I think that Linux is still the way to go for China.
The race isn't always to the swift... but that's the way to bet!
You see, being exposed to Windows source code gives programmers a killer headache, and after having seen it, they'll never be able to write a secure piece of code themselves.
If, theoretically, the USG saw all the source code, couldn't citizens then solicit that same information (the source code) under the Freedom of Information Act?
I mean-- it comes down to the core issue of privacy-- the gov't would have to prove that it has no unfair advantage that could impede my 4th Amendment rights vis a vis the M$ software.
Or-- it could prove to be collusion between a private entity and the state, also illegal in the US, and I would think most of Europe...
davejenkins.com |
OK, before I get flamed, yes I see in the FAQ:
Security-enhanced Linux is only a research prototype that is intended to demonstrate mandatory controls in a modern operating system like Linux and thus is very unlikely to meet any interesting definition of secure system.
and
Security-enhanced Linux is not part of any currently approved version of Linux and has no special or additional approval for government use over any other version of Linux.
So maybe NSA Linux isn't the answer, the NSA thing just seemed obvious since we're talking about government use. However, it almost sounds like they might have an approved version of Linux available. Wonder if they're experimenting with that...
YOUR FACTS ARE INCOORECT!
While I can see how this will help China discover unintentional backdoors, this won't help them against intentional backdoors.
There was an old hack which Ken Thompson used to give himself access to all Unix systems, as a proof-of-concept of why you shouldn't trust source code. He didn't modify the Unix source code. Nor did he modify the C compiler used to generate the Unix binaries. He modified the C compiler used to compile the C compiler. Full source code access wouldn't help you see the exploit.
Details are atn ed /thompson.html.
http://www.wbglinks.net/pages/reads/hacksexplai
China doesn't have the rights to compile the source code they get. Even if they do (and I'm sure they will, if it's of any use to them) they won't be able to verify that the code is free of intentional backdoors-- because presumably it requires M$'s compiler. Even if they get access to the compiler source code (and I don't think they do) they can't verify that it doesn't have a back door.
If I were China I'd be afraid that the US government has hidden an exploit in Windows. That may seem paranoid, but security folks are supposed to be a little paranoid. I wouldn't trust Windows, source code or not.
Come to think of it, I wouldn't trust the American-designed processor, BIOS, disk controllers, RAM, keyboard controller, chip design tools, etc.