Slashdot Mirror
Microsoft to Clean Up Code
the_pooh_experience writes "Microsoft has decided to beef up their security group by adding a code cleaning group according to Infoworld. As the director of MS security engineering says: 'Microsoft is a long way from its ultimate goal where users can take security for granted in its products...the majority of viruses written attack Microsoft products.'" The new group is called Security Engineering Strategy and while it may seem long overdue to many, it's still a step in the right direction for the folks in Redmond.
If you've learned anything by now, it's not important that Microsoft fix the majority of their security flaws, but that they imply they will.
The OSS model of peer review on a large scale is the sole reason for such reliable security.
Proprietary companies still have an edge. If people programmed according to a planned set of pre/post conditions, and tested their modules with black box testing, then a large portion of the controllable errors can be caught. Whether or not Microsoft does this is questionable since we can't see their code.
Oh, and BOUNDS CHECK EVERYTHING. Buffer overflow errors should have been non-existant for a half a decade by now.
- tristan
... that this group didn't exist before. Surely a company the size of MSFT would already have a team or group just doing code auditing?
Oh well. as they said - it's a step in the right direction.
OpenBSD have done this. They set up a team of dev's who went through the entire code fixing up buffer overflows\underflows, and all that jazz. I hope for the worlds sake (because it seems that the whole world is using Microsoft products) that they do a good job, but in my mind it wont make me feel like Windows or IIS or any other networkable piece of Microsoft written software is secure.
Gnome wasnt built in a day.
The trolling editors seem desperate to generate pageviews and posting a Microsoft piece almost guarantees to inflame and troll enough users to accomplish this.
Look at this story...what's really that new or interesting here? This looks like just another opportunity for slashbots and "M$" haters to get their kicks.
The more reasonable readers don't get off on that kind of stuff. Please editors, this is getting old and boring.
SIG:Slashdot: indymedia for nerds.
Yea, it really sucks that I can develop and test code on my Windows laptop and just copy the compiled files over to an AIX box, or Intel/Linux box, and everything works perfectly.
Methinks you're a disgruntled C programmer feeling the world's leaving you behind.
Get with it - there's tools for every job - pick the one that works best.
My original point was made in humor partly - but the main point was that normal security exploits attacking buffer overflows, for example, are a non-issue in my 'interpereted language'.
Nobody in their right mind is going to simply take it for granted that any given operating system is secure. Considering Microsoft's track record of programming, they are the last people anyone should blindly trust. The only way to deliver security on a project of this magnitude is to open the source to peer review.
If the 3r33t community hated other software/platforms as much as they hated Microsoft I'm sure the level of bugs exposed/viruses would be equally as high. I'm not saying Microsoft throws all beautiful software around, but if you devote time to finding holes in software, you'll find it no matter who the maker. As a fair example, look at what happens Larry Ellison tries to make grand claims about the stability of Oracle software. Many of you have valid opinions, and that's respectable, but how so many people can blindly hate Microsoft because of the hate trend makes me want them to succeed.
I'm wrong and so are you.
I think you forgot to add this:
and everything works perfectly*.
*Perfectly is taken to mean "Works about right as long as that system has the same brand and minor revision of the JRE"
Seriously though, every Java based piece of software we have looked at has been total crap. Many of them require a certain runtime, such as one web service from a major company we looked at, that only works with Apple's runtime. Other's only work with MS Java runtimes. The list goes on.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
What Bill should do is contract Theo de Raadt of OpenBSD. He has to be one of the lord high masters of code cleanup in the whole world.
Pay boffo bucks, send a Gulfstream to get him and give him some Bill face time.
He'll give you a seminar on code cleaning you'll never forget.
It's Christmas everyday with BitTorrent.
MS employs a staff that roughly equals 20% of GE. And the bulk is either in marketing or legal. Factor out these yocals, mid-level managers doing nothing but CYA and all the air-head interns and there's not much left. There's your 'task force,' working on this whitewashing.
What is Microsoft's full-time worldwide headcount? Current employment headcount as of 6/30/02: Worldwide: 50, 030
GE operates in more than 100 countries and employs 313,000 people worldwide. Now, that's manpower. Anything under 250,000 is just an excuse to have vending machines in the lobby.
I have yet to see anything substantial in this area from this company. In my experience, the only way to fix code that messed up is to do a complete re-write plugging in bits of the origenal where it can. It's a lot of work, but worth it in the end.
This signature has Super Cow Powers
If true, than M$ has internalized, or is attempting to, another OSS development process feature into it's corporate structure.
Even if it was just a flapping of the lips, it's a good thing, especially for all the shops in the IT world who take hints from the large players, which, like it or not, M$ is. I got a copy of "Code Complete" from M$ Press my first day on the job here. People do pay attention.
The concept pre-dates open source development. They did have peer reviews in the days of the mainframe.
Sure, the concept of peer review is an old one. This is a slightly different slant, however - The security review is not to check that the code performs it's task correctly, rather that it does not compromise the security of the application.
In the OSS community, code (potentially) gets reviewed by people with expertise in a number of fields, something that is not guaranteed in a closed-shop development team. Hence, my observation that this is a watered down version of that process, with it's focus solely on security.
So, here's a rather obvious 1-2-3-profit list
Perhaps you haven't looked too closely at Windows Server 2003. I've been kicking it around for about 2 weeks now and let me give you some highlights.
1. Stuff works. It's the easiest time I've ever had configuring a server. It's like flipping a switch.
2. Stuff is locked down. Everything out of the box is turned off. When you do turn it on, it's locked down by default. Everything runs with the lowest privelege possible to get the job done.
3. Reliable. Nearly anything can be done without restarting the machine. The only exception I've had so far is making it a domain controller.
Frankly, I'm looking forward to working with it in a production environment.
bance.net
I hope for the world's sake they do a terrible job and most people realize it. If their software remains marginally good enough in most people's minds, as it is now, it'll continue to be used. Their walking a thin line right now. If their software is seen as more expensive, buggier, or more insecure than it is now, even by just a little, they'll hurt. Anything that keeps them above that line keeps them in business. I'd much rather see them fail so there's a much quicker transition to FOSS.
Developers: We can use your help.
Will this group have the authority to hold up a release if there are security holes? If not, they are just window dressing.
Is this group REALLY going to be able to get Microsoft to create secure code, or just avoid goofs so large they provoke those embarassing industry articles about lack of security?
Most people do not CHOOSE to use IE - it is simply what is available from the get go on their computers with windows pre-installed...
On win2k you can't even remove outlook express (yeah of course you can - but not by simple means).
Click the outlook express by mistake once - it won't even ask you - it will just take over as default mail app.
Check out my PHP Url Validator
The mucky-mucks at MS, or Apple, or any other software company work long days worrying about and getting all the info they can about other companies.
Since linux is non-corporate it is up to people like us to discuss, argue, trash-talk, and otherwise beat to death information and news about the competition.
To me its just good business.
That's because (for the most part, anyway) the developers are writing the software because they want to, so they're going to do it right. Closed-source shops have deadlines & developers will often take shortcuts to meet them.
Having some people to actually just fix security issues is good, since then those people can concentrate on security topics.
Even if all their developers where aware of security issues, there actually has to be some group that concentrates on KNOWING about the issues, so that not only is code looked after, but actual developers have someone to ask when they think "there is potential pitfall here" but don't know the exact problem/solution.
I think Open Source security works because there is always someone that can show the actual problem with the code.
There's also the problem of big picture. While you COULD check buffers at every stage of code, you actually only need to check data that is coming INTO your code, as long as you trust your own code. Problem here is that there is often functions that SHOULD get data only after it's validated, but for some reason get it without validation. If there's someone who knows the actual validation process and data flow, and whose job is to check that all is fine, then security can be built as the first layer, not just small checks in 11001 places.
Ofcourse everyone still needs to check return values of functions that can fail (or catch exceptions when programming with a sane language).
Software should be free as in speech, but if we also get some free beer, all the better.