Gates Says Windows Reliability Is Greater

mogrinz writes "According to an interview with the New York Times, Bill Gates is proud of the achievements Microsoft has made in increasing the security of Windows. As for the effects on people being attacked by SoBig.F, etc? Gates says this is "something we feel very bad about". Gates summarizes the Microsoft position very succinctly: "We're doing our very best, and that's all we can do"."

Comments

Wow, it's really secure now!

[Rosco P. Coltrane]

Shit, it's so secure I need a password to read the article:

Welcome to The New York Times on the Web!

For full access to our site, please complete this simple registration form.
As a member, you'll enjoy:

In-depth coverage and analysis of news events from The New York Times FREE

Up-to-the-minute breaking news and developing stories FREE

Exclusive Web-only features, classifieds, tools, multimedia and much, much more FREE

Please enter your Member ID:

Please enter your password:

Remember my Member ID and password on this computer.
Forgot your password?

No?

[jabbadabbadoo]

"Q. Blaster included a message attacking you. Do you take these things personally?

A. No. "

He should.

Re:No?

[tomstdenis]

Why? His company released a patch to fix it a few months before the attack started.

Would Linus feel particularly hurt if a worm went around that attacked kernel v0.94 ???

Tom

Re:No?

[Dark Lord Seth]

If he did, two minutes of reading slashdot would be enough to drive the guy to suicide.

Re:No?

[militantbob]

Agreed. Microsoft took the appropriate actions. They recognized the problem, and released a fix far before any damage was done. They even made AutoUpdate enabled by default, to cover the rear ends of lazy/unknowing/careless users. I think Microsoft is making steps forward - small but important steps, such as ahead-of-time patches, offering a foundation for cooperation with 3rd party IM client producers, and admitting to and showing indications of intention of addressing security and stability problems.

Microsoft has a long way to go. There's no doubt about that. But *some* of the recent news concerning Microsoft has surprised and pleased me.

If users would leave AutoUpdate on, or take the time to check for patches once every week or two themselves.. and MS doesn't bloat 2004 and instead focuses on security/stability... I think things will be just fine.

Re:No?

[Anonymous Coward]

I agree with you, but I was pleasantly surprised to find that a lot of users actually cancel Windows auto updates when they become available because they think they're viruses attacking their computer...

Again, what is needed is more education of computer users in general - Windows Update really needs paper literature devoted to it in the box as it really is that important - from the perspective that the end results can affect others. It's the same issues with anti-virus software updates - a lot of people think installing from the box is all that's necessary.

What amazes me is that some large companies have a 'no executables' download policy on their networks. This umbrella policy also stops Windows Update working correctly, leaving a lot of exposed machines. Microsoft has supplied a way for larger companies to have their own internal Windows Update server running that will get around this problem and allow updates, but in some cases, company policy seems to be more important that IT common-sense.

Patches are important, they're just as important as those product recalls for exploding monitors/laptops and monetarily can probably cause more damaged if not applied.

Re:No?

[Gleng]

Yes, but wearing a top hat and a monacle.

Re:No?

[gl4ss]

actually linus might take it pretty personally if there was a hole found in linux that affects every linux kernel from 0.94 to 2.6test4.. even if he did then release a patch for it a bit later.

(as equivalent as the holes that have found to be in all nt based ms os's)

-

Re:No?

[militantbob]

Turning off AutoUpdate is a scary thing, in the case of the casual user. This is one area where I wish there was *more* harrassment and hassle required before disabling could be accomplished. A big bold warning box as soon as that checkbox is clicked, and another when the changes are saved. Many of my non-technical friends have heard about the 'insecurity' or 'privacy concerns' that are 'inherent' in auto-installs such as AutoUpdate and virus definition updates... and so they figure out how to turn it off, not knowing that THAT is the most dangerous thing they could do.

The harm caused by a worm to the user who disables AutoUpdate is his own responsibility. But the warnings should be more clear and in more places, when one considers what you pointed: that the user's choice may very well prove harmful to countless others. It is his machine, it is his choice. But he should be compelled by the software itself to make that choice in a more educated fashion.

Obligatory quote from "The Rock"

[arnie_apesacrappin]

Losers always whine about their best. Winners go home and fuck the prom queen.

Fear of lawsuits? Bah!

[denisdekat]

I like the part about "are you afraid of product liability suits". He should have answered. "no, now that we understand how to buy politicians and use lobbyists, we no longer fear the law".

Dear Bill ...

[Ninja Programmer]

Dear Bill,

Far and away your #1 bug is the infamous "buffer overrun" flaw. These usually mostly manifest themselves in string libraries. I know that you have at least 3 library solutions in-house (Safestr for C, CString in MFC, and basic_string in STL) but your developers don't use them otherwise these problems wouldn't happen.

I'd like to point you out to another alternative:

http://bstring.sf.net/

Which your developers may prefer. But whatever you do, why don't you simply make it a requirement that <string.h> simply be outlawed (you could easily write a tool to enforce that couldn't you?), or take some other drastic action?

Buffer overruns are certainly the most common kind of bug that isn't caught by QA (the right answer is not to try to train QA to find them -- they would require the skill of a hacker.) If you concentrate on this one bug alone, you will probably easily remove 80% of these attacks.

Works for me but I'm an expert user

[j_dot_bomb]

I have never gotten a virus with xp. Never even even had one come up in a virus scan. But, I do all the right things like use a firewall and autoupdate. I also do things no one else does like use IE security settings and turn -everything- (java, activex) for all but say 40 sites on the net. This last step is just far too much work even for expert users (esp with that stupid site may not display properly dialog for ActiveX). Further it is just beyond the typical home XP user.

Re:Just Great

[digitalunity]

Now that's just mean.

If by reliability, you mean it's ability to function in a proper way without self-destruction, I'd say he is succeeding. Windows XP is indeed better than the previous offerings. Once upon a time, you didn't even have to touch your computer and it would spontaneously have problems. It has gotten much better. Now, it's resilience against the evils of the internet...

That's another story. Indeed, Gates should institue a moratorium on new projects until the old ones can become stable enough to actually properly handle the internet.

Sobig.F is a good example of how fundamental the problems with Microsoft software is. The changes required to secure (pick one: Windows,IE,Outlook,Exchange,IIS) need to happen at the API layer. Unfortunately, this would take industry-wide support, something not even Microsoft can make happen overnight. It would seem with all the money companies already have invested, there is a lot of corporate inertia to overcome.

Re:A SoBig Achievement

[GabrielStrange]

You know... If MS was really going out of their way to try to make systems running Windows be secure...

They'd figure out some way to make it possible to run your Windows XP Pro system with a Limited (i.e. non-root) account without rendering it totally useless.

The few programs I've actually managed to get running on a Limited account still don't seem to have the access they need to SAVE THEIR SETTINGS... So they need to be reconfigured every time they load up.

And the only way I've figured out for dealing with that is to temporarily add the Limited Account to the administrators group, pull the network cable, log in with it like that, make the changes, log back out, remove it from the administrators group, reconnect network cable and run Ad-Aware and pray nothing went horribly wrong.

Which is a bit of a hassle.

Gates and the Chewbaca defense

[UnknowingFool]

It's interesting how Gates tries to deflect the questions:

Q. The buffer overrun flaw that made the Blaster worm possible was specifically targeted in your code reviews last year. Do you understand why the flaw that led to Blaster escaped your detection?

A. Understand there have actually been fixes for all of these things before the attack took place. The challenge is that we've got to get the fixes to be automatically applied without our customers having to make a special effort.

The interviewer asks how Blaster occurred despite Trustworthy Computing. Gates responds again and again that if everyone patched their systems, Blaster would not have been an issue. In essence, he is correct but he doesn't really answer the question. But this isn't a complete solution as not all users can automatically patch their systems.

Before everyone starts chiming in on how real system admins would have been prepared. Remember a few things:
1) After being burned by a few bad patches, some corporations now have a policy that specifically states that patches must be tested first. With the huge amount of patches that is released by MS, this is a full time job.
2) Remote users (laptop users, VPN users, etc.) are like sailors coming back from overseas. Who knows what they were exposed to and what viruses they have. This is outside the control of most admins.
3) Microsoft itself was not prepared for Slammer. SQL servers that were being used in a development environment (read outside of normal sys admin networks) were not patched. With large organizations, sometimes there are unknown, rogue installations.

Virus Cost Statistics, Microsoft's DOS Attack

[Anonymous Coward]

> Every MS virus, worm, and what not does not cause BILLIONS in lost dollars. There are I am sure some cases of actual lost real money, but if they totalled billions I'd be surprised.

So be surprised.

Here are some virus costs from Wired:

Nimda -- $635 million
Code Red -- $2.62 billion
SirCam -- $1.15 billion
Love Bug -- $8.75 billion

While we're looking at statistics, here's another...

According to CERT, the number of reported security incidents grew, starting in 1988, until they hovered at just over two thousand incidents per year from 1994 to 1997.

But then in 1998, the number of incidents started to explode:

1998 -- 3,734
1999 -- 9,859
2000 -- 21,756
2001 -- 52,658
2002 -- 82,094
2003 -- 76,404 (so far)

So what happened in 1998?

Microsoft introduced embedded e-mail scripting in Outlook Express!

Even an idiot could have predicted the consequences.

But why would Microsoft do something that was so clearly incompetent and irresponsible?

The answer can be found in another event that occurred in 1998, namely, the leaked release of the Halloween document. That internal Microsoft document described a strategy for fighting Open Source, as follows:

> OSS projects have been able to gain a foothold in many server applications because of the wide utility of highly commoditized, simple protocols. By extending these protocols and developing new protocols, we can deny OSS projects entry into the market.

So there you have it. The embedded scripting in Outlook Express is just one part of a general Microsoft strategy to decommoditize (i.e. break) Internet protocols.

In other words, these viruses and worms, which are costing us $billions, are just a side effect of MICROSOFT'S EXTENDED DENIAL OF SERVICE ATTACK ON OPEN SOURCE USERS.

If Jeffrey Parson might be going to jail for his denial of service attack (modifying the DDOS Blaster worm), then why not the president of Microsoft?