Slashdot Mirror
Gates: 'You don't need perfect code' for Security
securitas writes "ITBusiness has an interview from the Microsoft Professional Developers Conference where Bill Gates says 'You don't need perfect code to avoid security problems.' Instead he suggests that users acquire and properly configure firewalls and make sure that they keep their software patches up-to-date. Considering that Microsoft says it is focused on security, the comments from the Chief Software Architect aren't inspiring, especially beacuse the underlying attitude seems to contradict the idea of well-written, secure code. What kind of message does that send to the developers who work for Gates?"
This is a typical problem, that was discussed a few days ago. People
are confusing microsoft's success in general with Technological
superiority.
I find it interesting that *anyone* would care what Bill Gate's
opinion is on security. The volume of critical problems reported, and
of actual viruses and worms that have spread across the internet
lately should've been enough to indicate that microsoft doesn't have a
good understanding of security in general.
His argument is an interesting point of view though. It sounds to me
like he's saying microsoft doesn't need perfect code because people
can just install firewalls. What if the code in the firewalls in turn
isn't perfect though? Doesn't that leave us in an insecure position
again? What about the e-mail scanning software? What if it misses a
virus? Shouldn't you have layers of protection, instead of an outer
layer of protection and a soft underbelly?
Of course he is shifting the burden back to the users of the software
again. If only they had our firewall product and a good e-mail
scanning software package, and if they kept their software up to date
none of this would've happened.
Of course if they didn't ship their software with nearly every service
turned on by default, and everyone running as root this wouldn't have
happened either, but let's not trifle with details.
I really liked the part at the end where he comments that all the
viruses and attacks on microsoft's os are really a compliment.
You keep telling yourself that Bill.
Doug Tolton
"The destruction of a value which is, will not bring value to that which isn't." -John Galt
he's right, you only need good code. Too bad windows still doesn't hit the mark.
and he's absolutely right. We could just unplug our computers and leave them in a cold, dark room all by themselves, with no power.
For the rest of us, however, security starts with the code.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
How do you firewall off a semi-legit request to a external MS-Exchange that "Admin's" the server? Even stateful devices like the Packeteer cant selectively block data in the TCP block... expessially 0-day exploits.
Yeah. You can use firewalls(cough). That's why Unix is the Internet OS.
If we are not going to rely on perfect code but expect firewalls to catch the problems, then what do we do if the code in the firewalls aren't perfect?
Do we string together a series of firewalls in the hope that the code problems don't overlap?
It makes sense to me. Don't rely on someone else to keep your computer secure. Take steps yourself.
Look at me, I'm just going to get the latest debian iso and install it and not worry about anything!
Look at me, I'm just going to go buy a car and not worry about locking the doors or using a club, because I expect that the ignition system is tamper proof.
Don't blame the architect when someone comes through an unlocked window in your home and steals your stereo.
No, you don't need perfect code. Linux has no "perfect code". If it did, Linus et al would be finished and have moved on to other things.
I dont rely on Linus for security, I don't rely on Bill Gates for security. At the end of the day, it's my system, and it's up to me to take steps to protect it.
I don't need no instructions to know how to rock!!!!
Sounds like what Bill is actually saying is that "It's not our fault!" or "Security is not our responsibility!". By saying that security should fall to firewalls, etc., he is trying to shift responsibility from his company to the end user. Sounds to me like it is nothing more than justifying the trend in software, particularly MS (but admittedly others) to let software schedules be driven by the marketing department as opposed to when the software is actually ready for prime time.
The fact is, you won't get perfect code, whether you need it or not. You should design things to minimize the amount of code that does have to be perfect, and the damage done if it isn't.
Blame the user, not the developer, is the message.
Its not the users responsibly to compensate for poor design, regardless of the product. Be it an unsafe car, or insecure OS.
---- Booth was a patriot ----
"You don't need perfect code to avoid security problems."
Here is a guy who knows nothing about perfect code, nor security.
Reminds me of the child who keeps on flunking school responding to the first sign of criticism, "I don't have to be PERFECT, do I?"
Sdelat' Ameriku velikoy Snova!
"All code has at least one extra instruction and at least one bug. Therefore by extrapolation, all programs can be reduced to one instruction that doesn't work."
the major advances in civilization are processes which all but wreck the societies in which they occur - A.N. White
Programming can be fun again. Film at 11.
It's kind of hard to say any system, even open source, is going to have "perfect code," but the major problem that is pointed out here is that it does no good to patch a system when the customers aren't going to install the patch. With products like 'nix, which are used more by *ahem* "serious" computer users, admins and the ilk, as soon as someone says "There's a bug in the software," word gets out, and people in the know make sure they are protected. The general population doesn't respond that quickly, however. Many Windows owners aren't even going to understand how to update their systems. This is not so much a fault with Windows as a fault with computer users who don't attempt to fully understand the product they are working with. People don't understand firewalls, they don't understand basic security. They know that you double-click on Outlook, and, poof, there's your e-mail.
We're going to see some obvious responses to this post about the faults of closed-system software, but Gates does bring up a good point: It's hard to have a secure system if the end-user doesn't know what he or she is doing. It's like a car that you drive for five years without ever getting the oil changed; there is no patch for ignorance. And what's funny is: whenever a company tries to become more user-friendly, Windows, Macintosh, etc., the hardcore community gets on their case for it. If we could develop an open-source system with enough depth to satisfy the experienced users, but is easy enough to keep in control by the neophytes, then you could have a widespread, secure system.
Libertarians somehow believe that private businesses should be stronger than governments but weaker than individuals.
Haven't we done this before? Last time, it was about Outlook, then it was about Longhorn...why does Slashdot keep posting flamebait?
How immature do you have to be to post an entire article about one line from Bill Gates? I mean, what do you expect the point is? Clearly, the editors want you to fall over yourselves bashing away on Microsoft.
Don't fall for it. Instead, let's show that we're a rational, level-headed community and not just a reactive one against some company.
Did you also know that Bill Gates said earlier this week the following:
"Jealousy has driven more mistakes by my competitors than anything else," Gates said. "When people focus not on the next breakthrough, but on cutting off Microsoft, it's actually been quite a windfall for us."
Now, this entire article is just a flamebait. You can take anything anybody ever said and make a story like this out of it. Remember SCO doing it with Linus' comments on patents in the kernel? And you all harped on them for it.
What happened to Slashdot?
"Sufferin' succotash."
Microsoft's expertise is controlling the market, not writing code.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
re: don't need perfect code to be secure
Linux code is not perfect and is secure.
I'd say two things to him. First, the only completely effective firewall is the one where I unplug my computer. Assuming you leave a port open, that's a possibility for an attack. Second, all a hacker needs is a proper buffer-overflow in a user program that employs that port, and it's fun time. I'm sure Internet Exploder etc wouldn't apply there. No, not at all.
He has a point in that firewalls have to be a large part of the solution. However, the idea that I can write the world's shittiest code and this is OK because I have a firewall is ludicrous.
Naturally, all this assumes you don't buy your firewall software from MS. That would be pretty funny.
-Looking for a job as a materials chemist or multivariat
Of course they are. They tend to be trusting and don't realize that perfect strangers are more than willing to screw them into the ground. But the OS doesn't need to be a welcome mat for these problems. There are some very basic things that MS could have done to make Windows secure enough that being a trusting user doesn't put the entire system at risk.
To make a analogy that fits users of this level and background, your point is like saying that cars are less likely to get stolen if the doors are locked and blaming said car owners for because their Fnords are getting stollen because they haven't locked the doors that Fnord didn't bother to install in the first place.
Boobies never hurt anyone. - Sherry Glaser.
seriously.
I don't understand why no one raises the patch size issue. To fix a buffer overflow, you've got to need what, 2K of modified code, tops? But the patch is like 2MB? Or 20MB?
In the US, where most people are still on dialup, how can anyone reasonably expect that people are going to download tens of megabytes of patches?
Microsoft should be mailing out free CDs with the latest patches.
Let's be fair to Mr. Gates, for once. If you needed perfect code to achieve security, security would be impossible; I've never seen a nontrivial perfect program. All real-world large projects are going to have errors in them; it's a simple fact of our imperfect world.
Once you recognize this, attention must turn from achieving some mythical perfection to dealing with the probable scope and impact of errors. Just for example, one good thing about languages like (e.g.) Perl and Java is that (absent major kludging) they are incapable of expressing a buffer-overrun bug, a category of possible bug in (e.g.) C which is single-handedly responsible for a majority of significant net security holes.
In other words, once you admit that your code will never be perfect, you are forced to consider how to limit the damage your imperfections can do, and that in turn steers you toward technologies, processes, and practices that help you with that potential-damage reduction goal.
In that sense, Gates is entirely correct that one key to maintaining a secure system is to limit the accessibility of unneeded ports (and the services possibly behind them) from the net at large. Yes, ideally, all those ports and services would be invulnerable to attack. But we know that we're not perfect, so we play it safe and use a firewall. It's classic "belt and suspenders" engineering.
There is certainly a lot to be said about Microsoft's culpability for the low quality of their products, particularly with regard to security. But that doesn't mean Gates was wrong to say what he said.
When all you have is a hammer, everything looks like a skull.
Common sense tells us to go to the Auto dealer to get a fix done when there is a recall. Granted we all get a notice if that happens but you know not to drive around too long if there is word it could be serious.
But the computer is a tool to most people akin to a screwdriver or hammer, people really dont look to take care of it, they just use it. If more people looked at it like a pet and not a tool, then maybe people would care for their computers.
That being said, it IS his duty to the customer to both make fixes visable and known and not hide them like Microsoft does on a routine basis, and more importantly make things work better the first time so this stuff doesnt happen every 3 weeks.
One of the things that pisses me off the most about Microsoft vs. Apple is that Microsoft defaults almost everything to being open and insecure half the time. Only with XP was stuff not defaulted to on and did they default you to having a firewall to protect stuff.
And it was always stupid stuff no consumer would ever use that was defaulted to being open, and of course you being the consumer didnt know any better. This is more dangerous now when we see more and more computers connecting full time with the use of cable and DSL vs. even 5 years ago when roughly 97% of traffic was 56k, and therefore only on for short periods.
They are taking steps, but Microsoft has to stop denying it has an important roll in this cause honeslty it does. Everyone is using your OS guys, the least you can do is make sure their computers will be safe.
"Slashdot, where telling the truth is overrated but lying is insightful."
This would prevent most buffer overflow attacks.
I think it's correct to assume that you'll never--on a box where many companies can write software--have 100% perfect code. Having hardware at the processor and network level to add security is a fine idea.
Microsoft isn't too far off the mark.
Best Buy can have you arrested
Perfect code is a myth, like extra money, or a temporary tax. What we really need is consistency between the calls, internal (local) or external (web) in the way the buffer is handled and access controls that make sense. At least on the M$ side they still have not recovered from the code mangling idiocy with MSIE and Explorer co-mingling.
errr....umm...*whooosh* *whoosh* Is this thing on ?
You seem to be the only person around here who gets it as far as what security really is.
The Blaster worm was a good thing in that a major flaw which basically rendered permissions irrelevant is now fixed just about everywhere...
The recent RPC bugs have been around since NT 3.51. Do you honestly believe that real hackers have not been taking advantage of that fact for years?
Conformity is the jailer of freedom and enemy of growth. -JFK
You *can't write perfect code. Luckily, you *don't* have to write perfect code, if you write everything in a language that properly handles exceptions. This doesn't mean you shouldn't try to write perfect code...just that if, like every other programmer that has ever touched a keyboard or punch card, you have bugs in your code, you're much better off if your tools are watching your back.
.1% off your linpack benchies...
A good example is the number one favorite tool of the hacker, the buffer overflow. I don't care what OS you have, if you have buffers that can be overflown, you have insecure code. It doesn't matter what "user" the code is running as when it gets full access to your memory and command stack.
So use one of the dozens of languages that won't let you write unchecked code. And you can write as sloppy as you like -- nobody's going to be able to bust down that door. To be honest, i think in the next few years we'll see more of this sort of problem with LINUX than we will with Microsoft. Microsoft is trying to get everybody to write for a virtual machine in languages like C# and VB.NET (which is significantly less of a joke than you think it is). Whereas open source developers seem to pride themselves in sticking to archaic C code...shit, that language was old when I was in MIDDLE SCHOOL (in fact, the computer librarian would only let you check out books on C++). It's not "faster" in today's world, where machines are three clock cycles FASTER than the fastest common interconnect...coding in C is simply some bizarre combination of laziness and bravado. Hey, if you guys want to code in a masochist's language, there's always PERL. The rest of the time we should all be in C++ and Java wherever possible. Sorry if those overflow checks take
Hey freaks: now you're ju
That sounds like a Microsoft way of thinking. Leave the code we have the same, just have add-ons to protect that and add-ons to protect that.....
The core of Windows is so bloated by patches or quick fixes I was confused on the column on Linux Hacks. Maybe it was ment as not to go down the same path. But the code that seems to be quick fixes rarely breaks anything, only makes it better.
No code is perfectly secure and I don't expect worms and such to stop on any OS, IMHO I feel that security needs to be a vital part of Windows' thinking, if they want to keep their market share.
Actually, that's true. For security, you want to minimize the amount of code that's important for security, and the security-relevant pieces have to be right in the sense that they don't allow security to be broken. Even the critical pieces can be imperfect as long as the imperfections don't harm security. But there's a danger here - typically the bar is set far too low. My fear is that this will be interpreted by his developers as "slipshod implementations are still okay." Which is not true - the parts that matter, still matter.
Tools and security audits can help, as can firewalling and keeping up with patches. But that's not enough. Training developers how to develop secure software , and giving them the time to do, is probably even more important. I know Microsoft has done at least some of that, though I don't know how widespread it is and how well it's compensating for all the years they did not do that. Techniques other than the ones he's listing are frankly more critical, too. In particular, the system needs to be broken down into smaller, mutually suspicious pieces with minimal privileges, so that breaking one component doesn't break everything. There needs to be multiple layers of defense. The system needs less tight integration, and it needs to be easier to disable and remove everything not strictly necessary for a particular task. In contrast, firewalling is only a first baby step - his competitors (like Red Hat Linux) enable that by default as a starting point, and so Microsoft is only just catching up there. Besides, viruses are almost entirely an Outlook-unique problem, other systems are designed to not have that weakness in the first place. Patch management is important, but given Warhol worms, they won't be enough - if attacks take a few seconds or minutes, we won't be able to patch every system around the world fast enough.
I hope that Microsoft is doing much more than Mr. Gates is saying here.
- David A. Wheeler (see my Secure Programming HOWTO)
Why? Because the manufacturers put in a switch which makes it hard to do it. The blade won't operate without the lid on.
Now you CAN work out a way to remove the guard and cut off your fingers...if you really want to.
If Windows had been a little better thought through, they'd have locked it down, done more sandboxing and helped people run it in idiot mode, or allow people who know what they are doing to run in non-idiot mode.
I know heaps of people who use their PCs for Word, Excel, web surfing, reading emails, viewing pictures, and playing games. They don't want to install much, and would probably love it if the operating system made it difficult for them to install garbage on their machine.
They want to use it as an appliance, not as a piece of geek tech.
It's sad that the idea of net stations didn't take off, where everything is accessed across a network, and a hard drive is only there for caching. All your data lives on it, and all your programs (which could be rented with services being added).
Of course, you think Microsoft would go for such an idea?
> What kind of message does that send to the developers who work for Gates?
a) That the crap^H^H^H^Hprojects you are working on only have one constraint: the deadline.
b) What you're doing doesn't matter. What marketting says is all that matters.
c) Thought you were hired because of your capabilities of writing good code? Nope. It was because you can get something slapped together and out the door quickly.
d) some combination of the above.
in a corporate environment.
If a computer in the act of being installed is exposed to the net unprotected, your System Admin's need to be dragged out and shot.
If it's getting infected by an infected computer INSIDE the corporate firewall, your IT department needs to be dragged out into the street and shot.
There is absolutely NO GOOD REASON that a computer should be freely attackable in a corporate environment unless the IT Department is grossly incompetent.
I can't agree with that. If the default behavior of all common mail programs so discourages people from executing attachments, I think the worm problem (at least as it exists today with things like sobig) would be effectively solved.
That's not to say that nobody will find a way to execute such a program. The problem with sobig, though, was that so *many* people ended up running it, because of how easy it is to do in mail programs.
Except many worms are spread through more than one means.
A real case I dealt with: the I LOVE YOU virus.
The ILY virus spread through local network shares and e-mail attachments. The parent office of a corp I worked for (2,000 PCs) was hammered with it. It took them two days to clean up.
Then, the next day, some idiot who originally *thought it was a real love note and saved the attachment to his desktop* executed it again -- out of the context of an e-mail attachment.
The shame and humiliation heaped upon him was enough to ensure he wouldn't ignore IT memos again. However, it brought the e-mail servers down a second day while it was fixed. Again.
In a LAN environment, all it takes is one idiot.
Learning HOW to think is more important than learning WHAT to think.
Bill Gates says 'You don't need perfect code to avoid security problems.' Instead he suggests that users acquire and properly configure firewalls and make sure that they keep their software patches up-to-date.
Come on now. I deal with end-users all the time. They have problems finding their damn "start" buttons, and the illustious Mr. Gates is suggesting that these users install and configure their own firewalls?
True, there is no perfect OS and all OS's are going to be vulnerable in some way. True again that Windows holds the desktop market in it greasy hands, but instead of attempting to meet "corperate deadlines" and wasting time and money by adding functionality into the OS consequently putting other companies out of business, lets start writing some quality code. Screw the deadlines.
This annoys me.
If you are a developer and you believe that code can be perfect or that it even NEEDS to be in order for users to be protected then I would suggest that you've never worked on any projects of any size. If you are a developer who claims to write perfect code then I invite you to send me your resume.
The truth of the matter, and anyone who has done professional software development knows this, is that it is impossible to write perfect code. Yes, even under our beloved Linux. Indeed, EVEN our beloved Linux. The challenge is to implement within that imperfect code solid security procedures that deal with, and protects the end user from that code.
Really folks, I hate Gates as much as the next guy, but he isn't wrong in EVERY single thing he says. Sheesh.
Anthony Papillion
Advanced Data Concepts, Inc.
"Quality Custom Software and IT Services"
That's why I find free software to be superior to non-free software. With non-free software you must "rely on someone else to keep your computer secure" because only one person or organization has the source code and the legal authority to improve the software. If a program is Free Software for me, I get to choose how much time am I willing to spend developing the skill to improve my software to suit my needs. It doesn't matter to society how much of that freedom I leverage, what matters is that I have the freedom. But I want that freedom for everyone else too. I benefit from more people having these freedoms because I benefit when those people leverage those freedoms in clever ways.
This is also where I somewhat part with the Open Source movement. On the one hand, I'm glad for all the attention they've helped bring to Free Software licenses (particularly the GNU GPL), but on the other hand I (as a user) want the freedom to share and modify software. I'm not against businesses having the freedoms of Free Software, but I don't want to tailor my message for them or pitch chiefly to them. The GNU project tells about an interesting episode in their their essay on the difference between Free Software and Open Source:
stratjakt wrote:
Nothing is perfect, so arguing about our need for perfection seems to me to be a moot point. I think we need a system to give as many people the freedoms to inspect, share, and modify software so software can meet people's needs. The proprietary model of software development and distribution does not give us these freedoms.
Digital Citizen
Users want software that works, that does the job it's supposed to do. What should users be expected to know and do? Basic security, such as updates and securing against somewhat standard threats (such as Outlook attachments) might be reasonable, but I was under the impression that the documentation for changing these features was less than outstanding. In some cases, the updates may either not work or may come with onerous EULA (WMP 9.0).
I didn't RTA, but BG seems to expect users to know as much as the virus/script writers and perhaps more than his own engineers to secure their computers. While there is a lot of avoidance of responsibility on the part of users for security flaws, it seems unreasonable to have to spend significant amounts of time to know the inner workings of their system to use it, particularly when Microsoft seems more interested in adding "features" such as "trusted computing" than to write correct code and patches.
In order to drive, I have to look at the oil, gas, and tire pressure to keep it OK, and I have to know how to drive competently, but I don't have to understand my transmission much to run the car. It would be harder for lots of people to secure their cars if, in addition to the locks, the engine had multiple overrides to allow other users access which would either be listed on p.600 of the Advanced Mechanics' Maintenance Manual for your car or available by downloading from the manufacturers' website along with great features such as a governor that limits you to 55 mph or which rejects non-Exxon gas. MS sells its OS to people solely interested in using it, yet it neither is willing to clarify the requirements for maintaining security nor to write working software or patches. Instead, MS is better at blaming or hindering its users than in actually achieving the "security" they trumpet so loudly.
If you want users' help in improving security, BG, a good start might be to work with your users rather than against them. Whatever legitimate points you make are diluted by your cavalier attitude about the flaws of MS software and the antagonistic attitude of MS towards the users of its software with respect to security (trusted computing again) - improvements at security seem to secure software from use by legitimate agents rather than from use by illegitimate agents (virus writers and crackers). Users should be your customers, not the enemy. If you believe that users should behave differently, than clarifying the correct behavior to users without a BS in EE/CS would help; setting insecure features to default off might help too.. Then if users want to shoot themselves in the foot, they might have to learn something (and thus might learn not to do that). MS warnings about user security sound like "don't engage in unsafe sex" talks from condom makers who make defective products.
That a computer system's administrator should be fairly intelligent, able to read and learn how to do new and complex things and stay up to date with technology.
What the hell were we thinking....??
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Your thinking is one of the reasons that security is often breached. It is not possible to think about computer security without securing the computer physically. The security process requires holistic thinking. You cannot just dismiss ways to bybass security with a "well, of course somebody could do that". A cracker may find it easiest to get in via the wire, but a determined cracker won't stop at that. Unless you are thinking of every way to break in, just like an attacker would, you have vulnerabilities.
There are other ways around the wire as well. What if your mother (child, significant other, friend, employee) were using your computer (you let them while you aren't home), and somebody calls you and impersonate you or claims to be a friend calling on your behalf. The attacker has her go to a website, download a program, and run it. The program reads your private data and sends it. Do you expect Microsoft to prevent this type of attack? There are some things you can do to lock a system down so users can't install and run software, or upload to the internet, but it is a hard problem to solve.
IS NOT
'you can't rely on perfect code for security'
First, imperfect code is a security problem. M$ has many flaws and they know it each time they ship code. The kind of problems M$ has extends to poor design as well, so it would break even if it were perfect.
Second, Bill's statement implies that his company never will get better. That's something anyone familiar with M$'s history and hype knows, but it's kind of in-your-face for him to put it that way then blame the users again.
Get back in your hole, appologist troll.
Friends don't help friends install M$ junk.
It was Microsoft who told these home users that they could be connected without any hassles. They can't just backtrack now and blame their users.
So yes Unix may be secure but it is arcane and difficult to learn and use.. but no unix vendor has ever stated (afaik) that anyone can use their product without any knowledge about computers.
What a rotten party, have we run out of beer or something?
Actually, the last point is worse than bullshit. It's downright dangerous.
One of the most important rules of security is: Don't engineer a single point of failure. The reason for firewalls et al is that we know that the software that they protect will be insecure despite our best efforts. That's why we put up an additional barrier.
Relying on firewalls because we made the software insecure and have no intention of fixing it is effectively engineering a single point of failure.
sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
OpenBSD people were arguing over this point a year or two ago. C is known far and wide as the number one source of buffer overflows. Theo de Raadt postion for a while was that competent C programmers and a "secure by default" configuration was the way to go. But then there were a couple of embarassments in the OBSD camp, and Theo got sick and tired of repairing buffer overflows after the fact, so he added in stack protection and noexecutable pages to give OpenBSD users another "layer" of protection. FreeBSD has added support for ACL's to go with LOMAC and PAM (Linux), all of which are arguably redundant by Unix standards, but the demand for them is there. If people really trusted the network daemons running on their machines, why would they need firewalls?