Gates: 'You don't need perfect code' for Security

securitas writes "ITBusiness has an interview from the Microsoft Professional Developers Conference where Bill Gates says 'You don't need perfect code to avoid security problems.' Instead he suggests that users acquire and properly configure firewalls and make sure that they keep their software patches up-to-date. Considering that Microsoft says it is focused on security, the comments from the Chief Software Architect aren't inspiring, especially beacuse the underlying attitude seems to contradict the idea of well-written, secure code. What kind of message does that send to the developers who work for Gates?"

Comments

Since when is Bill Gates a security expert?

[dtolton]

This is a typical problem, that was discussed a few days ago. People
are confusing microsoft's success in general with Technological
superiority.

I find it interesting that *anyone* would care what Bill Gate's
opinion is on security. The volume of critical problems reported, and
of actual viruses and worms that have spread across the internet
lately should've been enough to indicate that microsoft doesn't have a
good understanding of security in general.

His argument is an interesting point of view though. It sounds to me
like he's saying microsoft doesn't need perfect code because people
can just install firewalls. What if the code in the firewalls in turn
isn't perfect though? Doesn't that leave us in an insecure position
again? What about the e-mail scanning software? What if it misses a
virus? Shouldn't you have layers of protection, instead of an outer
layer of protection and a soft underbelly?

Of course he is shifting the burden back to the users of the software
again. If only they had our firewall product and a good e-mail
scanning software package, and if they kept their software up to date
none of this would've happened.

Of course if they didn't ship their software with nearly every service
turned on by default, and everyone running as root this wouldn't have
happened either, but let's not trifle with details.

I really liked the part at the end where he comments that all the
viruses and attacks on microsoft's os are really a compliment.

You keep telling yourself that Bill.

Re:Since when is Bill Gates a security expert?

[mcspock]

I dont even see why this is news. No code is perfect, especially at the OS level. If you think about it abstractly, what gates is saying is that security should be layered, so you have multiple filters protecting you.

The part about it "being a complement", which i dont really agree with, is based on the fact that windows is high visibility, so it gets the most attention from virus writers.

The whole argument is silly though - windows is what happens when you have a desktop only operating system and transition it into a network enabled system. You end up with design flaws (everyone runs as "root") and security holes.

Re:Since when is Bill Gates a security expert?

[retinaburn]

microsoft doesn't have a
good understanding of security in general.

Just because their code is bad doesn't mean they don't understand security, it may just mean it is not profitable to write perfectly secure code.....and they get money from upgrades :)

Re:Since when is Bill Gates a security expert?

[murdocj]

Ok, where does the OS end and the application begin?

This is the core of the problem. I talked to a guy I had worked with who was at MS and was complaining about how the MS Office group was implementing all sorts of O/S features in Office because they needed them. MS has never had the concept of seperating O/S functions from application functions. As a result, you end up with holes because the core O/S is performing operations that should be in apps, and the apps are doing the work of the O/S.

Perhaps in theory Windows has now been layered to an extent that it could function similar to UNIX, but in practice MS continues to prefer lots of functionality over security. And as the interview shows, that attitude comes down right from the top.

Re:Since when is Bill Gates a security expert?

[Dark Fire]

Both Windows and Unix are based on 20 year old ideas. The similarities between VMS and Windows are quite astonishing. There was an article on /. a while back about it.

I agree that many security problems in both unix and windows come from poor application design.

Compare designs between qmail and sendmail. qmail is a properly constructed unix application that takes advantage of all the facilities unix provides. sendmail is a blob. bind also suffers from being a blob. sendmail and bind alone account for a good portion of unix related vulnerabilities.

Bind and sendmail are applications in the unix world.

Unix and Windows may bother be at heart very solid designs. Remember though that microsoft isn't just responsible for the operating system, but for many of the most popular windows applications as well. IIS, Office, file/print services, exchange, etc.

Microsoft goal has always been integration. Integration and Security are opposing goals.

Single sign-on is a good example. To prevent someone from entering their password each time they want to utilitize a secure resource, you ask them for their username and password once and then cache the username/password. By doing this, you have sacrificed security for integration. The cache acts as an integrated security service that transparently lets any program that runs act with your full authority on all security resources that you are permitted to utilize for as long as your credentials remain in effect.

Read into it what you want

[stratjakt]

It makes sense to me. Don't rely on someone else to keep your computer secure. Take steps yourself.

Look at me, I'm just going to get the latest debian iso and install it and not worry about anything!

Look at me, I'm just going to go buy a car and not worry about locking the doors or using a club, because I expect that the ignition system is tamper proof.

Don't blame the architect when someone comes through an unlocked window in your home and steals your stereo.

No, you don't need perfect code. Linux has no "perfect code". If it did, Linus et al would be finished and have moved on to other things.

I dont rely on Linus for security, I don't rely on Bill Gates for security. At the end of the day, it's my system, and it's up to me to take steps to protect it.

Re:Read into it what you want

[DeltaSigma]

I'm not disagreeing with you, or trying to dampen your point.

You might be a college graduate, hell a professor when it comes to security. You might have an understanding of every open cryptic algorithm in use today. You just might have learning and experience which has engraved security processes onto your heart.

But then, there's the rest of us. I'm a simple web/graphics designer. I don't even know how to compile a program. The most complicated things I produce are script. In the technical arena my contributions are child's play. As a long-time windows user, I had no concept of security. It was accepted fact that I had to patch and run process sapping virus scanners to prevent what was inevitable anyways, the infection and subsequent re-install of my operating system.

In the last year, I switched to Linux. Debian, first, now RedHat 9.

It's Linux that taught me security. It's Linux that gave me a better understanding of how ports work, how services can be hijacked and used to tamper with your machine, how random programs can degrade my security, how running as root is like volunteering my machine to be a DOS attack zombie.

Linux isn't inherantly secure due to superior code (don't get me wrong though, I strongly believe Linux utilizes superior code). It's inherantly secure because it conditions its user to consider security. Debian and RedHat taught me where vulnerabilities can exist in my operating system, and how to account for them.

Thanks to Debian and RedHat, my Windows box is more secure as well.

I may not have the safest internet-connected box on the face of this earth, but I can rest assured I'm in the top 10% when I'm using my Linux-based operating systems.

Re:Read into it what you want

[Zelet]

Your arguement is flawed. A better analogy would be:

I have a car. Even though I locked the door... it fell off.

Basically what I'm saying is that the basic of security that the manufacturer should provide isn't functioning. Of course I could always use 'the club' but the door shouldn't fall off the hinges.

Of course if you wanted a true analogy of what Windows security is like:

You can lock the doors - but the door locks are hidden and my mom couldn't figure out how to do it and the doors come unlocked by default. Even if you lock the doors the windows are always open - and there is no way to close them without buying the windows rollers yourself. If somebody gets into your car not only can the ignition be turned by any basic screw driver but they could blow up the entire car - including the engine by using easy to use functions from within the cabin of the car.

Now take OS X (I haven't used Linux in a while so I'm more familiar with OS X)

Your car comes with the doors locked by default. The windows are all rolled up. If somebody DOES get into the car - they can trash the cabin but can't destroy the engine.

Re:As an SSL developer

[RatBastard]

Middle-aged women seem to be the worst offenders

Of course they are. They tend to be trusting and don't realize that perfect strangers are more than willing to screw them into the ground. But the OS doesn't need to be a welcome mat for these problems. There are some very basic things that MS could have done to make Windows secure enough that being a trusting user doesn't put the entire system at risk.

To make a analogy that fits users of this level and background, your point is like saying that cars are less likely to get stolen if the doors are locked and blaming said car owners for because their Fnords are getting stollen because they haven't locked the doors that Fnord didn't bother to install in the first place.

Re:Unix is difficult, Windows is easy to use

[cayenne8]

"Unix may be secure but it is arcane and difficult to learn and use."

That a computer system's administrator should be fairly intelligent, able to read and learn how to do new and complex things and stay up to date with technology.

What the hell were we thinking....??

...sarcasm mode off...