Slashdot Mirror
Gates: 'You don't need perfect code' for Security
securitas writes "ITBusiness has an interview from the Microsoft Professional Developers Conference where Bill Gates says 'You don't need perfect code to avoid security problems.' Instead he suggests that users acquire and properly configure firewalls and make sure that they keep their software patches up-to-date. Considering that Microsoft says it is focused on security, the comments from the Chief Software Architect aren't inspiring, especially beacuse the underlying attitude seems to contradict the idea of well-written, secure code. What kind of message does that send to the developers who work for Gates?"
This is a typical problem, that was discussed a few days ago. People
are confusing microsoft's success in general with Technological
superiority.
I find it interesting that *anyone* would care what Bill Gate's
opinion is on security. The volume of critical problems reported, and
of actual viruses and worms that have spread across the internet
lately should've been enough to indicate that microsoft doesn't have a
good understanding of security in general.
His argument is an interesting point of view though. It sounds to me
like he's saying microsoft doesn't need perfect code because people
can just install firewalls. What if the code in the firewalls in turn
isn't perfect though? Doesn't that leave us in an insecure position
again? What about the e-mail scanning software? What if it misses a
virus? Shouldn't you have layers of protection, instead of an outer
layer of protection and a soft underbelly?
Of course he is shifting the burden back to the users of the software
again. If only they had our firewall product and a good e-mail
scanning software package, and if they kept their software up to date
none of this would've happened.
Of course if they didn't ship their software with nearly every service
turned on by default, and everyone running as root this wouldn't have
happened either, but let's not trifle with details.
I really liked the part at the end where he comments that all the
viruses and attacks on microsoft's os are really a compliment.
You keep telling yourself that Bill.
Doug Tolton
"The destruction of a value which is, will not bring value to that which isn't." -John Galt
For example, if you introduce a bug that breaks the TCPIP stack, that's going to really secure things nicely.
I couldn't agree more.
Majority of security issues come not from buffer overflows in the application code or similar stuff, but from dumb users clicking on e-mail attachments and downloading wicked screensavers.
Ever ran Spybot through a typical home user computer? Middle-aged women seem to be the worst offenders, Spybot and Ad-aware have pages and pages of stuff that the user usually isn't aware about.
and he's absolutely right. We could just unplug our computers and leave them in a cold, dark room all by themselves, with no power.
For the rest of us, however, security starts with the code.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
If we are not going to rely on perfect code but expect firewalls to catch the problems, then what do we do if the code in the firewalls aren't perfect?
Do we string together a series of firewalls in the hope that the code problems don't overlap?
It makes sense to me. Don't rely on someone else to keep your computer secure. Take steps yourself.
Look at me, I'm just going to get the latest debian iso and install it and not worry about anything!
Look at me, I'm just going to go buy a car and not worry about locking the doors or using a club, because I expect that the ignition system is tamper proof.
Don't blame the architect when someone comes through an unlocked window in your home and steals your stereo.
No, you don't need perfect code. Linux has no "perfect code". If it did, Linus et al would be finished and have moved on to other things.
I dont rely on Linus for security, I don't rely on Bill Gates for security. At the end of the day, it's my system, and it's up to me to take steps to protect it.
I don't need no instructions to know how to rock!!!!
Blame the user, not the developer, is the message.
Its not the users responsibly to compensate for poor design, regardless of the product. Be it an unsafe car, or insecure OS.
---- Booth was a patriot ----
By that logic, Microsoft software should be the securest software around.
"You don't need perfect code to avoid security problems. There are things we're doing that are making code closer to perfect, in terms of tools and security audits and things like that. But there are two other techniques: one is called firewalling and the other is called keeping the software up to date. None of these problems (viruses and worms) happened to people who did either one of those things."
The first sentence is correct -- or moot. The last is pure bullshit.
"Perfect" code is probably unattainable in complex applications. This is why things like firewalls, IDS, backups, etc. exist. Code should be made as good as possible, but dwelling on perfection will only pull your focus from other issues.
However, no virus or firewall in the world is gonna stop a cluleless user from clicking on an attachment and screwing their system. Virus scanners are mostly reactionary -- if it isn't in their list of malware, they can't find it. If it is a new way to screw users, and they click it...
EVEN if users have to jump through hoops like not executing from inside the mail program, saving it to the desktop, unzipping, scanning -- they'll screw something up. It is the nature of the beast.
Even with sandboxing -- good luck getting a user to execute the code in a sandbox first, every time.
Learning HOW to think is more important than learning WHAT to think.
What kind of message does that send to the developers who work for Gates?
That it's time to get more G5's because 18 isn't enough...
Business \Busi"ness\, n.;
A scam in which all people involved perceive as beneficial...
BillG: "You don't need secure code".
(aside to Ballmer - "The Force gives power over weak minds")
Ballmer: "Um yes, the Force gives power over weak minds."
BillG: "Steve, stop that!"
Ballmer: "Um... Steve, stop that!"
I want to delete my account but Slashdot doesn't allow it.
How much trouble their products have when seperated by stateful firewalls. I mean, it wasn't until after AD was out for a bit that they realized you couldn't put a firewall between them and for large corporations, that wasn't acceptable. Now there is a bogus work-around, but ultimately W2K is horrible at dealing with firewalls inside the enterprise.
And the whole idea of a protected shell, soft middle has been destroyed by the likes of Nimbda, Nachi, etc. Eventually, someone gets past the outer shell.
We like to keep all of our satallite locations seperated by Firewalls, but as we started moving to W2K3 we found out Microsoft won't support our infrastrucure with internal firewalls...
Real nice Bill, thanks for the help.
This sig is the express property of someone.
From a military perspective, "patching" is equivalent to deploying your forces to protect against kids throwing rocks over the base fence. That won't help when an organized force attacks.
I'd say two things to him. First, the only completely effective firewall is the one where I unplug my computer. Assuming you leave a port open, that's a possibility for an attack. Second, all a hacker needs is a proper buffer-overflow in a user program that employs that port, and it's fun time. I'm sure Internet Exploder etc wouldn't apply there. No, not at all.
He has a point in that firewalls have to be a large part of the solution. However, the idea that I can write the world's shittiest code and this is OK because I have a firewall is ludicrous.
Naturally, all this assumes you don't buy your firewall software from MS. That would be pretty funny.
-Looking for a job as a materials chemist or multivariat
seriously.
I don't understand why no one raises the patch size issue. To fix a buffer overflow, you've got to need what, 2K of modified code, tops? But the patch is like 2MB? Or 20MB?
In the US, where most people are still on dialup, how can anyone reasonably expect that people are going to download tens of megabytes of patches?
Microsoft should be mailing out free CDs with the latest patches.
thats hilarious .. you dont need good code to be sure .. you only need somebody else's good code to run a firewall.
oh lordy.
"Old man yells at systemd"
There is no such thing as software without bugs.
There is no such thing as an operating system without vulnerabilities.
No scan will find all the holes.
No firewall will protect you from all attacks.
No patch will fix all your systems.
No intrusion detection system will catch all breakins.
No employee screening process will weed out all the criminals.
No employee training program will eliminate all employee mistakes.
Security cannot be purchased.
Security cannot be achieved.
The security process is a checklist of items that should be evaluated and expanded periodically.
Continuously and actively search for vulnerabilities. If the cracker knows about the hole before you do, you have a problem. Run scanners, hire people to test your security.
Read security advisories, keep systems up to date with the latest patches, consult others who also try try to keep their security bar high.
Take preventative measures: install a firewall, train employees to use secure practices, implement stricter checks and balances.
Detect problems with intrusion detection systems. Put up honeypots and tripwires. Enable logging.
It scares me, but Microsoft is right.
Don't worry, Windows is making strides in stability every day because of it's open design and collaborative development process. One day, it will be a suitable desktop operating system. Maybe it will even be enterprise ready. But that's still a ways off.
This signature has Super Cow Powers
I can't agree with that. If the default behavior of all common mail programs so discourages people from executing attachments, I think the worm problem (at least as it exists today with things like sobig) would be effectively solved.
That's not to say that nobody will find a way to execute such a program. The problem with sobig, though, was that so *many* people ended up running it, because of how easy it is to do in mail programs.
Except many worms are spread through more than one means.
A real case I dealt with: the I LOVE YOU virus.
The ILY virus spread through local network shares and e-mail attachments. The parent office of a corp I worked for (2,000 PCs) was hammered with it. It took them two days to clean up.
Then, the next day, some idiot who originally *thought it was a real love note and saved the attachment to his desktop* executed it again -- out of the context of an e-mail attachment.
The shame and humiliation heaped upon him was enough to ensure he wouldn't ignore IT memos again. However, it brought the e-mail servers down a second day while it was fixed. Again.
In a LAN environment, all it takes is one idiot.
Learning HOW to think is more important than learning WHAT to think.
Gates said:
I mean, people act like some other systems don't have vulnerabilities; actually all the forms of Unix as well as Linux have had more vulnerabilities per line of code.
Now, that is the best justification for MS code bloat I have ever heard. It reduces your security vulnerability density!
That a computer system's administrator should be fairly intelligent, able to read and learn how to do new and complex things and stay up to date with technology.
What the hell were we thinking....??
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Who is Bill Gates?
I would like to hear what a real security expert like Jeff Goldblum had to say, though. After all, he managed to interface a Mac with an Alien computer. I mean, he's no Sandra Bullock, but he's still a pretty good "hacker". (That's the correct term, right?)
indeed..