Gates: 'You don't need perfect code' for Security

securitas writes "ITBusiness has an interview from the Microsoft Professional Developers Conference where Bill Gates says 'You don't need perfect code to avoid security problems.' Instead he suggests that users acquire and properly configure firewalls and make sure that they keep their software patches up-to-date. Considering that Microsoft says it is focused on security, the comments from the Chief Software Architect aren't inspiring, especially beacuse the underlying attitude seems to contradict the idea of well-written, secure code. What kind of message does that send to the developers who work for Gates?"

Comments

Since when is Bill Gates a security expert?

[dtolton]

This is a typical problem, that was discussed a few days ago. People
are confusing microsoft's success in general with Technological
superiority.

I find it interesting that *anyone* would care what Bill Gate's
opinion is on security. The volume of critical problems reported, and
of actual viruses and worms that have spread across the internet
lately should've been enough to indicate that microsoft doesn't have a
good understanding of security in general.

His argument is an interesting point of view though. It sounds to me
like he's saying microsoft doesn't need perfect code because people
can just install firewalls. What if the code in the firewalls in turn
isn't perfect though? Doesn't that leave us in an insecure position
again? What about the e-mail scanning software? What if it misses a
virus? Shouldn't you have layers of protection, instead of an outer
layer of protection and a soft underbelly?

Of course he is shifting the burden back to the users of the software
again. If only they had our firewall product and a good e-mail
scanning software package, and if they kept their software up to date
none of this would've happened.

Of course if they didn't ship their software with nearly every service
turned on by default, and everyone running as root this wouldn't have
happened either, but let's not trifle with details.

I really liked the part at the end where he comments that all the
viruses and attacks on microsoft's os are really a compliment.

You keep telling yourself that Bill.

Re:Since when is Bill Gates a security expert?

[mcspock]

I dont even see why this is news. No code is perfect, especially at the OS level. If you think about it abstractly, what gates is saying is that security should be layered, so you have multiple filters protecting you.

The part about it "being a complement", which i dont really agree with, is based on the fact that windows is high visibility, so it gets the most attention from virus writers.

The whole argument is silly though - windows is what happens when you have a desktop only operating system and transition it into a network enabled system. You end up with design flaws (everyone runs as "root") and security holes.

Re:Since when is Bill Gates a security expert?

[Rhys]

The really great thing is we just had a Microsoft security speaker at the ACM Reflections|Projections conference at UIUC.

He was talking about how important it is to have secure code, and all the initiatives they have to fix security holes.

He also talked about how fast worms are spreading these days. Patching is not going to be sufficient - a bug discovered and posted will turn into a worm hours or days before Microsoft will respond with a patch. By then it'll be too late.

Re:Since when is Bill Gates a security expert?

[retinaburn]

microsoft doesn't have a
good understanding of security in general.

Just because their code is bad doesn't mean they don't understand security, it may just mean it is not profitable to write perfectly secure code.....and they get money from upgrades :)

Re:Since when is Bill Gates a security expert?

[murdocj]

Ok, where does the OS end and the application begin?

This is the core of the problem. I talked to a guy I had worked with who was at MS and was complaining about how the MS Office group was implementing all sorts of O/S features in Office because they needed them. MS has never had the concept of seperating O/S functions from application functions. As a result, you end up with holes because the core O/S is performing operations that should be in apps, and the apps are doing the work of the O/S.

Perhaps in theory Windows has now been layered to an extent that it could function similar to UNIX, but in practice MS continues to prefer lots of functionality over security. And as the interview shows, that attitude comes down right from the top.

Re:Since when is Bill Gates a security expert?

[Dark Fire]

Both Windows and Unix are based on 20 year old ideas. The similarities between VMS and Windows are quite astonishing. There was an article on /. a while back about it.

I agree that many security problems in both unix and windows come from poor application design.

Compare designs between qmail and sendmail. qmail is a properly constructed unix application that takes advantage of all the facilities unix provides. sendmail is a blob. bind also suffers from being a blob. sendmail and bind alone account for a good portion of unix related vulnerabilities.

Bind and sendmail are applications in the unix world.

Unix and Windows may bother be at heart very solid designs. Remember though that microsoft isn't just responsible for the operating system, but for many of the most popular windows applications as well. IIS, Office, file/print services, exchange, etc.

Microsoft goal has always been integration. Integration and Security are opposing goals.

Single sign-on is a good example. To prevent someone from entering their password each time they want to utilitize a secure resource, you ask them for their username and password once and then cache the username/password. By doing this, you have sacrificed security for integration. The cache acts as an integrated security service that transparently lets any program that runs act with your full authority on all security resources that you are permitted to utilize for as long as your credentials remain in effect.

Re:Since when is Bill Gates a security expert?

[evilpenguin]

There's a famous quote, wish I could remember who said it (someone leap in with attribution!) (and I'm quoting from memory, so I'm sure I'm misquoting...)

"It is axiomatic that every program contains at least one bug and can be reduced in size by at least one instruction, therefore, every computer program can be reduced to a single instruction which does not work."

There's the singularity on your asymptotic curve ;-)

"Sometimes imperfect code is better"

[Anonymous Coward]

For example, if you introduce a bug that breaks the TCPIP stack, that's going to really secure things nicely.

As an SSL developer

[Anonymous Coward]

I couldn't agree more.

Majority of security issues come not from buffer overflows in the application code or similar stuff, but from dumb users clicking on e-mail attachments and downloading wicked screensavers.

Ever ran Spybot through a typical home user computer? Middle-aged women seem to be the worst offenders, Spybot and Ad-aware have pages and pages of stuff that the user usually isn't aware about.

Re:As an SSL developer

[RatBastard]

Middle-aged women seem to be the worst offenders

Of course they are. They tend to be trusting and don't realize that perfect strangers are more than willing to screw them into the ground. But the OS doesn't need to be a welcome mat for these problems. There are some very basic things that MS could have done to make Windows secure enough that being a trusting user doesn't put the entire system at risk.

To make a analogy that fits users of this level and background, your point is like saying that cars are less likely to get stolen if the doors are locked and blaming said car owners for because their Fnords are getting stollen because they haven't locked the doors that Fnord didn't bother to install in the first place.

Read into it what you want

[stratjakt]

It makes sense to me. Don't rely on someone else to keep your computer secure. Take steps yourself.

Look at me, I'm just going to get the latest debian iso and install it and not worry about anything!

Look at me, I'm just going to go buy a car and not worry about locking the doors or using a club, because I expect that the ignition system is tamper proof.

Don't blame the architect when someone comes through an unlocked window in your home and steals your stereo.

No, you don't need perfect code. Linux has no "perfect code". If it did, Linus et al would be finished and have moved on to other things.

I dont rely on Linus for security, I don't rely on Bill Gates for security. At the end of the day, it's my system, and it's up to me to take steps to protect it.

Re:Read into it what you want

[DeltaSigma]

I'm not disagreeing with you, or trying to dampen your point.

You might be a college graduate, hell a professor when it comes to security. You might have an understanding of every open cryptic algorithm in use today. You just might have learning and experience which has engraved security processes onto your heart.

But then, there's the rest of us. I'm a simple web/graphics designer. I don't even know how to compile a program. The most complicated things I produce are script. In the technical arena my contributions are child's play. As a long-time windows user, I had no concept of security. It was accepted fact that I had to patch and run process sapping virus scanners to prevent what was inevitable anyways, the infection and subsequent re-install of my operating system.

In the last year, I switched to Linux. Debian, first, now RedHat 9.

It's Linux that taught me security. It's Linux that gave me a better understanding of how ports work, how services can be hijacked and used to tamper with your machine, how random programs can degrade my security, how running as root is like volunteering my machine to be a DOS attack zombie.

Linux isn't inherantly secure due to superior code (don't get me wrong though, I strongly believe Linux utilizes superior code). It's inherantly secure because it conditions its user to consider security. Debian and RedHat taught me where vulnerabilities can exist in my operating system, and how to account for them.

Thanks to Debian and RedHat, my Windows box is more secure as well.

I may not have the safest internet-connected box on the face of this earth, but I can rest assured I'm in the top 10% when I'm using my Linux-based operating systems.

Re:Read into it what you want

[Zelet]

Your arguement is flawed. A better analogy would be:

I have a car. Even though I locked the door... it fell off.

Basically what I'm saying is that the basic of security that the manufacturer should provide isn't functioning. Of course I could always use 'the club' but the door shouldn't fall off the hinges.

Of course if you wanted a true analogy of what Windows security is like:

You can lock the doors - but the door locks are hidden and my mom couldn't figure out how to do it and the doors come unlocked by default. Even if you lock the doors the windows are always open - and there is no way to close them without buying the windows rollers yourself. If somebody gets into your car not only can the ignition be turned by any basic screw driver but they could blow up the entire car - including the engine by using easy to use functions from within the cabin of the car.

Now take OS X (I haven't used Linux in a while so I'm more familiar with OS X)

Your car comes with the doors locked by default. The windows are all rolled up. If somebody DOES get into the car - they can trash the cabin but can't destroy the engine.

Security is a process not a state

[DeadSea]

There is no such thing as being secure.
There is no such thing as software without bugs.
There is no such thing as an operating system without vulnerabilities.
No scan will find all the holes.
No firewall will protect you from all attacks.
No patch will fix all your systems.
No intrusion detection system will catch all breakins.
No employee screening process will weed out all the criminals.
No employee training program will eliminate all employee mistakes.
Security cannot be purchased.
Security cannot be achieved.

The security process is a checklist of items that should be evaluated and expanded periodically.
Continuously and actively search for vulnerabilities. If the cracker knows about the hole before you do, you have a problem. Run scanners, hire people to test your security.
Read security advisories, keep systems up to date with the latest patches, consult others who also try try to keep their security bar high.
Take preventative measures: install a firewall, train employees to use secure practices, implement stricter checks and balances.
Detect problems with intrusion detection systems. Put up honeypots and tripwires. Enable logging.

It scares me, but Microsoft is right.

Best excuse for code bloat

[isn't my name]

Gates said:

I mean, people act like some other systems don't have vulnerabilities; actually all the forms of Unix as well as Linux have had more vulnerabilities per line of code.

Now, that is the best justification for MS code bloat I have ever heard. It reduces your security vulnerability density!

Re:Unix is difficult, Windows is easy to use

[cayenne8]

"Unix may be secure but it is arcane and difficult to learn and use."

That a computer system's administrator should be fairly intelligent, able to read and learn how to do new and complex things and stay up to date with technology.

What the hell were we thinking....??

...sarcasm mode off...

Who is Bill Gates?

[Dr. Molf]

Who is Bill Gates?

I would like to hear what a real security expert like Jeff Goldblum had to say, though. After all, he managed to interface a Mac with an Alien computer. I mean, he's no Sandra Bullock, but he's still a pretty good "hacker". (That's the correct term, right?)