Microsoft To Share Office Source Code

Interesting by StateOfTheUnion · 2004-09-20 00:03 · Score: 4, Interesting

Interesting . . . wonder how long it will take to leak out of one of these offices and wind up on file sharing sites?

Re:Interesting by Lumpy · 2004-09-20 00:20 · Score: 3, Interesting

that would be devastating.

Any of these "governments" will have a hard time getting competent coders to look at the code, as the second you do, you become "tainted" and pretty damn unemployable. Microsoft would love to be able to play the lawsuit card on any company that hired someone that ever saw that code... ESPICALLY if they worked for a company making software that interoperates or is even remotely similar to Office.

Having access to any of Microsoft's source code is the poison/suicide pill for any programmer in today's sue, sue, sue litigation is business as usual environment.

--
Do not look at laser with remaining good eye.
Re:Interesting by glyph42 · 2004-09-20 01:27 · Score: 5, Interesting

Source code watermarking is a hot research topic. You do it by inserting *logic* into the code, not just text. The logic, thanks to the hardness of SAT, can be constructed so that it is nigh impossible to see which parts will be run and which will not. Thus it becomes impossible to remove the logic, even for a nice optimizing compiler. There are side effects built into these bits of code, such that no matter how it is modified, rearranged, and compiled, the side effects can be read (by you, the programmer) to identify which copy of the source code it comes from. Of course, the code will become somewhat obfuscated and difficult to read, but hey :P There are tools already available for watermarking Java.

Google for: "source code" watermarking filetype:pdf

--
Music speeds up when you yawn, but does not change pitch.
Re:Interesting by Destoo · 2004-09-20 01:45 · Score: 3, Interesting

Version 1:

#include "windows.h"
int main(void)
{
RunWinders();
return 0;
}

Version 2:

#include "windows.h"
int main(void)
{
RunWinders();
return 0;
}

Then a version with tabs.. and stuff like that.
And pass each section through some sort of CRC checks.

Easy to find if you get your hands on two versions leaked. But what are the odds of that happening.</sarcasm>

--
Nouvelles de jeux et technologies en français. TC
Re:Interesting by ajs · 2004-09-20 02:06 · Score: 4, Interesting

It's much easier to just add whitespace at the ends of lines. There's software out there that hides text in source code by doing this. Bottom line: if you get source from MS, don't give it to anyone else unless you're unafraid of being fingered as the one who did it. There are DOZENS of ways to embed IDs in code (changing variable names, subtle differences in whitespace, bury an ID in an include file somewhere, encode it in filenames, switch which files constants are defined in, etc, etc.) If they're smart (and while MS may be large and unscrupulous, we should give them credit for being smart), they'll use several of these techniques at once.

No source for you by cermanius · 2004-09-20 00:04 · Score: 4, Interesting

Only 30 eh? It doesn't mention anything about M.S. letting the US government see the code. Think they might still be a little bitter with that whole "You have a monopoly. We can't let you do that..." thing? Or do you think M.S. is afraid the Department of Homeland Security might issue another advisory saying that Office 2003 is insecure and everyone should switch to Open Office.

--
"Don't sweat the petty stuff and don't pet the sweaty stuff." -- by an Unknown Wise man.

Readable? by Daengbo · 2004-09-20 00:05 · Score: 5, Interesting

If the reports that I've heard are true about the code, it's so confusing that the developers are afraid to change much lest they break something. All that backward compatability screws everything up. Could the govenments make much sense of it if the MS developers are having a hard time?

Love this part:

Redmond, Washington-based Microsoft keeps its source code closely guarded, and requires any governments or companies to sign agreements not to divulge the data that is used to create its software programs.

The Linux software system, which is now a major competitor to Windows and other Microsoft products, and its source code are freely available to anyone under an open source license that guarantees that the data will always be shared.

--
Put identity in the browser.

Re:I'm wondering... by Kingsly · 2004-09-20 00:05 · Score: 5, Interesting

The important questions is...

Is there a way for the governments to verify if the binaries that MS ships is from the same source that they are getting to see?

Will the governments be allowed to compile their own version ?

Re:I'm wondering... by Anonymous Coward · 2004-09-20 00:05 · Score: 3, Interesting

Good point, This offer should be rejected on many levels, first and foremost, shouldn't Microsoft be responsible for their own security.

Surely with a $500.00+ dollar pricetag for Office MS can afford to do their own homework !!

Some questions not answered in the article by StateOfTheUnion · 2004-09-20 00:08 · Score: 5, Interesting

Are any of these governments already using open source technologies? I wonder if this effort is to get governments to switch back to MS products or only to prevent others from joining those that have already defected from Microsoft's empire . . .

Alos, are any of these governments developing countries? Or southeast Asian? In other words is Microsoft entrusting the code to any governments that seem to take a blind eye to software piracy?

Re:I'm wondering... by mirko · 2004-09-20 00:08 · Score: 5, Interesting

Well, if they compile these and they do not get the exact same binaries, they might claim they are cheating but as we know Microsoft, they will explain that their WC++ might not always produce the same output depending on many factors...
So, well, they have to believe it.

--
Trolling using another account since 2005.

Another SCO? by iammrjvo · 2004-09-20 00:15 · Score: 5, Interesting

When (not if) the source code is leaked, then how long will it be before MSFT claims that office code was integrated into OpenOffice. How much in royalties will they demand?

--
Ha, ha! Nobody ever says Italy.

Is this a preemptive legal defense strategy? by StateOfTheUnion · 2004-09-20 00:15 · Score: 5, Interesting

After thinking aoubt this for a while I think that it may be a brilliant strategy on MS's part . . .

If the government of a country has the source code of the software to examine for security flaws, doesn't this give MS a defense against liability from future lawsuits? For example, if the UK government gets to inspect the source code, continues to use MS-Office, and then has a major problem due to hackers hacking MS-Office; MS can say that the software was given a clean bill of health by the British government, so MS shouldn't be held liable.

I know that no defense is necessarily bulletproof, but this is just going to give MS's legal dept. more ammunition so that that MS can get away with writing sloppy code and not be found as grossly negligent.

My Q(s) is/are... by danalien · 2004-09-20 00:15 · Score: 4, Interesting

* what's "_most_" of the src(s)?

/* Quote [emphasis added]: "The new initiative is an extension of Microsoft's Government Security Program, which allows the governments of more than 30 countries to examine
most of Microsoft's underlying source code, or software blueprint for its flagship Windows operating system." */

* what is 'required' to agree beforehand with? ..and how will this agreement effect ones ability to work (with other 'source code(s)') in the future to come?

/* Quote [emphasis added] : "Redmond, Washington-based Microsoft
keeps its source code closely guarded, and requires any governments or companies to sign agreements not to divulge the data that is used to create its software programs." */

--
I don't claim I know more than I know, and if you know you know more than I know, then by all means, let me know.

Smoke and mirrors by Slinky+Saves+the+Wor · 2004-09-20 00:25 · Score: 5, Interesting

This is basically a load of crap. Why? Well...

If you cannot compile the given source to a fully working Microsoft Access (or whatever source is provided), how can you be sure that the program you buy from the store contains the same source code?

You can't, since you most likely can't compile the given source, and keep on using that compiled version!

This is just smoke and mirrors. Now Microsoft can say their code has been provided for auditing by some instance, so it's got to be safe. However, there is no guarantee that the defects found will be fixed at all, and that the fixes will ever be found in the actual product. There is also no guarantee that the software you obtain from the store is the same as that for which the source was provided.

You can easily implant backdoors to the supposedly "audited" source code: just don't give the newly modified source code with the backdoor back to auditing...

--
I do not moderate.

Just a PR stunt by Andy_R · 2004-09-20 00:30 · Score: 5, Interesting

From the article (emphasis added by me)

The new initiative is an extension of Microsoft's Government Security Program, which allows the governments of more than 30 countries to examine most of Microsoft's underlying source code, or software blueprint for its flagship Windows operating system.

What's the benefit in looking at "Most of" the code and seeing if it is secure?

Absolutely nothing at all, apart from Microsoft getting an NDA signed on your behalf by your Govern(e)ment without any consultation with the public.

--
A pizza of radius z and thickness a has a volume of pi z z a

Re:I'm wondering... by AstroDrabb · 2004-09-20 00:51 · Score: 4, Interesting

That is exactly what I was thinking. MS gets tons of government programmers to do the job for MS in finding security problems. Then MS keeps all that _tax payer_ work and gets to turn around and sell that back to the governement. What a great business model!

This still doesn't fix the problem of governements putting out documents in a closed format that limits who can use/view those documents. Sure there is the free MS Word Viewer, though that only says it supports MS Word 2000 and doesn't mention WinXP. So it may or may not work. Also, MS realeases these viewers a long time after the most recent version comes out, so the most recent viewer is usually a version or two behind the most recent MS Office Suite. I think all governments should stick with an open doc format like PDF. Any government can use an suite like OOo.org that will let them convert documents to PDF or even Flash.

--
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison

Poor Government drones by dJOEK · 2004-09-20 00:58 · Score: 3, Interesting

I don't know about the rest of the world, but generally People Working At Governments aren't exactly the best and brightest or the best motivated workers. Let's call them Very Good at being Mediocre.

Imagine the following:

Boss: Jim, you're a programmer right?
Jim: uh, right
Boss: Management told me to inspect some code for bugs. I tossed it to the printer. Can you mark all the bugs with magic marker?

--
Exercise caution when modding this message up: the author acts like a jerk when his karma is excellent.

Office source code is not enough by cpghost · 2004-09-20 01:55 · Score: 4, Interesting

This is not nearly enough to satisfy governments. First of all, code that they don't compile themselves is not guaranteed to stem from the same set of sources. Second, the source code to the OS, and to the compilers is needed as well, because, hey, what does that black box kernel, dll, or compiler toolkit add to the pristine source?

Responsible governments would either avoid closed-source products completely, or they should require a complete source code system that they could bootstrap themselves. No hidden binary at all!

Would Microsoft provide such a complete, source code system that could bootstrap itself? It was reported many times earlier that they are having a helluvatime to maintain their own compiling environment. Would they be able to package it in such a way that non-Microsoft personnel could do something with it...

... assuming that they were sincere, and not just pulling a cheap PR stunt?

--
cpghost at Cordula's Web.

Slashdot Mirror

Microsoft To Share Office Source Code

19 of 348 comments (clear)