Slashdot Mirror


Richard Clarke on Microsoft security

hizzo writes "Richard Clarke, former White House cybersecurity and counterterrorism adviser, harshly critized Microsoft's security track record. 'Given their record in the security area, I don't know why anybody would buy from them.' He also called for some regulation of security for ISPs in addition to better industry self-regulation, such as disclosing QA practices and becoming more accountable for secure code. I wonder if anyone will finally start listening to him?"

23 of 491 comments (clear)

  1. Why? by Telastyn · · Score: 3, Insightful

    If people don't listen to their computers getting nuked or their info stolen or any other direct impact upon themselves, they're not going to listen to a pundit.

  2. Why buy from MS... by Joey+Patterson · · Score: 3, Insightful

    Given their record in the security area, I don't know why anybody would buy from them.

    Maybe because people aren't aware of the alternatives that are out there (Mac and Linux) or simply resist change.

    1. Re:Why buy from MS... by Eternally+optimistic · · Score: 3, Insightful

      Many people prefer their mother's home cooking, even if it is unhealthy and tastes terrible. Trying something new is scary, not everyone wants to do that.

      --
      What keeps me going is my inertia.
  3. Humph by Anonymous Coward · · Score: 4, Insightful

    A story only a few hours ago on how Microsoft shines on security.

    Fact: any box is as secure at the admin makes it.

    Move along.

    1. Re:Humph by DickBreath · · Score: 3, Insightful

      Fact: any box is as secure at the admin makes it.

      Fact: any box starts out as secure as the developer/packager makes it.

      For example, having a vulnerable IIS turned on by default on a plain jane workstation.

      An incompetent admin can make a secure system insecure.
      A competent admin can, with work, might be able to make an insecure system secure.
      (Depending upon the nature of the required fixes.)

      But a box can start out relatively more or less secure, and that is an important point worth comparing. How secure is a given system out of the box, before an admin gets hold of it?

      --

      I'll see your senator, and I'll raise you two judges.
    2. Re:Humph by nihilogos · · Score: 3, Insightful

      Fact: any box is as secure at the admin makes it

      I can't believe this got modded insightful. The vast majority of computer users aren't admins, and don't have an admin coming round to their house to 'secure' their system, or stand over their shoulder to tell them they shouldn't open that email attachment.

      The 'admins' need to be built into the software you tard.

      --
      :wq
    3. Re:Humph by randomencounter · · Score: 3, Insightful
      For example: the message passing API which was (still is?) a major local privilege escalation vulnerability.

      For example: Shipping major software packages that required significant administrative skill to run as an unprivileged user on NT-series OS's (MS Office).

      For example: Shipping as their major OS product for years an OS that didn't even have the concept of an unprivileged user (Windows-over-DOS).

      They are getting better, but so is everyone else, and they have a lot of catching up to do.

      --
      Forget diamonds, copyright is forever.
  4. Apologia by Stanistani · · Score: 4, Insightful

    Clarke does deserve some kudos as the only responsible government official to apologize to the 9-11 victims's families.

  5. Re:Why listen to this weasel now? by Rei · · Score: 4, Insightful

    Oh come on, watch something other than Fox and read something other than NewsMax and FreeRepublic for once. :P

    Lets take a wide gander here. You've never read his book. You didn't listen to his testimony - only selective excerpts and clips. Your knowlege of his history comes from one or two right-wing articles, without ever reading any counters.

    I was (foolishly) hoping that this thread wouldn't get dragged into a left-right debate. I was wrong.

    --
    "Well, then fire it up and show me what this..." (sigh) ... "coccoon can do."
  6. This is a trap by argoff · · Score: 4, Insightful

    Security issues are a wonderfull way to convince people that the government should regulate IT, but ironically it will actually play to the favor of Microsoft most of all. As soon as regulations start out, it will start increasing the bariers to entry in the IT space.

    This has happened in every industry it's been attempted in. Plumbing, electricity, telephones, auto-repair. Hell, you can't even sell a hot-dog without going thru 10-20 thousand dollars worth of regulation for it to be legal. Yeah, I know, don't say it. There is always a good sounding reason for these .... yeah ..... right.

  7. some serious evasion by motorsabbath · · Score: 4, Insightful

    "In a statement responding to Clarke's comments, Microsoft said it has formalized its internal security efforts by adopting an official life cycle that it uses to develop secure software,[...]"

    Just what the hell is that supposed to mean?

    --
    The heat from below can burn your eyes out
  8. Re:Seriously by TheWatchfulBabbler · · Score: 5, Insightful
    Richard Clarke is some kind of expert on computer security? Where are his credentials on the subject?

    Well, he handled CIP during his time with NSC, and was cybersecurity czar after being shoved out of his counterterror role. 'Czars' of various sorts are, given their lack of power, perhaps the most ironically-named figures in Washington, but Clarke was certainly the best-informed computer security layman in the nation. So, yes, when the former Cybersecurity Czar specifically singles out Microsoft as a source of major vulnerabilities, I think he's qualified to pass judgment.

  9. Re:but but but by isometrick · · Score: 3, Insightful
    Science: Water Is Still Wet
    Posted by timothy on Thursday February 17, @05:00PM

    ...

    Science: Scientists Discover That Water Isn't Wet
    Posted by timothy on Thursday February 17, @03:00PM
  10. Re:Hmm... by Doc+Ruby · · Score: 3, Insightful

    Yes, Clinton, who presided over the biggest capital gains in history. Not Bush, who's got a $2.5T budget sending hundreds of billions to state-guaranteed corporate gigs like Halliburton and pharmacos. Yep, Clinton, the communist. Where do you get this stuff? Oh, right - the "news".

    --

    --
    make install -not war

  11. Re: not a politician by HD+Webdev · · Score: 3, Insightful

    Anybody who has read Clarke's book can see for themselves that he is not some raving madman. He's a professional who has made a career out of imagining the worst, figuring out who's likely to do bad things, and then trying to get others to do what's necessary to prevent the bad things or capture/arrest/kill the bad people. His failure, if you can call it that, is that he was unable to get the current US President to take al Qaeda and the threat of International Terror seriously until after 9/11, and even then, the President was more worried about Saddam Hussein and Iraq than he was about Mullah Omar and Osama bin Laden.

    It's a testament to the character of that man in that he was the first person to come forward and publicly apologize for 9/11.

    I've read the book he wrote about the events before and after (as he saw them) and have followed articles about him. I get the distinct impression that he is the type of person who has 'what if i had have done X' thoughts tormenting him quite often.

    --
    This is not a dream, not a dream...we are transmitting from the year 1-9-9-9.
  12. The real reason people don't switch by dustmite · · Score: 4, Insightful

    She found someone else to fix it

    You've just hit on the real reason people don't switch ... it's because they always find some geek they can sucker into cleaning up the mess each time, for free! Most people don't even have to lift a finger to keep their systems free of malware - there are geeks running around everywhere literally doing free maintenance - it doesn't even so much as inconvenience them, why would they change?

    Why exactly are we all running around spending hours of our own weekends/evenings etc. cleaning up the mess Microsoft made for them for free? Is your time and expertise worth nothing? You feel "expected" to do it because it's a family member? Or some hot chick sweet-talked you into doing it by flirting a little? (We all know we've done that before). Utter nonsense ... start charging for it!

    People will start considering alternatives when they realise it's going to cost them a tidy little packet every time their systems get jammed up with the latest MS malware.

    I simply told my folks last time they bought a computer, if they buy Windows, I'm not supporting it for them, if they buy a Mac I'll support it for them. Don't expect me to spend my Saturday doing free support work for Microsoft.

  13. Re:not likely by Viking+Coder · · Score: 3, Insightful

    Ha ha ha. Funny.

    It's our jobs as citizens to question our leaders. That's just about the only thing you and I are expected to do, in a representative democracy.

    I think she was lying when she said that the contents of "the memo" didn't say that Bin Laden was determined to attack America, because I know for sure that that was the name of the freaking memo.

    Or is this some wacky truth test that I'm a moron to use?

    Microsoft, like every other business in America, lobbies the government. Just like I lobby the government.

    Secretary: "Senator, Microsoft is on line one, and some internet guy who calls himself 'Leo McGarry' is on line two."

    Funny. You most assuredly do not lobby the government "just like" Microsoft does.

    They throw around more money than any other corporation, you spent less than a buck on a postcard. Sorry for burtsting your bubble, but in this representative democracy, Microsoft's voice carries more weight than yours.

    There are lots of middle-men whose job it is to collect public opinion and communicate it to the representatives in Washington.

    Again, "ha." These guys find someone who says that a survey says what they want it to, and feed that to representatives. It's not scientific at all. And if Microsoft, oh, I don't know, pays for those surveys, are you seriously so naive as to be surprised if the outcome of the surveys they tell people about say something that's always in favor of Microsoft? (Feel free to replace "Microsoft" with any corporation's name here, by the way.)

    They're dishonest. Duh. Put on your ridicule-retardant pants, because you're in for a beating.

    --
    Education is the silver bullet.
  14. Re:not likely by SiChemist · · Score: 4, Insightful

    What a bunch of crap. Lobbyists don't educate, they advocate. They are paid to convince your representative to act in a manner which is unlikely to be in the best interest of the majority of their constituents.

    As for "shouldn't business be given the opportunity to express itself", I say no. A corporation (despite that abomination of a court ruling) is not a person. It's interests are often in conflict with those that are supposedly being represented by the congressperson. Yet its voice is magnified by the millions of dollars of influence it wields. It is a legal form of bribery.

  15. Re:not likely by F34nor · · Score: 4, Insightful

    Its is all about the combination of benefits. Corporations had limited liability and limited rights later the Supreme Court read the 14th amendment as giving human rights to property, thus giving human rights to limited liability legal structures. So now they have the benefit of limited liability and the right to speech moreover money is now considered a form of speech. Therefore corporation may make money illegally, then use that money to affect government. This is just as fucked up as letting churches make money tax free and then letting them use that money to affect government. Its fucking wrong and un-American and need to be stopped. If you want to express your opinion as a business then take the money out of it, pay taxes and be subject to personal limits.
    COPRPORATIONS SHOULD NOT HAVE MORE RIGHT THAN A HUMAN BEING.

  16. Re:not likely by drsmithy · · Score: 3, Insightful
    Then MS and BG threw in big with GWB.

    I think you'll find Microsoft "threw in big" with pretty much everyone, as a direct result of the antitrust suit.

  17. Re:not likely by idlake · · Score: 4, Insightful

    No, it's not. Microsoft, like every other business in America, lobbies the government. Just like I lobby the government every time I write my Congressman a letter. It's called "representative democracy."

    When you lobby Congress, it's a representative democracy.

    When a business, which is not a human being or citizen but a legal construct, lobbies Congress, it is something altogether different.

  18. Re:Hmm... by Doc+Ruby · · Score: 4, Insightful

    Those "failed socialist regimes" are kicking our ass - haven't you noticed that the Euro is up over 30% since its introduction? No one knows what "HillaryCare" would have done - the Republican Congress's version (boosted by Bush's $750B pharma-welfare last year) is responsible for most of the remaining debt. In spite of Clinton's paydown of the Reagan/Bush debt. Which Bush Jr immediately squandered, creating trillions of new debt every year. We're staring down a $3T budget right now, financed by unprecedented (and unsupportable) debt, all after 4 years of Bush, his Republican Congress, and little denied. Where rightwingers come off lecturing about debt, failed regimes, and even socialism (like our version, state capitalism, corporate welfare) is beyond me. They get called "heartless" because "mindless" gets repetitive after a while.

    --

    --
    make install -not war

  19. Re:not likely by Viking+Coder · · Score: 4, Insightful

    BEN-VENISTE: Isn't it a fact, Dr. Rice, that the August 6 PDB warned against possible attacks in this country? And I ask you whether you recall the title of that PDB?

    RICE: I believe the title was, "Bin Laden Determined to Attack Inside the United States."

    Now, the...

    BEN-VENISTE: Thank you.

    RICE: No, Mr. Ben-Veniste...

    BEN-VENISTE: I will get into the...

    RICE: I would like to finish my point here.

    BEN-VENISTE: I didn't know there was a point.

    RICE: Given that -- you asked me whether or not it warned of attacks.

    BEN-VENISTE: I asked you what the title was.

    RICE: You said, did it not warn of attacks. It did not warn of attacks inside the United States. It was historical information based on old reporting. There was no new threat information. And it did not, in fact, warn of any coming attacks inside the United States.

    Where is the word "airplane" or "weapon" anywhere in that conversation? You're so full of bullshit, and you have no desire to find out if you're wrong.

    It also did not point to "possible hijackings." According to Dr. Rice, it was entirely historical. Unfortunately for her, the word "determined" means "on an unwavering course of action". That means, "will continue to be." That means, "in the future," or "not just historical." That means, she was wrong or lying.

    Who's the moron now, you moron?

    They represent a hell of a lot more jobs than I do.

    No - the people who work there represent a lot more jobs. Microsoft doesn't represent anything except shareholders.

    It's not supposed to be. You're not one of those people who mistakenly thinks everything is about the scientific method, are you?

    Facts are clean, and politicians are greasy. The scientific method is the best way I know to determine facts (even facts about opinions). Tell me a better way, and I'll use it.

    Until then, Microsoft greases palms, and you're an idiot for thinking they're just exercising their first amendment rights - it's a corporation, not a person. And they're buying votes. The votes that belong only and precisely to you, as a citizen of the democracy that they were elected to represent. If you don't care that you're being screwed, it's because you have no idea what being a citizen means.

    When the army that's supposed to defend you starts torturing people, will you sit idly by?

    Oh wait, that already happened - and yes, you are sitting idly by.

    Does "America" mean anything to you, other than corporate profit and protection from terrorists?

    --
    Education is the silver bullet.