Slashdot Mirror
Microsoft Opens Its Security Research Cookbooks
greg65535 writes "Today Microsoft launched a blog about the internals of their IT security research and patch development process. There are already some posts that you will not find in the official security bulletins or KB articles. One of the posts says, 'We periodically identify workarounds or mitigations like this that we can't use for official guidance because they're either too nuanced or have some exception cases. When we discover something potentially useful but are uncomfortable listing it in the bulletin, we'll do our best to describe it here in this blog.' It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication."
Chapter 1.
If someone knocks on the door, use the little peep hole.
So it's a way of getting the nitty-gritty of issues, which won't be shown to Joe Average, who wouldn't have a clue what it was anyways? Cool.
It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication.
That's just because they haven't found a way to launch chairs at people through the internet.
The theory of relativity doesn't work right in Arkansas.
Microsoft Security Research: Do you know what kind of a bomb it was?
Clouseau: The exploding kind.
That this will just cause more issues than help any by giving away vulnerabilities in Windows. Just me thinking.
For those who seek perfection there can be no rest on this side of the grave.
Don't give out new ideas.
Why is it that people feel the need to put in 35 character long tags? Isn't that defeating the purpose of it all?
Chapter 2!
An unidentified program wants to use your little peep hole.
The source and purpose of this little peep hole is unknown. Don't use the peep hole unless you have used it before or know where it's from.
CANCEL/ALLOW?
Question: Mr. Ghandi, what do you think of Microsoft security?
Answer: I think it would be a good idea.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
It does not just look like...it definitely is the case that Microsoft *is* making an effort...not just looking like.
Question is: Who is being sensational here?
It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication.
That depends on what the meaning of is is.
stuff |
Microsoft likes to throw around the word "open" a lot these days, but most smart people in the industry remain skeptical. Take, for example, what open standards advocate Russell Ossendryver has to say about Microsoft's supposed open OOXML format: So how open is open? Unless the code is considered open under OSI standards or Free under FSF guidelines, it's really still just a pig with lipstick and a dress.
I'll tell you why...because they assume that Windows administrators are idiots. Now, I've known some stupid Windows administrators in my day, but I wouldn't go so far as to think that most of them are idiots.
My blog
Let me guess, the blog only gets updated on the second tuesday of every month?
henry -- the human evolution news relay
Microsoft isn't the only one researching vulnerabilities in their products, and in fact, if it wasn't for the effort of a lot of third-party researchers uncovering vulnerabilities, Microsoft probably wouldn't make the effort that they are just now showing us and exposing to public scrutiny.
The real problem is twofold... first, denial; for so long Microsoft (as well as many other mainstream software companies) refused to admit that there was a problem and didn't spend any time or money on the problem. This is a mindset that still needs to be addressed and was never present in open-source software development. Second, the time-to-acknowledgment has to come down. Microsoft is not making vulnerabilities that they discover public knowledge in a timely fashion to allow people who use their products to address these vulnerabilities through work-arounds and other techniques, and in fact, their approach to patch development is prioritized using marketing, not security awareness, as the primary driver behind which vulnerabilities are addressed and when.
Anyone else find it interesting that they had screenshots from Wireshark (previously known as Ethereal) on the page?
It's not exactly rocket surgery.
Aren't Easy-Bake Ovens fun!
I am still working on a draft of CTP - Chair Transmission Protocol
It makes me so glad that anyone can read the source code for the OS I use. I don't know how I would get by if one company was the only trusted agent to decide whether some issue was too "nuanced" for me to know about. I don't know how people get through the day running that stuff.
"It looks like Microsoft is making an effort to appear more 'open' in the area of security research and communication."
They say the mind is the first thing to
Marketing.
MS can fool you into spending your free time on its blogs.
Microsoft Security Research: the first book is free.
Domestic spying is now "Benign Information Gathering"
you may be eaten by a Grue.
Abort, Retry, Ignore?
Except that creative spelling and the ever-dreadful "convert now or fall forever" attitude will never yield anything meaningful.
The twitter monologues. Click on my homepage and be amazed.
It looks like someone has never read MS's TechNet anytime in the past 10+ years. MS has always been very open about these things, and between MSDN and TechNet, there's hardly anything I've needed to know which wasn't readily available.
Now if I were to actually have a valid complaint, I'd talk about how difficult it can sometimes be to search through that information. I've sometimes spent literally hours reading through search results, and it never seems like refining the search improves the results. But, MS has something in beta right now which is supposed to improve that- I haven't used it yet, however, so can't say how good it is.
So, the company that created the largest security problem in the world due to ad-hoc coding and lack of architecture wants to share its security lab secrets?
C'mon... we all know why windows is insecure; how about just fixing it in a user-livable manner like every other OS has done?
Security hole discovered:
Step 1 - Say Open Source Software is insecure and mock Linux
Step 2 - Think about security hole
Step 3 - Promise fix will be done in next service pack
Step 4 - Mock Linux a bit more and claim open source is comunism
**** 5 Months later security fix
Not being anal, but it is Gandhi and not Ghandi
What a COMMUNITY! I log into the new MS R&D Blog and I cannot read the comments nor can I post.
Jesus.
Quoted for hilarity. Up to that point I thought your post was actually serious. Haven't seen a punchline that good in ages.
Because most connections are in the clear and unencrypted. If you encrypt, you would be much more secure. Period.
http://www.rense.com/general79/wdx1.htm
Interesting if 5 years late...
Which part to you find humorous? The spoof/proxy of SSL certificates? Do you think it can't be done when every machine on your network trusts a CA root that you control?
Microsoft ISA is bloated and not easy to configure without careful reading, but it does do the job it is intended for.
Why does MS's "Security Cookbook" look like an 8-Ball with a little window in the bottom?
Dear Twitter/Erris/$NEW_SOCKPUPPET_WE_HAVE_NOT_DISCOVERED_YET
Slashdot is probably the most sympathetic forum you'll ever find for your deranged ranting and raving. And you've buried not one, but two accounts in Karma Hell.
I'm sure you were preparing your usual "M$ astroturfers" defense, so consider this: Nobody is modding your "I Hate Microsoft" posts up. If your Slashdot accounts were the battleground between the Paid Microsoft Shills and the True Warriors of Linux, as you have deluded yourself into believing, then somebody, somewhere, would be throwing an Insightful or Informative your way. But they're not.
I've never been ostracized by my own kind before. How does it feel?
Maybe now, you'll learn that the message isn't enough. It's how you send the message that truly counts.
Ha ha, fuck you for thinking you can control public opinion and expression. M$ executives deserve more than derision, they deserve jail time. Your little modpoint games are as worthless as the way you are spending your life. Suck it up as your employers flog you for yet another failure to make the internet safe for their failures. Their loss of control and public mind share is a reality you can't change for them.
Thank God that there is someone on our side in this, the little peoples, who don't have all the money, it make me feel good that freedom is working.