Slashdot Mirror
Microsoft Opens Its Security Research Cookbooks
greg65535 writes "Today Microsoft launched a blog about the internals of their IT security research and patch development process. There are already some posts that you will not find in the official security bulletins or KB articles. One of the posts says, 'We periodically identify workarounds or mitigations like this that we can't use for official guidance because they're either too nuanced or have some exception cases. When we discover something potentially useful but are uncomfortable listing it in the bulletin, we'll do our best to describe it here in this blog.' It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication."
Chapter 1.
If someone knocks on the door, use the little peep hole.
It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication.
That's just because they haven't found a way to launch chairs at people through the internet.
The theory of relativity doesn't work right in Arkansas.
Microsoft Security Research: Do you know what kind of a bomb it was?
Clouseau: The exploding kind.
Don't give out new ideas.
Why is it that people feel the need to put in 35 character long tags? Isn't that defeating the purpose of it all?
Chapter 2!
An unidentified program wants to use your little peep hole.
The source and purpose of this little peep hole is unknown. Don't use the peep hole unless you have used it before or know where it's from.
CANCEL/ALLOW?
Question: Mr. Ghandi, what do you think of Microsoft security?
Answer: I think it would be a good idea.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
It does not just look like...it definitely is the case that Microsoft *is* making an effort...not just looking like.
Question is: Who is being sensational here?
It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication.
That depends on what the meaning of is is.
stuff |
Microsoft likes to throw around the word "open" a lot these days, but most smart people in the industry remain skeptical. Take, for example, what open standards advocate Russell Ossendryver has to say about Microsoft's supposed open OOXML format: So how open is open? Unless the code is considered open under OSI standards or Free under FSF guidelines, it's really still just a pig with lipstick and a dress.
I'll tell you why...because they assume that Windows administrators are idiots. Now, I've known some stupid Windows administrators in my day, but I wouldn't go so far as to think that most of them are idiots.
My blog
Let me guess, the blog only gets updated on the second tuesday of every month?
henry -- the human evolution news relay
Microsoft isn't the only one researching vulnerabilities in their products, and in fact, if it wasn't for the effort of a lot of third-party researchers uncovering vulnerabilities, Microsoft probably wouldn't make the effort that they are just now showing us and exposing to public scrutiny.
The real problem is twofold... first, denial; for so long Microsoft (as well as many other mainstream software companies) refused to admit that there was a problem and didn't spend any time or money on the problem. This is a mindset that still needs to be addressed and was never present in open-source software development. Second, the time-to-acknowledgment has to come down. Microsoft is not making vulnerabilities that they discover public knowledge in a timely fashion to allow people who use their products to address these vulnerabilities through work-arounds and other techniques, and in fact, their approach to patch development is prioritized using marketing, not security awareness, as the primary driver behind which vulnerabilities are addressed and when.
Anyone else find it interesting that they had screenshots from Wireshark (previously known as Ethereal) on the page?
It's not exactly rocket surgery.
Aren't Easy-Bake Ovens fun!
It makes me so glad that anyone can read the source code for the OS I use. I don't know how I would get by if one company was the only trusted agent to decide whether some issue was too "nuanced" for me to know about. I don't know how people get through the day running that stuff.
"It looks like Microsoft is making an effort to appear more 'open' in the area of security research and communication."
They say the mind is the first thing to
Marketing.
MS can fool you into spending your free time on its blogs.
Microsoft Security Research: the first book is free.
Domestic spying is now "Benign Information Gathering"
Except that creative spelling and the ever-dreadful "convert now or fall forever" attitude will never yield anything meaningful.
The twitter monologues. Click on my homepage and be amazed.
It looks like someone has never read MS's TechNet anytime in the past 10+ years. MS has always been very open about these things, and between MSDN and TechNet, there's hardly anything I've needed to know which wasn't readily available.
Now if I were to actually have a valid complaint, I'd talk about how difficult it can sometimes be to search through that information. I've sometimes spent literally hours reading through search results, and it never seems like refining the search improves the results. But, MS has something in beta right now which is supposed to improve that- I haven't used it yet, however, so can't say how good it is.
Security hole discovered:
Step 1 - Say Open Source Software is insecure and mock Linux
Step 2 - Think about security hole
Step 3 - Promise fix will be done in next service pack
Step 4 - Mock Linux a bit more and claim open source is comunism
**** 5 Months later security fix
Not being anal, but it is Gandhi and not Ghandi
What a COMMUNITY! I log into the new MS R&D Blog and I cannot read the comments nor can I post.
Jesus.
Quoted for hilarity. Up to that point I thought your post was actually serious. Haven't seen a punchline that good in ages.
Because most connections are in the clear and unencrypted. If you encrypt, you would be much more secure. Period.
http://www.rense.com/general79/wdx1.htm
Why does MS's "Security Cookbook" look like an 8-Ball with a little window in the bottom?
Thank God that there is someone on our side in this, the little peoples, who don't have all the money, it make me feel good that freedom is working.