Slashdot Mirror
Microsoft Opens Its Security Research Cookbooks
greg65535 writes "Today Microsoft launched a blog about the internals of their IT security research and patch development process. There are already some posts that you will not find in the official security bulletins or KB articles. One of the posts says, 'We periodically identify workarounds or mitigations like this that we can't use for official guidance because they're either too nuanced or have some exception cases. When we discover something potentially useful but are uncomfortable listing it in the bulletin, we'll do our best to describe it here in this blog.' It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication."
Chapter 1.
If someone knocks on the door, use the little peep hole.
It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication.
That's just because they haven't found a way to launch chairs at people through the internet.
The theory of relativity doesn't work right in Arkansas.
Microsoft Security Research: Do you know what kind of a bomb it was?
Clouseau: The exploding kind.
Chapter 2!
An unidentified program wants to use your little peep hole.
The source and purpose of this little peep hole is unknown. Don't use the peep hole unless you have used it before or know where it's from.
CANCEL/ALLOW?
Question: Mr. Ghandi, what do you think of Microsoft security?
Answer: I think it would be a good idea.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Microsoft likes to throw around the word "open" a lot these days, but most smart people in the industry remain skeptical. Take, for example, what open standards advocate Russell Ossendryver has to say about Microsoft's supposed open OOXML format: So how open is open? Unless the code is considered open under OSI standards or Free under FSF guidelines, it's really still just a pig with lipstick and a dress.
I'll tell you why...because they assume that Windows administrators are idiots. Now, I've known some stupid Windows administrators in my day, but I wouldn't go so far as to think that most of them are idiots.
My blog
Microsoft isn't the only one researching vulnerabilities in their products, and in fact, if it wasn't for the effort of a lot of third-party researchers uncovering vulnerabilities, Microsoft probably wouldn't make the effort that they are just now showing us and exposing to public scrutiny.
The real problem is twofold... first, denial; for so long Microsoft (as well as many other mainstream software companies) refused to admit that there was a problem and didn't spend any time or money on the problem. This is a mindset that still needs to be addressed and was never present in open-source software development. Second, the time-to-acknowledgment has to come down. Microsoft is not making vulnerabilities that they discover public knowledge in a timely fashion to allow people who use their products to address these vulnerabilities through work-arounds and other techniques, and in fact, their approach to patch development is prioritized using marketing, not security awareness, as the primary driver behind which vulnerabilities are addressed and when.
Anyone else find it interesting that they had screenshots from Wireshark (previously known as Ethereal) on the page?
It's not exactly rocket surgery.
I dunno what's worse:
- that there is a 35 character tag
- or that you took the time to count it
A statement of intent and two example postings is "making an effort"?
You're being very generous to a company with a long history of abandoned promises and vapourware.
How about we wait and see how they perform for a few months instead of offering immediate praise?
"I've got more toys than Teruhisa Kitahara."
Except that creative spelling and the ever-dreadful "convert now or fall forever" attitude will never yield anything meaningful.
The twitter monologues. Click on my homepage and be amazed.
Not being anal, but it is Gandhi and not Ghandi
Quoted for hilarity. Up to that point I thought your post was actually serious. Haven't seen a punchline that good in ages.