Slashdot Mirror
MS To Share Early Flaw Data With Governments
Trailrunner7 writes "Microsoft today announced plans to share pre-patch details on software vulnerabilities with governments around the world under a new program aimed at securing critical infrastructure and government assets from hacker attacks. The program, codenamed Omega, features a 'Defensive Information Sharing Program' that will offer government entities at the national level technical information on vulnerabilities that are being updated in their products." There's a stream the bad guys would dearly love to tap into.
Sounds like they don't need to tap. :P
and everyone KNOWS how well governments can keep secrets.
- Minutus cantorum, minutus balorum, minutus carborata descendum pantorum.
Because governments would never help a company in their nation with industial espionage.....
Unfortunately for the government, the Omega program is only in alpha release.
It's certainly not about security. It's purely a PR scheme. MS wants to make government agencies feel important and special if they use their products. Nothing impresses government officials more than press releases that make every bullshit bing player happy.
As every black hat knows: you will not need to compromise the software. You just have to compromise one of the people working for the government in question.
Actually an early information about security patches from Microsoft looks like that:
Product Affected: all versions of windows
Risk: Remote code execution
Rating: Critical
Reboot required: You betcha
Description: This vulnerability is even more serious than the previous 10 000 other Critical software updates, if 0 were the highest priority on a scale 1 to 10, this one would rate -10 000, see that's like super duper uber hyper critical times 3.
MS will provide information only "after our investigative and remediation cycle is completed..." In other words, after the vulnerability is discovered and fixed, and the patch is ready to roll out.
Then, "disclosure will happen just prior to our security update release cycles."
So the disclosure amounts to this:
"Tomorrow's MS Windows Update contains a security patch that fixes a serious vulnerability in your system. Oh, by the way, you have a serious vulnerability in your system."
Doesn't Linux already do this, for everyone? The only people who are going to be fooled by this in the government are elitist pricks.
An Education is the Font of All Liberty
the book of FLOSS guys. all your customers need to promptly know when you find flaws, not just the governments with the ability to restrict your sales and service. Im talking about banks, schools, hospitals, and power plants.
Good people go to bed earlier.
This is insanity! So the government of US, UK, Israel, China, etc. will get information on vulnerabilities before the general public? The obvious outcome isn't a more secure government server, it is that the intelligence agencies will get a headstart on exploiting public and private systems the world over. It is a license to hack, for either industrial espionage or government espionage purposes.
What is a system administrator to do? There is no way to prepare for this kind of thing, the attack vectors will be unknowable by the general public. My only thought is to switch as many systems away from Microsoft as fast as possible. This is a total security nightmare.
-molo
Using your sig line to advertise for friends is lame.
The first time I read that headline, my brain completely omitted the word "data" without skipping a beat.
It sounded par for the course, I guess.