Microsoft Opens Source Code To KGB's Successor Agency

Jack Spine writes "Microsoft has struck a deal with the Russian government which will give the FSB, successor to the KGB, access to the source code for Windows 7, among other products. The agreement is an extension of Microsoft's Government Security Program, according to a source with links to the UK government."

Comments

security holes of releasing source code

[Anonymous Coward]

yay, so now the Russians will know all the holes in Windows 7 and how to exploit them, no?

Re:security holes of releasing source code

[TheRaven64]

They've already provided it to the Chinese (and the British, not sure who else). That means that the Russians and Chinese can look for and exploit holes in Windows. Last I heard (which, admittedly, was around 2002), the source code that they provide is not enough to build a complete Windows system, and the license does not permit building it, only reviewing it, so this only lets you find (but not fix) accidental flaws, not malicious ones.

Basically, they get all of the disadvantages of open source security, but none of the advantages.

Re:security holes of releasing source code

[AlexiaDeath]

Yep. And you don't because you are not given the source. Giving the source to some people is considerably more dangerous than not giving it to anybody, because the ones with the source have an advantage over everybody else in finding exploits and particular reason to disclose them...

Re:security holes of releasing source code

[roystgnr]

Yeah, but Russia probably signed the same "We promise to hack Google first" agreement that China did, so from Microsoft's perspective it's win/win.

Re:security holes of releasing source code

[Vectormatic]

Last I heard (which, admittedly, was around 2002), the source code that they provide is not enough to build a complete Windows system, and the license does not permit building it, only reviewing it, so this only lets you find (but not fix) accidental flaws, not malicious ones.

What use is it anyway then? I gather the russians (and brits, americans, chinese) want to be able to fully review the software in order to clear it for national security, what would be the point of only getting 90% of the code, and being allowed to build from it?

i'd say a specific linux build for national security sensitive applications is in order, in every country which might want to stop the US or MS from spying in their stuff (which is everyone, including the US themselves)

Re:security holes of releasing source code

[cappp]

Russia is just being added to a rather long list of countries in this regard. Playing a little link-hopping tells us that both NATO and 30 countries (including the UK) have made similar deals with Microsoft albeit in refence to older technology. I would assume that all of those entities have similar updates to their agreements.

Re:security holes of releasing source code

[Anonymous Coward]

The point of it is being able to review certain critical parts, for instance many of the governments require cryptographical reviews before an OS can be used by certain sections of the government and this sort of code access allows that. The intention is not for a government to go trawling through the entire source trees but to instead allow them review code that is necessary to follow whatever guidelines and legislation is applicable for that country. Do you really think most countries have any interest in reviewing all the code in windows? or even in linux or any other OS for that matter? the size of such a task would be beyond belief and a constantly moving target.

Re:security holes of releasing source code

[aliquis]

Basically, they get all of the disadvantages of open source security, but none of the advantages.

?

Re:security holes of releasing source code

[jcwayne]

Basically, they get all of the disadvantages of open source security, but none of the advantages.

There are NO disadvantages to open source security! Take that back, you big meanie!

Re:security holes of releasing source code

[General Wesc]

Basically, they get all of the disadvantages of open source security, but none of the advantages.

?

People can find security holes and exploit them, but they can't find security holes and fix them. (They can, however, find security holes and report them, so...)

Re:security holes of releasing source code

[mlts]

Isn't it coincidental that the Chinese intelligence who received the source code suddenly had a lot of new Windows based 0-days and used them against US companies, Google mainly?

The blackhats have the source and can look for bugs and errors that they can exploit at will. The whitehats have to guess or blindly firewall, hope that there are no remote exploits, and put a lot of resources into perimeter security.

Maybe this is just another impetus for people and companies to move to UNIX based operating systems. Even a closed source offering like HP-UX or OS X (the pieces that are not open-sourced in Darwin or elsewhere) has been around such a long time that glaring show-stopper bugs are rare, and are usually limited to local exploits. This isn't to say things are perfect, but an exploit from remote like ssh is extremely rare on the UNIX side. To boot, UNIX variants have been getting a lot better at security, having ASLR, DEP, SELinux/AppArmor security policies, and other items to limit damage and spread of compromised code.

Re:security holes of releasing source code

[Anonymous Coward]

The licence also doesn't permit pirating window either, guess what the chinese do

Re:security holes of releasing source code

[PopeRatzo]

i'd say a specific linux build for national security sensitive applications is in order, in every country which might want to stop the US or MS from spying in their stuff (which is everyone, including the US themselves)

And what if you want to stop China, Russia or Google from "spying on your stuff"?

Re:security holes of releasing source code

[aliquis]

Imho finding them / being aware of them would be an advantage, regardless of what's happening, atleast as far as the open-source model goes.

For them to be exploited by others, yeah, but I guess in the government cases they most likely see it as an advantage to be aware of them ..

I think it's hard to argue that still being exploitable and have the flaw but not being able to tell because you haven't got the source would be worse.

And I thought being able to look for flaws was an advantage, maybe even so than having the maintainer accept any fixes or whatever.

And I assume Microsoft would want to fix things if people reported them in.

Re:security holes of releasing source code

[elrous0]

so now the Russians will know all the holes in Windows 7 and how to exploit them, no?

Them and every other hacker on the planet.

Re:security holes of releasing source code

[datapharmer]

i'd say a specific linux build for national security sensitive applications is in order

Try setting SE Linux to "enabled".

Re:security holes of releasing source code

[NotBornYesterday]

And I assume Microsoft would want to fix things if people reported them in.

And you would be wrong a lot. (One of many; Google is your friend, finding others is an exercise left to the reader.)

Re:security holes of releasing source code

[pandrijeczko]

and the British, not sure who else

Indeed, old chap. And we will tip our bowler hats at you when we've stopped having a jolly good laugh at it.

"Gor blimey, luv-a-duck, Mary Poppins! 'av ya seen the state of those header files for Minesweeper!"

Re:security holes of releasing source code

[NotBornYesterday]

I wondered why they bothered with Windows at all, given their previous movement towards Red Flag Linux. I wonder if they did so just to find the vulnerabilities ...

Re:security holes of releasing source code

[Anonymous Coward]

"enforcing"
Enabled is not an option, disabled and permissive are ;)

Re:security holes of releasing source code

[dintech]

Yes, but I'm looking forward to Vindows 7.

Re:security holes of releasing source code

[v1]

They've already provided it to the Chinese (and the British, not sure who else).

I'm sure the US Govt has had it LONG since before those guys. One of those "but under the Patriot Act, we don't have to TELL you" kinds of things I'm sure. It's like a rootkit for the Constitution.

Re:security holes of releasing source code

[Anonymous Coward]

> yay, so now the Russians will know all the holes in Windows 7 and how to exploit them, no?

No, that's what M$ wants the Russian government and naïve folks to believe.

To the US government, the talks and code are somewhat different, I suppose (I also am not entitled to know "what really happened").

Re:security holes of releasing source code

[Vectormatic]

The same, i was implying that since MS is US based, the various TLAs from the US have the best chances of acquiring a back door into windows

Sure, russia et all might be able to find a peephole in their limited view of the source, but if there are any real TLA backdoors, they will be in the parts the russians dont get

Re:security holes of releasing source code

[Anonymous Coward]

And what if you want to stop China, Russia or Google from "spying on your stuff"?

http://www.openbsd.org/
http://www.sun.com/software/solaris/trustedsolaris/index.xml

Re:security holes of releasing source code

[MikeBabcock]

The idea isn't to find bugs, but to validate that there aren't back doors (at the behest of the NSA for example). However, without being able to build it, you can't tell if this really is the source code to the version of Windows you're running or not. A build test with a binary comparison would be a real assurance.

Re:security holes of releasing source code

[Anonymous Coward]

Parent is twitter.

That is all.

Re:security holes of releasing source code

[mlts]

I'm sure that MS wants the countries to both get tough on piracy, and sign onto ACTA, so throwing them a bone by giving them the source code access makes perfect sense.

Re:security holes of releasing source code

[morgan_greywolf]

Do you really think most countries have any interest in reviewing all the code in windows?

If you can't compile the code into a working binary using the same compiler that was used to produce the production binary because you're missing parts, then you can't be sure that the source code you have represents the binary you're using. You have take Microsoft's word for it, and it's not like the rep you're talking to is the actual guy who manages the build, so even he doesn't actually know for sure.

An incomplete set of source is absolutely useless for a true security audit.

Re:security holes of releasing source code

[origin2k]

You don't need the source code to find holes to exploit! In fact some security researchers only care about having the released binaries. For more information read "Hacking: The Art of Exploitation". IIRC it has something to do with the fact that different; compilers, versions of same compiler, options to same compiler can all generate different binaries. So to truly exploit the code you need to know what instructions actually made it into the binary that people are using. That is why tools like IDA Pro are so useful.

 

Re:security holes of releasing source code

[Robert Zenz]

...guess what the chinese do

Using Linux?

Re:security holes of releasing source code

[Serious Callers Only]

Imho finding them / being aware of them would be an advantage

That's assuming that the FSB (for example) chooses to inform Microsoft of any holes they find. Why would they do that?

Re:security holes of releasing source code

[tibit]

I don't really see how the non-buildable source can be generally useful. Certainly, some things can be examined on a printout. Perhaps most of interesting things.

But there are still some pieces of code where it's hard to reason about their execution paths without seeing them in action. Thus you really need to build them, hack them, run under debugger and see how they behave in action, and how they react to your changes.

Re:security holes of releasing source code

[Sulphur]

If it fails, do they get their money back?

Re:security holes of releasing source code

[tenco]

Basically, they get all of the disadvantages of open source security, but none of the advantages.

?

People can find security holes and exploit them, but they can't find security holes and fix them. (They can, however, find security holes and report them, so...)

I guess that's why MS didn't give out the right to build from it's source. This denies governments to find flaws, fix it for their versions and exploit them on $enemy. This encourages governments to report found holes (unless they can be "fixed" without recompiling).

Re:security holes of releasing source code

[Anonymous Coward]

You mean Flowersweeper right?

Re:security holes of releasing source code

[Anonymous Coward]

Well....

It is only a secret if one person knows it.

With all the governments MS has exposed the source to it should be leaked out into the cyber criminal world by now.

The exploits to benefit criminal hackers are most likely already hitting the net.

Therefore, Win 7, no supprise, becomes an unsecure operating system.

Re:security holes of releasing source code

[alexo]

the source code that they provide is not enough to build a complete Windows system, and the license does not permit building it, only reviewing it, so this only lets you find (but not fix) accidental flaws, not malicious ones.

If I were in charge of an internal security agency, I would be more concerned about running an OS containing back doors or exploits than to try and exploit them myself. To that effect, I would insist on being able to build the OS from sources using a compiler that is known to be uncompromised (built it from source too). No other arrangement will guarantee that the copies I am running behave exactly like the source code says.

If the FSB agreed to the terms that you mentioned, they are not doing their work.

Re:security holes of releasing source code

[suso]

and the license does not permit building it, only reviewing it, so this only lets you find (but not fix) accidental flaws, not malicious ones.

Oh noes, a license. That will stop em.

Re:security holes of releasing source code

[phantomcircuit]

Clearly you have no idea how SELinux works. It's an enormous pain in the ass to setup correctly. Simply enabling it will do nothing at all.

Re:security holes of releasing source code

[Anonymous Coward]

You've got to be kidding. The wall came down, man. We're best friends with the Russians now, right?

It's not like we've got spies in each-others countries or any of that nonsense anymore.

Next thing you'll try telling me we're going to have one of those old Cold War style "spy swaps" or something.

Re:security holes of releasing source code

[NotBornYesterday]

Huh? No, definitely not.

Re:security holes of releasing source code

[Muad'Dave]

... the license does not permit building it, only reviewing it ...

To make it doubly secure Microsoft set the read-only bit to true and the compile bit to false on all the source files.

Re:security holes of releasing source code

[NotBornYesterday]

Yes, I understand MS's motivation ... just wondering about China's.

Re:security holes of releasing source code

[king neckbeard]

but Google is stopping internal usage of Windows, making it a moot point.

Re:security holes of releasing source code

[shutdown -p now]

Last I heard (which, admittedly, was around 2002), the source code that they provide is not enough to build a complete Windows system, and the license does not permit building it, only reviewing it, so this only lets you find (but not fix) accidental flaws, not malicious ones.

From what I heard, this transfer is for complete buildable code, and, indeed, the whole point is that FSB guys will strip out everything they don't need to minimize attack surface, and use the resulting build for their own systems.

Re:security holes of releasing source code

[d3ac0n]

Imho finding them / being aware of them would be an advantage

That's assuming that the FSB (for example) chooses to inform Microsoft of any holes they find. Why would they do that?

That's also assuming that the FSB is capable of finding any holes and I think that's assuming alot. If the recent "sexy spy" debacle is any indication, the FSB has become the keystone kops of the espionage industry.

Re:security holes of releasing source code

[Anonymous Coward]

yay, so now the Russians will know all the holes in Windows 7 and how to exploit them, no?

All?? There is at least a Googol of exploits!

Re:security holes of releasing source code

[Anonymous Coward]

Right, so its good to just deploy a fix that is untested, could break tons of required legacy apps or introduce new holes. Why don't you use your critical thinking skills instead of band-wagoning on the MS hate Conestoga. But it's cool with you when UNIX/FOSS leaves know flaws active for 20 years though:
http://www.computerweekly.com/Articles/2007/07/25/225765/serious-flaw-affects-bind-internet-server-software.htm

Re:security holes of releasing source code

[Your.Master]

Nobody said you couldn't build a binary. Just that you can't build the complete Windows system. You can probably spray dlls all over the place and then just do a binary diff against the original to verify that they are identical other than the signature.

Re:security holes of releasing source code

[morgan_greywolf]

If you only have 90% of the source, the portion you can't build depends on which 10% is missing. Just because you have 90% of the source, that doesn't mean you can build 90% of the binaries. For some projects, removing 10% source means you can't compile anything, if it's the right 10%.

Re:security holes of releasing source code

[Phu5ion]

Anything to prevent them from upgrading to FOSS.

Re:security holes of releasing source code

[bruce_the_loon]

Careful there, the FSB just happened to have the right number of warm bodies spying for America/et-al hanging around behind bars to do the swap immediately after the debacle started.

Keystone kops or ready to extract 10 spies whose job is done and are ready to come home? Just a thought

Re:security holes of releasing source code

[noidentity]

Never mind Window, I heard Linucks has released its source codes to all governments worldwide, so that they know all the backdoors and exploits. So much for Linucks being a secured operatings system!!1

Re:security holes of releasing source code

[StillNeedMoreCoffee]

"and the license does not permit building it, only reviewing it, so this only lets you find (but not fix) accidental flaws"

Right, the Russian former KGB is going to feel obligated to not build the code because they are not permitted to under license. The only way they wouldn't is if there was a bigger, more dastardly policeman out their to threaten to enforce that. Oh wait, the I.P. police, well I guess your right, they will abide by the licence.

Re:security holes of releasing source code

[morgan_greywolf]

Oh, yeah, another point: The license doesn't allow you to build any binaries, either.

Re:security holes of releasing source code

[SplashMyBandit]

The NSA released the SE patches to the Linux kernel a few years back. Most distros allow you to use this. Refer to: http://en.wikipedia.org/wiki/Security-Enhanced_Linux

Re:security holes of releasing source code

[aliquis]

Well, the issue was open-source advantages vs disadvantages?

I don't see how being able to check the source for issues is a disadvantage, but yeah, not being able to build the software yourself to fix the bug is one. But if they want it fixed they can inform Microsoft. Done.

If they just want to use the source code to look for exploitable code then they wouldn't be likely to inform Microsoft no matter what.

If anything this scenario makes it MORE likely that they inform Microsoft because if they want it fixed it's their only solution. So not doing so risk their own systems to.

I doubt the NSA is like "oh but we can't make anything we release of our own tooo good, it must be full of flaws so we can still exploit others."

But whatever, some people will most likely argue they are.

Re:security holes of releasing source code

[JumpDrive]

Well if I was able to look at the code and find a security flaw, then be able to use an exploit against that flaw. Then that would be good enough for me to say that the code was complete enough.

Re:security holes of releasing source code

[RocketRabbit]

Apple also has another power: the inherent anti-Chinese sigil. I don't know what it is about Macs, but I have been a Mac user for about 25 years and an owner for about 15 years, and I don't think I have ever seen Chinese software of any kind on any Mac, ever. I have seen lots of Chinese people at institutions of higher education using Macs, but I don't think I have seen Chinese software, from China, on a Mac.

I do believe they are probably pretty adept at exploiting Linux machines, though, because all day I get bombarded with probes and bad attempts on my SSH daemon, and when I nmap them they are usually running Linux and are usually in China.

Re:security holes of releasing source code

[arkane1234]

Do you really think most countries have any interest in reviewing all the code in windows? or even in linux or any other OS for that matter? the size of such a task would be beyond belief and a constantly moving target.

While it would be a huge huge huge task, by no means would it be a moving target.
Versions exist for a reason, which is why we have things called version control.

An organization/government can rip apart any version they wish to QA it, then freeze that version as 'stable' within their organization/government. It's how most (conventional) organizations operate.

Re:security holes of releasing source code

[NotBornYesterday]

I don't approve of anyone leaving holes unpatched, troll, so don't go putting words in my mouth. What I pointed out is a single instance of what has become a pattern of behavior from MS which contradicts his statement.

Re:security holes of releasing source code

[morgan_greywolf]

Well if I was able to look at the code and find a security flaw, then be able to use an exploit against that flaw.

One security flaw? No. You'd only know that that piece of code that contained the security flaw corresponded to the actual binary(ies). Even for that, you wouldn't have a guarantee, since the source could represent, say, an older version and the newer version of the same code has other security flaws that you can't see.

Re:security holes of releasing source code

[Windowser]

Clearly you have no idea how SELinux works. It's an enormous pain in the ass to setup correctly. Simply enabling it will do nothing at all.

Looks like you never tried it. It will make a lot of stuff stop working. Even serving a webpage will become complicated.

Re:security holes of releasing source code

[phantomcircuit]

Did you even read my comment?

Re:security holes of releasing source code

[hagiwhat]

hassie aq bu ne simdi?

Available as a Torrent in 3... 2... 1...

[Xtense]

Available as a Torrent in 3... 2... 1...

Re:Available as a Torrent in 3... 2... 1...

[Anonymous Coward]

Lawsuit in 1.. 0..

Re:Available as a Torrent in 3... 2... 1...

[Xtense]

Pffffffaaahahahaahaha.

Oh wait, you're serious.

Aaaaaaaaaaaaaahahahahahaahaaaaaaaaaaaaaaaaaaa!

Re:Available as a Torrent in 3... 2... 1...

[thijsh]

In Soviet Russia Information Wants To Be Suppressed, but Code Still Wants To Be Wrong!

Re:Available as a Torrent in 3... 2... 1...

[arivanov]

And in which jurisdiction are you going to sue?

Re:Available as a Torrent in 3... 2... 1...

[timeOday]

Don't you remember the big leak of Windows source code a few years ago?

Surprisingly, it didn't turn out to have any impact on anything, that I can tell.

Re:Available as a Torrent in 3... 2... 1...

[bigredradio]

Hax0r: Ha! I have windows source code!!! (10 mins later) Hax0r: Humm.. now what?

Re:Available as a Torrent in 3... 2... 1...

[theArtificial]

Wasn't that how the image hacks started? A specially crafted BMP. There are more but this is one I recall off of the top of my head.

Re:Available as a Torrent in 3... 2... 1...

[ThatsNotPudding]

Known Space. Gil Hamilton will serve the subpeonas.

Re:Available as a Torrent in 3... 2... 1...

[Anonymous Coward]

Keep seeding?

I'm sure this will turn out well

[linzeal]

I'm more afraid of the FSB selling or having the code stolen from them by Russian hackers than the FSB actually doing anything. They are mostly incompetent hacks either leftover from the 90's or put there to be yes-men to Putin policy. Putin would not stack the deck against himself so he has cut out most of the intelligence in the intelligence agencies, that is why you get things like the recent spy swap debacle where they could not even penetrate a PTA meeting let alone the Pentagon.

Re:I'm sure this will turn out well

[Anonymous Coward]

I tend to agree with your take on Putin.

And, wtf. Those poor Russians just can't seem to get a break. They've gone from totalitarian monarchy to communism. Yay, workers paradise, except when the revolutionary dust settled they were still under totalitarian rule.

And now that the confetti from the democratization celebration has blown away we are still looking at something remarkably similar to a dictatorship.

Re:I'm sure this will turn out well

[BitZtream]

Sounds like they've done pretty good for themselves. Their cover obviously has you fooled.

Re:I'm sure this will turn out well

[dargaud]

When you ask a russian his opinion on some leader (either russian or otherwise), whenever he wants to praise that leader, he'll always add 'he's a strong leader'. It seems that russians only recognize leadership when it is associated with strength, so do not be surprised that they go from dictatorship to dictatorship. It's mostly self-inflicted.

Re:I'm sure this will turn out well

[shutdown -p now]

People were genuinely supporting democracy and liberalism back in late 80s and in early 90s. That's what made the transition to democratic rule possible in the first place. It's also why the hardcore commie attempt at a coup d'etat failed in 1991.

The problem was that people's trust in those things was undermined by those very politicians who were pushing for them, once they got in power. Yeltsin was a horrible president, both as a person (drunkard, slow-thinking, dishonest) and as a ruler (autocratic, bad manager). It was bad enough in 90s that, for the majority of population, the very word "democracy" itself became tarnished - "If that's what they call 'democracy', we'd rather have it the old way". And since the "old way" is stereotyped as "strong hand", we got Putin.

So... I agree that it's self-inflicted, but it's more complicated than it seems.

Re:I'm sure this will turn out well

[Reservoir Penguin]

The poor Russian we are, suffering under a bloody KGB regime, why don't you come here and bring us some of you freedoms? And do not forget winter clothes, it can get bloody cold over here.

Re:I'm sure this will turn out well

[Anonymous Coward]

If they really wanted "the old way", shouldn't they have restored the monarchy?

Re:I'm sure this will turn out well

[shutdown -p now]

By "old way" I mean what people remembered as good times compared to where they ended up in the 90s.

But, since you ask - there has been quite a resurgence of various monarchist organizations in Russia in 90s, and quite a few of them are of ultra-conservative type advocating absolutism, Orthodoxy as a state religion etc - in general, anti-liberalism - and opposing that to the "lying and treacherous liberals who have robbed the country". They mainly appeal to those people who think that commies were okay, except for the part where they suppressed religion.

Re:I'm sure this will turn out well

[ScrewMaster]

The poor Russian we are, suffering under a bloody KGB regime, why don't you come here and bring us some of you freedoms? And do not forget winter clothes, it can get bloody cold over here.

No, we only spread freedom to countries with plenty of oil and other natural resources ... oh wait.

FSB is not "the" successor to the KGB

[the linux geek]

The FSB is approximately a third of the total KGB capability, with the FSO and SVR being the other legs of the triumvirate. The FSB, being the replacement for the former First Chief Directorate, is mostly responsible for internal security (counterintelligence, counterterrorism, counterinsurgency, action against dissenters.) I don't see how this deal with Microsoft could possibly threaten the US or US interests, except possibly in a peripheral way.

Re:FSB is not "the" successor to the KGB

[Divide By Zero]

Certainly they won't give it to whatever directorate's in charge of conducting espionage. Spies are the most honorable government officials there are, and nobody in Moscow's looking to get ahead by bending any rules.

Re:FSB is not "the" successor to the KGB

[elucido]

Certainly they won't give it to whatever directorate's in charge of conducting espionage. Spies are the most honorable government officials there are, and nobody in Moscow's looking to get ahead by bending any rules.

I smell sarcasm.

Re:FSB is not "the" successor to the KGB

[Rogerborg]

Whoa, whoa, whoa, let's put it in terms we can all understand, shall we? Are you saying that the FSB is like the Klingon ISF, while the FSO and SVR are the equivalent of the DSF?

Re:FSB is not "the" successor to the KGB

[chris mazuc]

Not one bit.

Re:FSB is not "the" successor to the KGB

[Anonymous Coward]

Certainly they won't give it to whatever directorate's in charge of conducting espionage. Spies are the most honorable government officials there are, and nobody in Moscow's looking to get ahead by bending any rules.

I smell sarcasm.

I smell obvious and the recursion thereof...

Re:FSB is not "the" successor to the KGB

[yossarianuk]

Using Windows is a bigger threat to US security than giving the Russian's the source code.

Re:FSB is not "the" successor to the KGB

[Bing Tsher E]

No, the security forces in Russia are not characters in a TV show.

Re:FSB is not "the" successor to the KGB

[Anonymous Coward]

It doesn't matter anyway since the FSB was replaced a long time ago by HyperTransport and QuickPath.

Re:FSB is not "the" successor to the KGB

[Rogerborg]

No, the security forces in Russia are not characters in a TV show.

Historical. Documents.

Brilliant Idea

[Anonymous Coward]

Giving the OS source code to the Russians... what could go wrong?

Re:Brilliant Idea

[shutdown -p now]

Microsoft is a company of 80k people. I would expect several hundred, at least, to have direct access to Windows source (and probably more like several thousand).

Do you seriously think that it would be hard for any foreign intelligence agency worth its salt to bribe, or otherwise hook, one or more of them, and steal the source code to whatever MS products they desire?

This is without even mentioning that there are quite a few people from ex-USSR working in MS.

Who can blame our "paranoia"?

[Anonymous Coward]

So now, how can we blame the US government for not trusting Microsoft products? ...or does this have something to do with the spy swap going on in Austria?

Soon it'll be a Linux First world if we don't all panik.

Re:In russia

[Pojut]

In Soviet Russia, you beat you to it!

Equal opportunity

[Cynic2sceptic]

I like it, the question remains - will they aid MS in any way or just use the opportunity to secure their own enviroment.
Also, isn't it fairly likely that they have the sourcecode already?

In Soviet Russia...

[yanyan]

I give up. This is too easy.

Re:In Soviet Russia...

[dimethylxanthine]

FSB caught your tongue?

Re:In Soviet Russia...

[Chupathingy]

If "In Soviet Russia, Microsoft gives you their source code,"

then "In Capitalist America.... You give Microsoft your source code."

Re:In Soviet Russia...

[Anonymous Coward]

In Soviet Russia, Front Side Buses YOU!

How's that?

Re:In Soviet Russia...

[moyl]

In Soviet Russia, your tongue catches FSB.

next step

[Anonymous Coward]

The FSB diffing the source with their own reverse engineered one to see if they did everything right.

This is actually good

[Chrisq]

It will keep them tied up for years trying to find exploitable holes, when the real spies will use something else

Re:This is actually good

[Anonymous Coward]

Wow, how did we miss that?! Hey, thanks for the info Chrisq.

Best,
KGB

Re:This is actually good

[JumpDrive]

Yeah , but can you play games on it. Everyone knows that it will never make it into the desktop market unless you can play games on it.

Trust, Interesting World

[Bob9113]

It is an interesting world in which a United States company trusts Russian spies more than it trusts United States citizens.

Re:Trust, Interesting World

[fuzzyfuzzyfungus]

It is a world operating completely as expected when a multinational corporation cares more about satisfying the requests of large customers than it does small ones.

Re:Trust, Interesting World

[Bob9113]

It is a world operating completely as expected when a multinational corporation cares more about satisfying the requests of large customers than it does small ones.

Well said. Thanks for truthing my post. :)

We would do well to remember that they are American In Name Only the next time they whine about taxes or H1Bs.

Re:Trust, Interesting World

[Anonymous Coward]

It is a world operating completely as expected when a multinational corporation cares more about satisfying the requests of large customers than it does small ones.

This is Russia. They pirate everything. They aren't customers.

Update email

[Linker3000]

Has anyone else just got the email from Microsoft regarding a critical security update that should be downloaded and installed immediately from windowsupdate.micros0ft.ru?

Maybe this will help the russian spies.

[elucido]

It will help with their IT troubles now that they will be given the complete sourcecode to Windows 7. This just goes to show me that Microsoft is evil. Stick to Open Source software. If It isn't open for everyone then something is wrong with that.

yeah, right

[circletimessquare]

because if the russian government (or any government) had an interest in using the source code for purposes beyond internal security, they would go "wait, we promised microsoft we would only use this domestically"

do you believe that? what exactly do you think motivates a government's actions?: protect the nation, at all costs, in any way possible. one way is to make false promises to naive parties and then promptly renege on them. but you write:

"I don't see how this deal with Microsoft could possibly threaten the US or US interests, except possibly in a peripheral way."

are you fucking serious? how naive and deluded are you?

the source code will soon be in the hands of ultranationalist russian hackers with marching orders to fashion a weapon or reveal a weakness out of anything they can find in the code. these hackers will be quasi-independent: no way to trace their activities back to the government. like the perfectly timed cyber attacks on georgia in 2008 as russian tanks rolled over the mountains or the cyberattacks on estonia because of a fucking statue. officially, of course, nothing to do with the government. yeah, right

you're a naive fool

Re:yeah, right

[Anonymous Coward]

And they said Screaming Fist would never happen.

Buildable?

[temcat]

I wonder if the scope of code to be provided allows building it to a working copy of Windows 7.

Re:Buildable?

[Shados]

Probably not. It is not all that uncommon for Microsoft to open its source. I mean, it doesn't happen everyday, but they have special facilities for that purpose alone.

It may have changed, but back when i saw it, it was basically a web based code browser that doesn't allow the more simple copying features (like no export and stuff obviously).

If its still what they use, then it definitely cannot (realistically) be built.

Re:Buildable?

[tibman]

How can the russians trust the source code to a binary if they can't compile and compare the binaries?

Re:Buildable?

[Anonymous Coward]

You are asking too many questions and your account is being terminated.

Potential attackers get code, do defenders?

[Anonymous Coward]

The FSB and their counterparts elsewhere are obviously potential attackers, and they get to see the source code, a huge benefit to them. Large corporations get to see it (IIRC), which must help with their security. The only ones left out in the cold are small/medium sized businesses and end users. At least I hope Trend Micro, McAfee, Symantec, etc. get to see it, so that those groups have a fighting chance.

Of course, now that I think of it, my computers are sharing a network with the FSB, every other intelligence agency, global criminal groups, and every hacker in the world. And I'm worried about the security Microsoft revealing its source code? What the hell am I doing?

Successor agency

[TrixX]

Shouldn't the successor to KGB be called LHC... oh!

Re:Successor agency

[glwtta]

Holy shit, that just completely blew my mind!

Re:Successor agency

[Anonymous Coward]

I'm gonna be a real you-know-what here and point out that if we follow that line of logic, it would actually be the LDV if you want to transliterate. Not sure how to do unicode here. Light Duty Vehicle? Laser Doppler Velocimeter...? Not quite as interesting...

Re:Successor agency

[L4t3r4lu5]

Leyland DAF Vans They made vans and minibuses in the UK. Most of them were shoddy and useless, and may as well have been made in post-communist Russia.

Re:Successor agency

[Anonymous Coward]

I'm gonna be a real you-know-what here and point out that if we follow that line of logic, it would actually be the LDV if you want to transliterate. Not sure how to do unicode here. Light Duty Vehicle? Laser Doppler Velocimeter...? Not quite as interesting...

!! Laser Deflecting Velociraptors !!

Very interesting...

Re:Successor agency

[Robert Zenz]

So, you mean CERN is just a cover-company?

Re:Successor agency

[TrixX]

Yes, an evil plot from ex-communists to take the world hostage threatening to eat it with an artificial black hole. There you have it, a plot for the next James Bond Movie.

Re:Successor agency

[Robert Zenz]

Ah damn it, and I already thought you'd come up with "threaten to blow up Vatican City with an Anti-Matter bomb". ;) Though, I agree that (yours) would be an interesting plot for a James Bond movie...I can already see the end battle...Bond and the ex-communist leader are rolling on the floor, stopping short before the black hole...first Bond seems to lose, then he turns the tables and the evil overlord is sucked into oblivion (though, I still believe that blackholes are nothing more then super-heavy spheres)! But it's to late for the world, the black hole already exists...but luckily Bond has that new inflatable Earth with him which Q gave him at the beginning of the Movie...well, I guess Stilettos will be forbidden from that day on. ;)

Re:Successor agency

[Anonymous Coward]

Like how HAL becomes IBM.

Re:Successor agency

[Anonymous Coward]

on a related note, did you know that the HAL 9000 computer went back in time, crossing over from a different world line where it exists in realspace, and founded IBM in our worldline?

we need open source by law

[Weezul]

We should restrict copyright for software to require publication of the source code. You could still sell custom software without releasing the source code for everybody, but you'd be required to release the source code to your customers if you wanted copyright protections.

Re:we need open source by law

[Bing Tsher E]

Why? The copyright protects a specific binary implementation. Are you implying that Microsoft's copyright protection should be extended to the method they use? That's what it sounds like.

Re:we need open source by law

[h4rm0ny]

We should restrict copyright for software to require publication of the source code.

Why?

Re:we need open source by law

[tlhIngan]

We should restrict copyright for software to require publication of the source code. You could still sell custom software without releasing the source code for everybody, but you'd be required to release the source code to your customers if you wanted copyright protections.

Copyright is designed to prevent that. I think you really meant patents, in which case every patent should come with the full (buildable) source of the product containing said patented item. After all, a patent has to describe how something is done, and nothing describes "how" better than the source code. The use of that code is restricted by the patent anyways, and copyright covers the use of the binaries.

Do the same for business patents (i.e., business employing said patent is literally open for inspection and observation by anyone) and you'll probably cut down the amount of silly patents filed (want to patent a silly feature? Release the source code to your entire app. Want to patent a stupid business plan? Well now your business is inspectable by anyone and everyone - open books for all, including your competitors).

Honey Pots ?

[mbone]

If I were in charge of this give away, some fake back door honey-pots would be put into Windows. That way, if they found and exploited back doors and security holes, Microsoft would know about it.

How to provide a hole that is not a hole at a deeper level would be an interesting exercise in computer science. Of course, if a hole is planned, a patch can be sitting ready to go as soon as it is exploited, which would help some.

Threat is by counterpassivity, of course

[dragisha]

Less holes in MS products => less opportunities to US intelligence audit/influence.

In Soviet Russia...

[Anonymous Coward]

In Soviet Russia, source opens YOU!

Whatcouldpossiblygowrong?

[halfEvilTech]

If anything deserves this tag it would be this. The Russian government has long been known to be corrupt and it is my guess that before the ink even dries that a copy of the code has already made its way to the RBN and others.

Am I the only one

[somaTh]

Am I the only one who thought of the text-a-question service? I mean, I could see Microsoft trying to get in on that action. I suppose the Agency portion of the title should've given it away.

in soviet russia

[Anonymous Coward]

AC's moderate you! But in slashdot, they just mod u down.

Wait for it...

[Anonymous Coward]

Cue Glenn Beck rant about Microsoft as communist plot in 3..2..1..

Reasonable Terms and a Nominal Fee

[Alsee]

I am open to negotiating a deal with Russia or any other government interested in offering me reasonable terms and a nominal fee in exchange for a copy of Linux source code.

-

Re:Reasonable Terms and a Nominal Fee

[Trelane]

For an extra dispensation, I bet you'd be willing to give them the remaining 90% and let them build and use it too!

As Stalin said

[gillbates]

Wasn't it Stalin who said, "The capitalists will sell us the rope we use to hang them."

Nice to know that Microsoft, after complaining for years that open source was insecure because anyone could see the code, is now providing same to Russia. Nothing quite like putting quarterly profits above national security.

Re:As Stalin said

[m93]

That was actually a Lenin quote.

Re:As Stalin said

[gad_zuki!]

I've always found that quote to be amusing. It like admitting that communism can't produce enough rope, only capitalism can, but they need rope so they deal with capitalists. Reminds me of all those stories about the price of car wipers and toilet paper in the USSR because their command economy 'geniuses' couldn't figure it out or couldn't turn capital into production.

>Nothing quite like putting quarterly profits above national security.

Lets not be too dramatic. The source code of Windows isn't some big trade secret. Several governments have it. Afterall, they want to see the source just like you do with linux and they have the buying power to demand it.

Re:As Stalin said

[dunkelfalke]

It is actually nothing like that. The saying implies that capitalists care about money so much that they would sell weapons which will destroy them to their enemies.

Re:As Stalin said

[meringuoid]

It like admitting that communism can't produce enough rope, only capitalism can, but they need rope so they deal with capitalists.

Read 1984 closely enough and you'll see this in effect. The despairing ending which everybody remembers is the future imagined as a boot stamping on a human face forever. But what was the first example we saw of the Party's information control in action? Why, it was our hero Winston Smith editing the figures for boot production.

For example, the Ministry of Plenty's forecast had estimated the output of boots for the quarter at 145 million pairs. The actual output was given as sixty-two millions. Winston, however, in rewriting the forecast, marked the figure down to fifty-seven millions, so as to allow for the usual claim that the quota had been overfulfilled. In any case, sixty-two millions was no nearer the truth than fifty-seven millions, or than 145 millions. Very likely no boots had been produced at all. Likelier still, nobody knew how many had been produced, much less cared. All one knew was that every quarter astronomical numbers of boots were produced on paper, while perhaps half the population of Oceania went barefoot.

Keep stamping, Big Brother. The day's coming soon when you'll run out of boots.

Re:As Stalin said

[bmajik]

I'd like to respond to this in two halves

Wasn't it Stalin who said, "The capitalists will sell us the rope we use to hang them."

You should assume that anyone in Russia or anywhere else that wants the windows code for naughty reasons already has it.

Nothing quite like putting quarterly profits above national security.

This brings up the more interesting half of my response.

What is Microsoft's obligation to US national security interests?

Microsoft (last i heard) had 40% of its revenue from outside the US. One reason MS has to continue putting up with the EU shakedowns is that MS gets so much money from its European customers. It would be financially irresponsible to just "walk away" and so MS has to continue putting up with the mafia style tactics employed by the EU.

The US DOJ has waxed and waned on how much it feels like "Sticking it" to Microsoft. Certainly the outrageous patent-troll lawsuits, monopoly litigation, and other things can be construed as "attacks" against Microsoft either by government entities in the US, or by MS competitotors using the force and authority of US government entities.

On the other hand, the current copyright and IP law protection regime in the US has some beneficial effects for MS. In the early days, having a strong copyright and anti-piracy legal framework was certainly a boon. These days when MS if the victim of many patent troll lawsuits it's not as clear that IP law is doing us much good.

I hold the (unpopular) view that Corporations have no moral obligations whatsoever.

When we see other countries doing bits of corporate protectionism to favor their domestic producers, we cry foul. IOW: I don't expect or want the US government to "help" Microsoft. But that's a two way street. Microsoft is a multi-national entity. WHy should it be loyal to the USA? Shouldn't its loyalties shift towards whomever provides the most benefits (or the minimum amount of pain/intrusion?)

Re:As Stalin said

[gillbates]

I hold the (unpopular) view that Corporations have no moral obligations whatsoever.

Perhaps this isn't the way things should be. But it is the way things are, with few notable exceptions. When the public at large understands that a corporation *can't* possess a moral compass in the same way a human can, then we can have a productive debate on the value of capitalism, and the appropriate regulatory framework to prevent abuses from happening.

All too many people fail to realize that a corporation - especially a publicly traded one - is a profit-making machine, nothing more, nothing less.

Re:As Stalin said

[Anonymous Coward]

That's an absolutely ridiculous interpretation of that quote.

I'll bet the NSA ...

[Rambo Tribble]

... is glad they picked Linux.

The conversation...

[lattyware]

Microsoft: So, we are agreed, you get access to our source code. FSA: Yes... we just have to add one question to our polygraph test for people reviewing the code? Microsoft: Yes. "Have you ever contributed, or plan to contribute, to open source software..."

Exporting software

[al3]

I once signed up for a license to distribute the Acrobat Reader on a CD-ROM my organization was using as a give-away, and I had to agree not to let the program end up in places like Cuba. Now, in the same week I learn about Russian spies being arrested and swapped with the USA, I hear that Microsoft is giving out the source code to Windows 7 to the Russian spy agency. Wow.

Re:Exporting software

[Anonymous Coward]

The encryption built into some software is actually classified as a munition for the purposes of export. So if you tried to export it you would be violating the same laws as an arms dealer. For further information, read the Export Administration Regulations. Have fun, it's a really LONG document.

In Soviet Russia...

[Sentrion]

Windows look out through you!

Priceless!

[Lisandro]

I'll just sit and wait for the torrent to appear!

I'm a Russian

[Anonymous Coward]

and Windows 7 was my idea

Re:In russia

[Anonymous Coward]

Which you will think is a good thing the next time you need it.

How the worm turns....

[zkiwi34]

It wasn't all that long ago when dear old Bil Gates et al were claiming in front of the DoJ that giving anyone (their competitors) access to Windows code would be a threat to national security. Fast forward to now and it appears that either the truth changed a whole lot or for some reason national security interests are served by giving China and Russia and who knows, maybe even the French access to Windows source.

The new Windows, our most secure OS ever!! Well...

Re:How the worm turns....

[thoth]

They changed even faster than that. IIRC, it was Jim Allchin that said releasing the source code for a portion of Windows (the message queue), would have serious US national security implications. This was in 2002, during the post-DOJ lawsuit cleanup where some states filed a separate lawsuit.

Less that a year later in early 2003, Microsoft entered into a broad source code sharing arrangement, with Russia, China, and many NATO members.
http://www.microsoft.com/presspass/press/2003/feb03/02-28GSPChinaPR.mspx

From "serious US national security issues" to "here you go Russia and China" in less than a year.

Damned if they do, damned if they dont...

[TheRedDuke]

I think it's ironic that we're reading an article about MS releasing source code and the /. community is busting their balls. Just sayin'.

Re:Damned if they do, damned if they dont...

[mikechant]

I think it's ironic that we're reading an article about MS releasing source code and the /. community is busting their balls. Just sayin'.

Maybe you should think some more and consider that
1/ MS are releasing the source code to potentially hostile foreign governments (China, Russia), but *not* to (say) security researchers etc. who might get something useful out of it for the benefit of Windows users in general.
2/ MS are not releasing buildable or complete source, there is no way to tell if the source accurately reflects the actual distributed binaries.
3/ MS has been doing this for years and it is clearly not in any way a path, stepping stone or partial move towards open source or anything like it.

So maybe you'd be able to explain why it's 'ironic' that they are being criticised in the light of the above?

Re:Damned if they do, damned if they dont...

[TheRedDuke]

So maybe you'd be able to explain why it's 'ironic' that they are being criticised in the light of the above?

Not really - I think my joke just fell on deaf ears.

Re:Damned if they do, damned if they dont...

[Anonymous Coward]

MS is releasing the source code to the blackhats. Not the whitehats who have to rely on the code to keep out intruders. This is another reason why people are extremely concerned about this move.

As a business owner, the best you can do is perimeter security because there is in effect no solid way to secure a Windows machine other than air-gap it. So the next best thing to do is focus on network security so the baddies can't get to the network segment (as well as isolate compromised boxes from everything else), as well as app security so malicious code is not able to execute on the machine.

Now, if people want to be really serious about wanting to completely get rid of Windows, find a way to make an Exchange replacement which actually works.

FSB isn't really the KGB's successor...

[Wyatt Earp]

The SVR is the successor to the KGB's First Chief Directorate, the section that is responsible for intelligence and espionage activities outside the Russian Federation. It works in cooperation with the Russian military intelligence organization GRU, negotiates anti-terrorist cooperation and intelligence-sharing arrangements with foreign intelligence agencies, and briefs the Russian president.

The FSB is the domestic intelligence organization handling counter-intelligence, internal and border security, counter-terrorism, and surveillance.

So it's like the division of the CIA and FBI with the GRU being the DIA.

Back in the Cold War, the ten Russian spies would have been working for the KGB, they didn't work for FSB this time however, they worked for SVR.

Have fun!

[Anonymous Coward]

The windows 7 source code is huge!

If the russians can figure out any part of it then go them!

All the code?

[Anonymous Coward]

So microsoft is giving them all the code? So they can compile it on site and have it run? Or are they giving them pieces of paper that they can read in their spare time; pieces of paper with pseudocode that give a rough general idea of approximately something? Its one thing to be given pieces of paper, another to compile it and see it run with full functionality. Using microsoft anything is a bad choice because you cannot audit it. The Russian government can now audit their stuff, but upon inspection, will give it back to them, since they can see for themselves exactly how bad it is.

Yo!

[notknown86]

Yo America!

What value has your freedom when your freedoms are extended more to your past and present enemies than to yourselves? Which one of your domestic agencies gets the same privileges? Let alone (holy fuck!) the actual domestic *users* of the software?

Excuse me when I quietly say *pffft* next time I hear another hypocritical cunt spout off about freedom with no consideration for the responsibility in preserving those freedoms. Truth is, most care more for comfort. Not a problem, but it bothers me when it is nested in a halo of moral rectitude.

Clearly you have no idea about security

[Anonymous Coward]

Clearly you have no idea about security. It doesn't matter a fig how much of a pain it is to set up, a government or sufficiently involved organisation to need such security can and WILL do it.

Do you know who wrote SELinux? NSA. Do you think they wrote a system they wouldn't be able to configure for their own use?

Just because you have source

[Anonymous Coward]

Just because you have source doesn't mean you have any right to copy it, in the same way as the fact that though your english copy of "The Half-Blood Prince" is there open source for you, that doesn't mean JK Rowling has no copyrights.

And yes, copyright HAS to be on a specific implementation: you can't copyright "a Word Processor". You can only copyright the code. So your reading is incorrect and deliberately so, so that you can cast FUD upon the waters.

Not just governments, college students too

[perpenso]

It's not just governments. Microsoft gives some college faculty and students complete access to Windows source code. They have to be part of a research team doing something Microsoft finds interesting, sign NDAs, etc. Microsoft gets access to their work but there are no restrictions on publishing. A friend was on such a team when he was a grad student.

I See Microsoft went Open Source

[Anonymous Coward]

Microsoft Windows, Open Source to everyone, "except the user." The user who pays has to break the law to get the source code. That's irony.

While it's funny on top, it's not funny ultimately. It certainly isn't in the public interest. It's in the spying interest though.

Copyright requires we be able to learn

[Anonymous Coward]

Copyright requires we be able to learn. You can't learn how someone coded their application from the object file. Copyright prevents you from copying and distributing whatever is copyrighted. And you can only copyright expressive art. That would be the source code, not the object code.

Think about this too: when the copyright expires, what can you use the object file on anyway? I can learn good writing from reading shakespear. If I can't read how you coded your application, what do I learn from it? Nothing.

Copyright on binary or object should DEMAND that source be available. You can't compile and make Bob's Windows 7 because there's still copyright on it. You can't use their VFAT extension in the US because it's patented. But that is true whether you have the source code or not.

And, since you can't gain anything from the object being made public domain, that requires you get the source code.

You've lost NOTHING from doing so.

Unless you've got something to hide in your code...

I said copyright & I meant copyright.

[Weezul]

If you don't provide your customers with the source, then you should have implicitly revoked your claim of copyright, pure and simple.

Software and business method patents should simply be eliminated outright of course.

Don't blame me...

[MJMullinII]

I voted for kotos!"

Jokes aside, I could very easily go into all the reasons why I use the Mac OS...but it's not proper to dance on another's grave :)

Just the latest...

[rnturn]

... in the almost innumerable reasons to avoid using Microsoft products.

Shouldn't something like this have been reviewed and approved by U.S. security agencies? And if it was, you gotta wonder whose side they're on.

I don't believe it!

[Anonymous Coward]

I don't think Microsoft is capable of writing KGB's successor System. KGB isn't that trivial.

But how...

[Anonymous Coward]

How did Microsoft get the source code of the FSB anyways? And why are they releasing it?

Haaaa I can hardly wait....

[dogzdik]

For the source code to hit the internets!!!!

Fuck Microsoft.