Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft's Security Development Process Under CC License

Posted by timothy on from the share-nicely dept.

An anonymous reader writes "The H Online writes: 'Microsoft has placed its process for secure software development under a Creative Commons License. The company hopes that this will lead to more developers utilising its process for programming software more securely across the entire product lifecycle ...'"

2 of 164 comments (clear)

  1. Re:Oh boy... by DJRumpy · · Score: 5, Insightful

    Yes and no. The MS OS is actually written with a lot of safeguards in place to make the OS more secure. Years of being attacked tends to make one a bit defensive and certainly more technically adept.

    I think their problems are on multiple fronts:

    Overly complex code
    Lax permission requirements,
    Too many admins (still default on workstation installs)
    Poorly written apps that in turn requires them to bend the rules or to provide workarounds.

    MS could take a hard line, and force apps to comply with OS guidelines, but they'd be shooting their compatibility in the foot. although I see them nudging folks in that direction, with more functions locked out by default, they have a long way to go. Instead, they bend over backwards to try to work around compatibility issues and legacy support, and as a result, leave tons of loopholes. I had great hopes for their VirtualPC bit and was hoping they would take a more Apple-centric approach, allowing them to just start with a fresh slate while virtualizing old OS compatibility. It appears that was a wasted hope however...

  2. MS Security... by leromarinvit · · Score: 5, Insightful
    Ahh yes, I can see it now:
    • Never check your input, no matter where it comes from
    • Make sure to make your algorithms as complex as possible so you don't run out race conditions and other non-trivial bugs, preferably in security critical areas
    • Embed your security flaws in specifications you'll have to honor forever to maintain backwards compatibility
    • Most importantly: When (not if) somebody finds a bug and reports it to you, don't fix it at once. Only when an exploit is out in the wild you can even start thinking about how to fix the bug.
    --
    Proud member of the Ferengi Socialist Party.