Slashdot Mirror
Microsoft Lets EU Governments Inspect Source Code For Security Issues
itwbennett writes: Microsoft has agreed to let European governments review the source code of its products to ensure that they don't contain security backdoors, at a transparency center in Brussels. The second of its kind, the new center follows on the heels of the first, built last June in Redmond, Washington. Part of Microsoft's Government Security Program, the company hopes the centers will create trust with governments that want to use Microsoft products. "Today's opening in Brussels will give governments in Europe, the Middle East and Africa a convenient location to experience our commitment to transparency and delivering products and services that are secure by principle and by design," said Matt Thomlinson, Vice President of Microsoft Security.
Can they (the governments) compile from source?
How could they even understand the code if they don't have an expert capable enough to tell them how stupid this is? Unless the governments are allowed constant access to the source and also the possibility to compile any configuration they choose and need, this "inspection" serves absolutely no purpose.
So a few people can spend a bit of time looking through hundreds of millions of lines of code? How is that useful?
And who would trust MS not to show one version of the software and deliver something compiled from slightly different sources? Remember MS is more than happy to turn over dissidents' emails to the Chinese government. MS will say: "We follow all applicable laws in the countries where we operate." So what are the US laws about spying on anyone outside the country? I think it is required under NSL's.
Look but don't touch.
Is this really the source code to the binaries we're using?
hahaha, but of course it is!
Help build the anti-software-patent wiki
This is nothing new. The Shared Source Initiative has gone on for years, and provides access to the source of Microsoft products to governments, OEMs, large customers etc.
The difference here is that they are providing it at what they call a "transparency centre", which I suspect is to minimise the danger of the source getting released to the public so we all can inspect the code.
probably be finished sometime before the sun burns out
No, it's not free. Install it and after 30 days suddenly it locks you out. Want to keep using it? Must provide Microsoft with your identity.
You don't even need EU to verify the lack of backdoors. Microsoft itself strives to create a product without backdoors. If one would be found, it would greatly hurt their business.
Has there ever been a backdoor in Windows or other Microsoft products? No.
I'm just tired of the paranoid attitude that all commercial software provides automatically want to screw you. No. They want to create a product that you want to buy. I'm sure you don't want to buy a product that has backdoors.
The main reason for going with closed source is not hiding malicious stuff, but that it allows making money with software. Open source works only if you have something else to sell along it.
Let alone the fact that you can't be assured that the source code you get to see is actually the one they use to build the final product, i'm also left with the question of 3th party software that is included in MS products. Will these have their source code also available for inspection? Can't imagine those companies will allow MS to do that. And if you can't look at those products source code, how can you be sure there is nothing going on in those?
On a long enough timeline, the survival rate for everyone drops to zero.
The cynic in me thinks the NSA/GCHQ will use this as an oppurtunity to engineer more 0-day malware for their own use. Much easier if you can have eyes on the code...
A picture is worth exactly 1024 words.
From recent revelations, it's more likely the governments are looking for easier ways to break into citizens' computers.
I can see it now - EU gets a nice clean shiny new OS from Microsoft. The next Tuesday a patch is released, MSNSAUS-007 Critical. In the fine print:
"This patch will allow a friendly U.S. operator to cause code to execute on the computer of a user. Such code could take any action that the user himself could take, including but not limited to creating, changing or deleting data, or communicating with an external web site."
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
They should make the source available via an ftp server, much cheaper than this fancy Brussels center and then you get the 'many eyes' advantage too.
B.t.w, in part of Brussels it's likely called a 'centre'.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Because it is fine for casual talk.
Just don't use it for sensitive political, business and lawyer subjects.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Is this really about back-doors or bugs exposing entrances?
In any case are the representatives of governments really the ones you should be showing your source code too? Seems to me that some of these people have a vested interest in keeping any exploits they find secret to their own intelligence agencies to be used later in targets (possibly their own citizens) to intrude and exploit.
I think I've said this before, if they really want to gain our confidence they need to let the users choose someone to inspect their source and demonstrate its validity against published binaries.
Because its the only VOIP solution that actually is usable?
I agree! I know that mobile phones are based on old model technology when connecting, and have heard they the old codes that could be sent over a model to estabilsh connections are still there, and can still be abused, to a point where they can turn your phone into a listening device for "them" to hear what ever the phone can pick up, and the OS of the phone won't pick up on this activity either.
But more to the point of this article, I think Microsoft has made massive changes in the way they're dealing with the outside world, and if this is their way of saying they've got nothing to hide, then I'm all for it. If you knew of a load of security vulnerabilities in software you created, would you be so willing to let a customer read through your source? So thumbs up for Microsoft! I'm impressed!
On a system you build from the silicon up with audited firmware and chip design.
Failure to follow this advice may result in non-deterministic behavior.
...the relevant back-door code just have to have an EXPORT license required of it such that the binary can be shipped but the code itself can't be reviewed.
Put it in a required portion, and you have a great calamity set up. Of course, it'll also be evident that something is being hidden.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
This, this, a thousand times this.
You can look at the source code all you like, but unless you can *use* that source code to build your own binaries and redistribute them, then that means absolutely nothing in terms of security.
The products you buy off the shelf may or may not have any relation to the code you looked at.
That's why Free Software is so important for security-sensitive applications. Not only do you get to look, you get to modify it and redistribute.
I mean with a restrict license that most people would not classify as open-source? Something like "you can download the source and build the OS, but you can not use it without paying us"? Or maybe just open-source some core components (the kernel, the drivers, all security-sensitive stuff) without the stuff that makes it usable (the GUI and the CLI) with the same conditions as I mentioned before?
I am serious here, I want to know what would be the implications.
Well, trust isn't a single bit operation. More nearly a float. Actually, trust along a single dimension is reasonably considered a float, but there are multiple dimensions.
Yes, it's safer if you use your own trusted compiler. But it's also safer if you build your own CPU, and the rest of your computer. And I doubt that MS would have bothered to build a custom compiler that would hide back doors when it was compiling the MSWind OS. It clearly *could*, it's just unlikely. Of course, how unlikely you consider it depends on what you are worried about, and I'm not planning on using any of their software, so I can afford to be unworried. I worry more about SOHO router vulnerabilities.
So the question becomes "For what purposes are they considering using MSWind?". This is still probably only security theater, but your proposed objection is likely to be unreasonable. One should never be certain, so one operates on the balance of probabilites of cost and gain.
I think we've pushed this "anyone can grow up to be president" thing too far.