Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Signs Renewed Cybersecurity Agreement With NATO

Posted by samzenpus on from the sign-on-the-dotted-line dept.

An anonymous reader writes: Microsoft and NATO have renewed a cybersecurity partnership. The agreement is part of Microsoft's Government Security Program (GSP) which allows worldwide federal bodies controlled access to Microsoft source code. PCWorld reports: "Since its inception, the GSP has grown to encompass a bunch of other types of information, especially over the past few years. With the new agreement, NATO will get controlled online access to source code for key Microsoft products including Windows and Office; information about Microsoft's cloud services, and intelligence about cybersecurity threats."

19 of 37 comments (clear)

  1. SEE! by Anonymous Coward · · Score: 1

    And that boys and girls is another example of why you should NEVER trust Microsoft or governments.

    1. Re:SEE! by NoZart · · Score: 3, Interesting

      But when i KNOW what an entity does, then i can trust in that and act accordingly.

      It's way worse when some entity does NOT disclose such behaviour.

    2. Re:SEE! by Anonymous Coward · · Score: 3, Insightful

      Governments also have access to Linux source code, so I guess we shouldn't trust Linux either?

    3. Re:SEE! by Chrisq · · Score: 4, Informative

      And that boys and girls is another example of why you should NEVER trust Microsoft or governments.

      I would be interested to see (if not classified) what the Nato recommended settings for Windows are. I have just taken the "free Windows 10" upgrade and took the "detailed" rather than the "quick settings" options and was amazed at the number of different data collection options I had to turn off. I say "had to", the truth is it probably doesn't matter, I dual boot and use Windowsa two or three time a year to run things like the update for my satnav

    4. Re:SEE! by Bert64 · · Score: 3, Informative

      The point is that we also have access to linux source code, so we're all on a level playing field.
      Closed source code is only available to select groups, and is also in the hands of blackhats. Legitimate security researchers have no access to it.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    5. Re:SEE! by Type44Q · · Score: 2

      Legitimate security researchers have no access to it.

      Legitimate security researchers have no legal access to it. FTFY.

    6. Re:SEE! by plcurechax · · Score: 3, Informative

      I would be interested to see (if not classified) what the Nato recommended settings for Windows are.

      The US's NSA (with NIST - US National Institute of Standards and Technology) and Canada's CSE(C) (with the Treasury Board / Public Works) publish guidelines for civilian government security policies and recommendations on their public web sites. I believe other (counter-)intelligence agencies do the same as well.

    7. Re:SEE! by frovingslosh · · Score: 1

      Microsoft "security" is a perfect way for any government organization to waste public tax money. Of course, we could use the money to import more Syrian terrorists, but I'm sure that we can find the money somewhere to do that too.

      --
      I'm an American. I love this country and the freedoms that we used to have.
    8. Re:SEE! by Ravaldy · · Score: 1

      Not all data collection has vile intentions. A lot of the data collected is used to understand user behavior or the sequence of events that lead to a failure. Some of the data collection is simply to do with the errors themselves.

      By default they leave it on because they want to improve their OS.

      The good thing is you have an option to opt out.

    9. Re:SEE! by Edis+Krad · · Score: 1

      I can't help but to wonder how many of those switches are nothing but disconnected flickering UI elements.

    10. Re:SEE! by Bert64 · · Score: 1

      That's the whole point, legitimate security researchers don't want to break the law...

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    11. Re: SEE! by Type44Q · · Score: 1
      No. The law is entirely orthogonal to the matter; an illegitimate security researcher would be looking to for vulnerabilities to exploit and a legitimate security researcher would be looking for vulnerabilities to patch.

      "Legitimate" != "legal"

    12. Re: SEE! by Type44Q · · Score: 1

      Unless, that is, you're a koolaid-drinking little sheep with an IQ no higher than 120 or so... ;)

  2. Wait.. by Anonymous Coward · · Score: 1

    They allowed access to their source code and found exploits. Being ethical, they of course tried to fix them...

    And then I woke up... It was just a dream.

  3. Viewing code means nothing; can they build it ? by Anonymous Coward · · Score: 1

    Viewing the source code means nothing here.

    The critical thing is: can they build that instance of the source code and use it in production ?

    If not, then this is just a PR exercise because you have no way of knowing that your production binaries are built from this instance of the source code.

    1. Re:Viewing code means nothing; can they build it ? by eibhear · · Score: 1

      Spot on.
      Microsoft could prove the value of the programme if it implemented something like the the Reproducible Builds project by Debian: https://wiki.debian.org/Reprod...
      'Course, that would probably be an openness too far for them...

    2. Re:Viewing code means nothing; can they build it ? by blackwizard · · Score: 1

      They don't need to build it. They'll be able to analyze it for security issues and keep the 0-day exploits they find to themselves. And they'll get notified in advance when Microsoft spots the same issue, so they'll have time to switch tactics.

  4. Dear NATO: by Type44Q · · Score: 1

    Dear NATO:

    In the interests of keeping our world safe, we hereby promise not to sell you any of our products. We do hope you appreciate the gesture.

    Sincerely yours,

    Microsoft

  5. Re:Another win for Open Source! by Gadget_Guy · · Score: 1

    It is hardly new that they share their code. They have had a Shared Source Initiative since 2001 to enable "source code access for customers, partners and educators, by making enterprise systems integrators (SIs) eligible to receive access to Microsoft Windows source code" (Source).

    They already did share their code with partners like Mainsoft, who was the source of the leaked Windows code for NT4 and 2000 that happened in 2004.

    Interestingly, Mainsoft was "one of the main providers for the Microsoft Windows Interface Source Environment (WISE) program, a licensing program from Microsoft which allowed developers to recompile and run Windows-based applications on UNIX and Macintosh platforms. Before WINE there was WISE!