MS Cites National Security to Justify Closed Source 827
guacamolefoo writes: "It was recently reported in eWeek that "A senior Microsoft Corp. executive told a federal court last week that sharing information with competitors could damage national security and even threaten the U.S. war effort in Afghanistan. He later acknowledged that some Microsoft code was so flawed it could not be safely disclosed."
(Emphasis added.) The follow up from Microsoft is even better: As a result of the flaws, Microsoft has asked the court to allow a "national security" carve-out from the requirement that any code or API's be made public. Microsoft has therefore taken the position that their code is so bad that it must kept secret to keep people from being killed by it. Windows - the Pinto of the 21st century."
War (Score:5, Funny)
Nice (Score:5, Interesting)
Nothing will ever be the same again indeed.
Re: Nice (Score:3, Funny)
> When in doubt, raise concerns about terrorism, or inappropriately use 9/11 as a crutch. The new coin of Washington (both east and west it seems).
It's not just the USA. Want to wage war on a neighbor or on members of your own population? Just go ahead, and call it "War on Terrorism (tm)" if anyone expresses outrage over it.
Re:True, and... (Score:3, Insightful)
For example, if any inconvenient fact looks like it might support Creationism, there are those who immediately impugn it as being `War on Science'. (-:
Of course the other side uses the same tactic as well. It's opportunism at its best. It takes a lot of integrity to resist using such tactics, especially when your opposition isn't reluctant to use them. I wish we could see more integrity in the world.
Re:True, and... (Score:4, Funny)
>stated many times that He doesn't want to be
>easily found--hence, no fact should be hard to
>accept for anyone of a religious mind.
prove that "god" "said" this.
i'll accept *.wav's or *.mp3's or *.ogg's
Re:Nice (Score:5, Insightful)
Dick Cheney said sunday something to the effect "there is a certainty they will attack us" and then said it could be any time maybe even a year from now. How brilliant is that? An infinite war. Of course he went on to say that the administration should never be investigatged or critized while we are fighting this war. Fucking brilliant. This administration has done a masterful job of shutting down dissent, much better then any two bit dictator or strongman.
Welcome back to reality. (Score:3, Insightful)
First off, "retaliate against Afghanistan" is funny wording. 1) The Taliban was recognised in few places as the official government of Afghanistan. They were foreign invaders who conquered Afghanistan and have had virtual control of it for several years. Seems kind of funny that Afghanistan soldiers did most of the attacking against "Afghanistan" 2) Retaliation? The Taliban had harbored Bin Laden while he orchestrated multiple terrorist attacks in the past, including a previous attempt to destroy the world trade center. These latest murders was the last 3,000 straws, so to speak. The U.S. gave them a choice, and the Taliban chose not to hand him over.
It's sad if oil really was involved, but even if it was, the U.S. did the Afghans a big favor by kicking out the invading Taliban. And it was definitely in the interest of the U.S. after so many attacks on American lives.
Re:Wrong! Power is in words, not wars! (Score:3, Insightful)
This is just one example.
Re:Nice (Score:3, Insightful)
I don't care whose code broke...the fact that a software problem could cripple a ship is unconscionable.
Re:Nice (Score:4, Interesting)
I don't see how thats microsofts problem. The government decided they wanted to use off the shelf computer equipment and software. They got sick of developing a computer system and maintaining it for 30 years. You realize that in the 80s there were software engineers that were maintaining code for submarines that had ferrous-core memory systems.
The navy wanted to get away from that.
So, its nice that you're mad about the navy's choice of computing infrastructure. The fact that it happened to fail has nothing whatsoever to do with microsoft, and you're being irrational about being upset with them over this.
Not that there aren't other things to be upset with them about
Re:Nice (Score:3, Interesting)
Another person at the Naval Air Warfare Center, who also requests anonymity, says: "In my view, and this is only my opinion, the move [IT 21] is not only illegal, but wrong. Moving the Navy completely towards a proprietary computer (a memo quoted states only 'Intel' computers could be purchased) and a proprietary OS (Windows) is against Navy procurement standards requiring OPEN competition. If anything, the Navy should stress compatibility, and open standards. MS Windows is not an open standard.
David Kastrup of the Institut fur Neuroinformatik in Bochum, Germany observed last year that "The specifications call for use of Windows NT 5.0 [now Windows 2000] when available, without any prior tests for usability or whatever. This means that the military is signing a blank cheque of trust to Microsoft to deliver what their marketing hype promises.
Re:Nice (Score:3, Insightful)
Thank you in advance.
That's brilliant (Score:4, Funny)
More proof that Bill Gates is just a more successful troll than me.
The point of java (Score:2, Troll)
Color me crazy, but wasn't one of the most appealing points of java in fact its interoperability?
Re:The point of java (Score:2, Funny)
You forgot to translate this:
RagManX
Re:The point of java (Score:4, Insightful)
The point was portability, not interoperability.
So Sun claims: "you can run your code anywhere", implying "as long as it is Java-code". Microsoft claims: "your code can talk to anyone", implying that your code runs on Windows.
You can choose what you like/don't like more.
MS sweating... (Score:4, Funny)
"Yeah, how can we BS her on this?"
"Uhh, maybe we can find a link to terrorism?"
"YEA! That's it! We can't comply, because of National Security"
Harmph....
You have the emphasis wrong. (Score:2, Troll)
Any fool knows that it is flawed to that magnitude. Only the fact that it was publically admitted by a M$ official is newsworthy.
Now what are they trying to hide? (Score:4, Interesting)
Worrying isn't it?
Re:Now what are they trying to hide? (Score:2, Interesting)
Re:Now what are they trying to hide? (Score:4, Funny)
I figure if Microsoft code was handling anything important, we'd be dead already. The concept adds a whole new meaning to BSOD.
Hypocrits (Score:5, Interesting)
If a car was dangerous enough to possibly cause death, wouldn't the government require a recall? Wouldn't the media jump on them like rabid wolves like they did Firestone? Wouldn't people avoid the things like they did Firestone?
Re:Hypocrits (Score:3, Funny)
But, I agree... I'd love to see the gov't return MS stuff and REQUIRE working code. Watch M$ reply with a RedHat CD.
Re:Hypocrits (Score:2)
Re:Hypocrits (Score:4, Insightful)
Re:Hypocrits (Score:3, Insightful)
I'm a recall coordinator. My job is to apply the formula....
Take the number of vehicles in the field, (A), and multiply it by the probable rate of failure, (B), then multiply the result by the average out-of-court settlement, (C). A times B times C equals X...
If X is less than the cost of a recall, we don't do one.
In other words, if it is cheaper to pay off everyone neccessary to prevent a recall than to actually do one, they don't do one.
Re:Hypocrits (Score:3, Informative)
The statement is, and always has been "we fix what we know about, if it wont break too much other stuff".
Incidentally, within some egregious time window (10 years ?) they fix it for free.
Thats the tradeoff the government willfully made when it wanted to use an off the shelf operating system, instead of doing it in house or submitting bids for a custom contract. (software that requires an ongoing support contract for security issues or _any_ issue at all)
What you're asking for would be something like an A1 system under the old pre-Common Criteria scheme... i.e. a provably correct system.
Guess how many products received A1 certs. Theres a list of some of them. It wouldn't take a long time to load the html. Even at 300bps.
Pintos should be offended... (Score:5, Funny)
unsafe at any build (Score:2)
Equality (Score:3, Interesting)
Fodder for ads (Score:5, Insightful)
Think about it from Microsoft's point of view... (Score:5, Insightful)
Re:Think about it from Microsoft's point of view.. (Score:5, Funny)
Hope this helps: irony [dictionary.com]
MS Flight Sim (Score:2, Funny)
Hey, now that I think of it, perhaps this wasn't a terrorist attack after all ?
Of course our security lies in... (Score:4, Insightful)
Yes, those are the integral parts for security. Who cares about information being stolen. As long as no one can rip a copy of your cd, everything is kosher...
Everyone knows terrorists rely on warez!
Re:Of course our security lies in... (Score:3, Interesting)
Just imagine your only phone call from you jail cell: "Sorry, I tried writing a st-valentines letter to you, but the 400 year old poem that I included was considered copyright and my computer called the cops."
er, (Score:5, Insightful)
> The protocol, which is part of Message Queuing,
> contains a coding mistake that would threaten the
> security of enterprise systems using it if it were
> disclosed, Allchin said.
Then with all the billions and billions of dollars M$ has hanging out in the bank, why not hire someone and FIX THE PROBLEM. What's the problem with doing the things that make sense?!
Single best thing M$ could do to improve their product security is to adopt the 'patch often' mindset. Fix something, release a patch, everyone goes home happy.
The bi-annual (exaggeration) security patches they currently do ain't gonna do it.
Re:er, (Score:4, Insightful)
That's great in theory, but the real world doesn't work like that. In the real world, it is very hard to get everyone to apply patches, and the software vendor gets blamed even when they've made the patches available months earlier; Code Red is a perfect example of this.
In the context of system administrators who forget to patch their boxes, you actually end up with better security if you release a large patch every month than if you release small patches every few days.
Re:er, (Score:2)
Re:er, (Score:5, Insightful)
Microsoft is all about perception. They learned long ago that they can release pure shite as long as the general public perceives it as good. And that can be accomplished through Marketing, which is much easier to craft and control than Coding....
Re:er, (Score:2)
People don't think that about games, video drivers (Score:3, Insightful)
Re:er, (Score:2)
WHAT?!?! Microsoft software has BUGS that could COMPROMISE SECURITY? *gasp* oh no!??!
</sarcasm>
Like that's new.. They should read NTBugTraq every once in a while then. Heck, even open source software has bugs. Code I write has bugs. Heck, that's a fact of life. And yes, sometimes they can compromise security.
Their big mistake is not opening the code. Maybe some malicious underground cracker already figured out how to exploit this. You don't know. It's Security Through Obscurity, and will NEVER work.
Great going Microsoft. Keep on going like that. I'll be waiting for the outcome.
Re:er, (Score:3, Funny)
The protocol, which is part of Message Queuing, contains a coding mistake that would threaten the security of enterprise systems using it if it were disclosed, Allchin said.
"That's business with
=tkk
Re:er, (Score:3, Interesting)
How many of you kids remember a.out to elf? Or the switch from libc to glibc? Any of you try to upgrade through that yourself without reinstalling a new distribution? Think of both of those, multiply it by 10000 and throw a couple major security holes in that the entire world may not be privy to. Then you are starting to scratch the surface of how large this problem is. On top of that why not factor in some bullying from the MS sales force, how many larger MS customers have been bullied at one point or other? Probably enough that if they were told they have to replace everything some of them would get really pissed off and seriously think about shopping elsewhere.
MS fucked up and they fucked up bigtime. They need more time too, they've got
Re:er, (Score:2)
It really worries me that MS are now effectively admitting "our code sucks, and we can't fix it".
This is big news... (Score:2, Interesting)
What's the solution for the DOJ (who holds the reigns now)?? Simple: force MS to adopt open standards and open code modules in the future. Given that the MS business model is based on leveraging its "secret" elements, this could force them to abandon nearly all of their anticompetitive practices.
More Lawsuits Now? (Score:2, Insightful)
All we need is some documented evidence of a MS exploit resulting in injury or death.
*Yawn* I think someone from Peru said it best ... (Score:5, Insightful)
Peruvian Congressman David Villanueva Nuñez made exactly this argument:
To guarantee national security or the security of the State, it is indispensable to be able to rely on systems without elements which allow control from a distance or the undesired transmission of information to third parties. Systems with source code freely accessible to the public are required to allow their inspection by the State itself, by the citizens, and by a large number of independent experts throughout the world. Our proposal brings further security, since the knowledge of the source code will eliminate the growing number of programs with *spy code*.
In the same way, our proposal strengthens the security of the citizens, both in their role as legitimate owners of information managed by the state, and in their role as consumers. In this second case, by allowing the growth of a widespread availability of free software not containing *spy code* able to put at risk privacy and individual freedoms.
The flaw here is that for windows code to posess the powers they imply, it would need to be a state secret. Perhaps it should be illegal to distribute mission critical osc across us boundaries? Windows code a state secret? I think not, anyone can reverse compile machine code.
Micro$oft should realize that governments do not like security threats they are not able to evaluate themselves. The NSA, for example, cannot sit and tinker with windoze's security holes the way they can with OSC (open source code)...
-Sean
Playing both sides of the fence (Score:2, Interesting)
National Security means... (Score:5, Insightful)
Remember: Cryptanalysis has, and will, always come in fourth place after burglary, blackmail, and bribery.
DRM and national security (Score:2, Insightful)
Terrorism = File Sharing
someonce call the RIAA and tell them the great news!
Ugh (Score:2)
BlackGriffen
Wow that's bold (Score:3, Insightful)
If it happened in any other industry (auto, aviation, train, commerce, weaponry, etc) the Government would drop their product like a dead rat (and more probably force the manufacturer into a recall). Yet Microsoft is willing to use it as a defense?
Fear the future... (Score:5, Interesting)
1) A software system with 1 or more serious _known_ flaws must be used on a worldwide scale by a government agency or large company.
2) That software must then fail.
3) The failure must cause thousands of deaths or hundreds of billions of dollars in loss or damage.
The result will be like the 9/11 of software...when the world wakes up and realizes that we have become so dependent on software systems for our daily lives that we actually have to start caring whether or not they work correctly. We need to start taking an engineering approach to software and KNOW (not think) that it will operate as advertised.
I'm actually hoping that this will occur sooner than later. The later it happens, the more catastrophic the result will be and the less time we'll have to rectify the problem before it happens again.
Lawsuit (Score:2)
Sure, the license makes all warranty void, but what about when they knowingly distributed insecure software.
This offers a perfect fact for your case.
News Flash!!! (Score:2, Funny)
(NAPI)- John Ashcruft today warned that al-Qaida terrorists have infiltrated several "Learning Tree" facilities over the past few months and have obtained illicit "MCSE" certificates. "With the imtimate knowledge they now have, no one who runs the Windows Operating System is safe" quavered Professor M. Druel of the University of North Dakota at Hoople. "Given the flaws we were warned of, why didn't we listen to that guy back during the trail?" Linux users (and other users of the soon-to-be banned "open-source" software) spent the days chuckling.
They must be getting desperate... (Score:5, Insightful)
My point is that they did not say anything new by admitting the problem. However by admiting it they also admit that they don't really care about security, as they certainly could have done significantly better! This casts a very bad light on other ventures like
So why are they admitting it anyway? In my opinion MS is scared to death that open APIs would also mean stable APIs (i.e. APIs that don't change all the time) and would enable others to make Windows compatible execution environments with relative ease. The sources are also important, because the API documentation MS would give (could?) away is not complete and correct enough. So while it takes a huge effort, competitiors would be able to really find out the complete API functionality and implement it in a way so that things that run on Windows would usually run on competing products without retesting or modifications.
As MS is not really having a good product, just an effective monopoly (by making cloning their API difficult), reasonable documentation of their APIs could kill them. At least that is what I think they believe.
Re:They must be getting desperate... (Score:3, Interesting)
Granted I don't use all aspects of the API, so perhaps parts of it are poor, but the parts I use are highly documented, examples given, and all sorts of other goodies. This is what dragged me, and many hundreds of thousands of other developers into the MS world where we make a good living building solutions to business problems.
-me
Re:They must be getting desperate... (Score:3, Insightful)
Perhaps the best basis for my concerns is the plans of MS to withold interfaces. In the past they have given these interfaces to selected people and not to others, so they where being used by some software. For an application developer that is not a problem unless he needs the specific API. For someone wanting to make a clone of Windows that is a killer.
The part about the sources being needed is my own dark suspicion. But I again, I did think of somebody else tryong to offer a compatible API, not somebody just using what the documentation he has says is there.
As an example think of MS-Office using additional API functionality that is not documented in the public documentation. While that does not bother somebody like you, this is catastrophic for somebody creating a MS compatible execution environment.
You're looking at it from the wrong side (Score:3, Informative)
Umm.. I don't think the issue is so much with poor documentation where documentation exists, I think the issue is more with non-existing documentation.
If you are looking at the whole system from the point of documentation, of course everything looks great? That's like looking at the world though a great big filter.
Instead you will have to go the other way; check all DLL/EXEs for exports, and then see if those exports are documented. Some exports aren't even done by name, but only by ordinal [gazonk.org], making them even harder to use.
I'm not a win32 guy either, so I can't give any concrete examples off hand, but I'm pretty sure this is partly where the issues lie.
You really cannot say the APIs are highly documented unless you have disassembled the code to see what it can really do, can you? Sure, there might be a hundred documented functions, but that is only impressive if there are only a hundred exports, and those exports are limited to the paramaters defined by the documentation.
Behaviors aren't consistent, etc... (Score:3, Informative)
The API's declaration is consistent, but what one version of Windows DOES with the parameters may differ slightly or radically from another, supposedly identical one.
Re:They must be getting desperate... (Score:3, Informative)
They don't do that anymore because people have reverse engineered enough of Windows and the MS apps that run on it to demonstrate conclusively that you've been fed a big fat lie. You don't have a level playing field and you never did.
This is a multi-billion dollar fraud and in large part it's what made Microsoft the uber-monopoly it is today (this was the grounds that the DoJ should have used to go after MS). The fact that you don't know that you've been shafted years after BillG and SteveB have admitted this in interviews leaves me speechless.
Open source and security - some references (Score:4, Informative)
It's already been revealed that some attacker got into Microsoft's network. Also, CD's with Microsoft's source have been released for various reasons over time. I have no trouble believing that some "bad guys" already have the source code. So, how do the rest of us protect ourselves from these bad guys with the source code? And from the bad guys to come who don't have it yet... but will?
As noted in Secure Programming for Linux and Unix HOWTO [dwheeler.com], section 2.4.2 [dwheeler.com], closing off source code doesn't actually halt attacks anyway. Here's the quote:
Re:Open source and security - some references (Score:5, Funny)
Well, they may have a point though. Thier "hidden" APIs can be a big security risk, such as:
BecomeRootUserWithoutNeedingPassword()
Secretl
DecryptAllFiles
and, of course the one Outlook and Word uses:
MakeProgramsRun90PercentFasterButTurnOffAllSecu
An interesting point? (Score:3, Interesting)
So the obvious question arises, is Linux/BSD (and any other software that has source available) more exposed to "serious" attacks. By "serious" I mean being launched by somebody who knew enough to be able to look at the source and find security flaws, vs a script kiddie who takes a virus toolkit and modifies the virus name and subject line. Theoretcially, it should be more vunerable than a picece of closed source software that was written with a similar level of "quality".
Again, I AM NOT DEFENDING OR SUPPORTING M$'S POSITION, only bringing up what I think is an interesting question.
Forgot to Mention (Score:5, Funny)
- reverse gravity
- send the tightly-controlled, stable market into a state of chaos
- put thousands of people out of work (how could MS pay its employees if they gave their products away?)
- bring back Elvis (in the form of MP3s distributed by the masses who were previously restricted by MS DRM)
- cause the judge's personal computer to automatically download pornography every day
Didn't we see this in Ghostbusters?They may argue themselves back to a breakup? (Score:3, Interesting)
Microsoft source code is already available... (Score:5, Informative)
Austria already has it. [microsoft.com]
Any U.S. University can apply for it now if they don't already have it. [microsoft.com]
Many of Microsoft's larger customers have it [com.com]
I don't see why it would be difficult for any terrorist organization to get it. How can they legitimately argue that it may possible be keep it secret at this point? If it's a national security risk to make the code available, the damage can no longer be avoided.
Ryan Fenton
Best Quote from Story (Score:5, Insightful)
'When pressed for further details, Allchin said he did not want to offer specifics because Microsoft is trying to work on its reputation regarding security. "The fact that I even mentioned the Message Queuing thing bothers me," he said.'
I love that! 'It pains me to admit that our software is dangerously broken, because we're trying really, really hard to convince people that the reputation we have for foisting dangerously broken software on them is totally unfounded.'
I guess if there were trying to work on their actual security, rather than just the reputation, they might act a bit differently (like, by publishing their API's and then working with the security community to get them safe).
-Dan
Second Best Quote (Score:5, Funny)
Microsoft's already endangering the U.S. (Score:2)
Maybe it's time for another trial.
Ok, let's look at a trend here... (Score:2)
The first, was "it can only hurt the US economy if the debut of Windows 98 (was 98, wasn't it?) is delayed..."
And now, "releasing source code/API's would threaten nationally security".
Does anyone want to start taking bets what the next grand bullshit excuse will be? My wager is on "God commands thee to cleanse thy hard drive of this vile Linux". I just can't think of anything else that is on the level of the first two.
In other news (Score:5, Funny)
Just have to say it... (Score:5, Funny)
They can name it something like 'Patch Lola Patch.'
Re:Just have to say it... (Score:4, Funny)
Jules: Send me that service pack. It's the one named, 'Dumbass Motherfucker.'
Vincent: You know what the funniest thing about Microsoft is?
Jules: What ?
Vincent: Its the little differences. Its got a lotta the same shit as other operating systems, but with those guys it is a little different.
Jules: How so ?
Vincent: For example. Another company has a bug. They fix it in like two days, and then they annouce the bug and the fix.
Jules: Ok. And at Microsoft ?
Vincent: At Microsoft, when someone points out a security hole, the first thing they do is threaten a lawsuit against the guy who found the hole if he says anything.
Jules: You mean they threaten the guy who is helping them ?
Vincent: Yup - exactly what I mean. As long as there is not a big media splash, they never gotta fix nuthin.
Jules: So what happens if the guy opens his mouth.
Vincent: Generally he don't. But, some 15 year old kid in Asia finds the same bug, and then releases a worm, and it chews apart all the Microsoft systems worldwide in like two days.
Jules: No shit !
Vincent: Yeah, and then Microsoft tells everyone about the bug, and provides a patch, but no one fixes it.
Jules: No one !?
Vincent: Well, smart people do, but most people just miss the message. They gotta go to Microsoft, get the patch, and half the time the fix will break something else on their system.
Jules: So if this shit is so bad, why are so many people using it ?
Vincent: It used to be everything on personal computers were that bad. Then, Microsoft controlled the market. Everyone else started making good shit, but it didn't matter. Microsoft made people buy their new shit so they could continue to read their own old shit. Can you believe it ?
Jules: Man, that is some weird-ass shit. Like some idiot can't take a step back and see himself being played like that.
Vincent: Yeah, it's kinda sad. But it makes a great market for guys to run around spending all their time patching holes after they are exploited. If Microsoft made good shit, we wouldn't have jobs.
Jules: Good point.
Logical Contrapositive (Score:5, Funny)
If the software has security flaws, then the code and APIs cannot be made public.
Open source view:
If the code and APIs are made public, then the software does not have security flaws.
So, Microsoft, we are finally in agreement, yes?
One standard to rule them all (Score:4, Funny)
So, according to Microsoft, it is better to have one company provide (ie control) the degree of interoperability between systems than to have another company promote a single standard for the whole industry to use and share.
I can't imagine that line of thinking going over very well with military officials used to building redundancy into everything.
You might also paraphase the above statements as follows:
"Microsoft has choosen to ignore freely available and already established standards and instead has wasted substantial time and resources needlessly reinventing the wheel by developing our own internal standards (that we won't share and that we admit are not really very good) so that we can control the degree of interoperability between our proprietary new product, and our former (and soon to be former) competitor's technologies"
"Sun's strategy of creating and sharing a standard that encourages 100% interoperability between all systems discourages interoperability (but only in respect to our systems, because ours are made to be incompatible with the accepted standard that everyone else uses)."
Oh boy, can I please buy your systems for my Army?
"It made a difference for that one starfish." (Score:3, Insightful)
Given that MS is admitting in court that they are selling defective products, demand that your local government sue MS for fraud. Politicians don't keep up to date on every legal battle going on everywhere, but if you send them the relevant portions they at least can't claim they didn't know.
While you're at it, forward this onto the local newspaper and tv stations. "poor security" is a big boogyman these days.
Another thing; Send this onto the people at your company who make buying decisions, if MS is going to admit their products have the security of swiss cheese, does your company really want to expose itself to that kind of danger?
Security (Score:4, Funny)
Your honor, it is a matter or national security, no international security, no galactic security, that we be allowed to continue our profitable monopoly.
Think she'll buy it?
=brian
Proof that Microsoft needs to go... (Score:3, Insightful)
Let's say that this message queueing vulnerability that was spoken of in the article is a pretty substantial hole that could be a true threat to national security. What makes anybody think that because Microsoft refuses to talk about it hasn't already slipped out to all the wrong people. If some high level executive at Microsoft knows about it, you can guarantee that probably hundreds if not thousands of people within the orgnization know about the problem already. The more people that know about it, the better the odds that somebody nefarious will get a hold of that information.
If I were the intelligence service of some devious foreign power you can bet I'd have a few operatives working in Microsoft. I mean if you want to fight a war with the US, what would be better than an opening shot that can harm >90% of the computers in the country. So you have a few operatives finding what holes they can and slowly relay them back. Then you just sit and wait for the day when you need a real threat in your arsenal.
Imagine how nice it would be if you are some nefarious foreign power in tense negotiations with the US and you can walk in, and them a floppy disk and tell them to give in or else. I mean even if they find out what the vulnerability is, can they deploy a response to it fast enough that it matters? Nothing like the threat of having the electronic economy slagged to make you amicable to a bad deal.
I think that if Microsoft's the threat they seem to imply, the judge should order them to turn over the source code to the FBI to begin dissecting these problems. Do we really want to trust a private corporation with our national security? I don't think so...
The way I see it, It's like choosing a woman. (Score:4, Funny)
Seems to me (Score:4, Insightful)
You just don't get to Allchin's level and "accidentally" let slip something like a fundamental vulnerability in a protocol. M$ officials may make mistakes, but not like this. Not in a public forum. Not in front of a judge. Not where every news medium in the world will be covering the story.
My feeling is that this is all a distraction from something else. Every black hat on the planet is now probably checking out the Messaging protocol. My guess is that there's no smoking gun there. But maybe another protocol has problems.
Furthermore, it just doesn't make sense. An API exposes only what you want it to. It doesn't show you the vulnerabilities that exist "under the covers" unless they're titanically, apocalyptically stupid.
I'd like to know what it was that he's distracting us from
Re:Seems to me (Score:3, Insightful)
Maybe he made this statement knowing every black hat is going to check the Messaging protocol.
Two days later, a major exploit is released, and Allchin says to the judge "see what I mean, THIS is exactly why we must keep it all closed"
It could be a bullshit ploy.
Windows is the cyberspace Corvair... (Score:3, Funny)
Staggering (Score:4, Interesting)
"Uhh, sorry Mr. President, the NSA can no longer monitor international communications. Our systems are just too vunerable to hacking to be used. Jim Allchin assured us that a comprehensive fix would be available within 18 months."
"In other news, the US Navy has ordered all AGEIS cruisers into port indefinatley. The AGEIS computer systems were deemed too risky for combat use. The Pentagon would not comment on reports the entire US fleet would require software overhauls before any offensive combat operations could be contemplated."
"World stock markets are today in freefall as most major international corporations raced to secure information systems based on Microsoft's Windows operating system. Some experts estimate that the expense of fixing or replacing mission critical software to provide an adequate level of security would dampen the World economy for a decade."
This goes so far beyond a computer industry issue. Its a staggering admission of guilt. What CIO would be caught dead installing an MS system unless they have absolutly no alternative?
There is also the legal issue. If someone has sustained an economic loss due to "flawed code", that they are using because MS illegally supressed competitive alternatives, then they have a really good case for compensation. And the hardest part, proving that MS illegally manipulated the market, is already done. And they have some tens of billions just sitting around, waiting for the right lawyer to just take away.
Microsoft _can't_ fix it? (Score:5, Insightful)
Somehow, I think that if the US government forbade the use of any Microsoft applications within federal facilities, pending a code review by a neutral 3rd party to identify and fix potential security holes, you'd see Microsoft scramble to get their shyte in gear pretty damn quickly.
As somebody already stated in this thread, Peru has the right idea: open source allows people to public review code for potential security flaws, which is how most bugs are caught anyway -- a fresh pair of eyes takes a peek. Ultimately, there's no way that Microsoft can compete with this code development paradigm -- since there's so much Open Source code "out there", it might spread people's attention out a bit too thinly in places, but over time one would hope that Linux apps will only more secure / stable.
Their spokesman went on to say... (Score:3, Funny)
Oh wait...
They don't know what they're getting into here (Score:5, Insightful)
I work for a defense contractor and have had to put up with this for years. I suppose MS can go this route if they really want to. They're already bloated enough; add government security procedures to the mix and they'll become every bit as agile and responsive as any other constituent of the Military-Industrial Complex.
Boy, that'd be a hoot.
I need a million bucks ... (Score:3, Funny)
25 die when "authentication" code locks out Airman (Score:3)
They will not allow anyone, classified or unclassified in the DOD to run XP.
They do not plan to either.
Believe me, its already making it "fun" to try to buy new PCs... i can't wait until 2004, when MS drops 2000 as a client OS, and then the bind we'll be in then, huh?
A weapon system that locks up because it doesn't have the right authentication key. How cool would that be!
fsck Microsoft. and Fsck the Air Force (where i work) - they are the stupid PHBs that didn't even concider anything else, didn 't look to anything else, and were too sheepish to try to find another solution that woudn't get us stuck in this way.
what boneheads. I'm working on a project that is in jeopardy because the system will only run on Windows NT 4.0, and we're having a hell of a time finding sources for NT 4.0 that are legal.
Pretty soon, we're going to just go illegal because we'll have no recourse.
we're so stupid...
Kerckhoffs' Principle (Score:3, Informative)
To quote Schneier: "Any system that tries to keep its algorithms secret for security reasons is quickly dismissed by the [cryptographic] community, and referred to as "snake oil" or even worse."
http://www.counterpane.com/crypto-gram.html
Re:Don't pick on me! My software sucks! (Score:4, Funny)
Well, at least I hope it doesn't. A comment like this from a Microsoft bigwig doesn't sound encouraging... Mid-air GPF anyone? *ouch*
Whose Your God Daddy? (Score:4, Interesting)
Actually, this is entirely consistent with MS's strategy all along: it has been arguing that it and its products are so profoundly important to the American economy and security that any remedy which interferes with its ability to act as it pleases should be struck down by the court. Otherwise, everyone will suffer at least as much as MS will.
It's the exact equivalent of a mob boss saying that he shouldn't be imprisoned for running a protection racket, because then he wouldn't be able to protect his customers. Moreover, he wouldn't be able to provide for his innocent wife and children (even though it's been shown he abuses them as well).
Microsoft isn't at all desperate; they're just so arrogant, and so blind to basic security principles, that they don't really see a problem with what they're saying.
Re:not so evil? (Score:2)
> This explains why innocuous commands (like touch and finger) have easy-to-remember and provocative names, while the more dangerous ones (like ld and vi) are "secure" through their "obscure" names
And pray tell... how exactly is vi(1) dangerous? I'd call emacs a bigger violation though, but hey, I'm biased. Heck, every editor on a UNIX system should have a "secure" name then. That logic doesn't really fly.
Runs off, before it turns in yet another editor flamefest (which is not what I am intending).
Re:Ridiculous argument! (Score:2, Insightful)
I think the judge will see through this ploy.
Re:Ridiculous argument! (Score:3, Funny)
Re: (Score:3, Insightful)
Re:ahah (Score:3, Insightful)
Unfortunately for Microsoft, the emphasis is on getting to market first (when you can't crush them otherwise with FUD or other methods). This accellerates the coding process and puts demands on quality, leading to shortcuts and an emphasis on new features over bug fixes.
It's all finally coming to roost at Microsoft. You can't put out crap all the time. More and more people I talk to are getting frustrated. Ask anyone who understands the software environment , the only reason anyone uses Microsoft is because of the availability of apps, not because it's stable or of high quality.
This is what's letting Linux and OSX in the door.
Re:Microsoft products = crap admitted in court (Score:3, Interesting)
Ho hum, might just turn interesting...