17 ms·

Microsoft, Once Infested with Security Flaws, Does an About-Face

158 points by hackuser 11y ago

mtgx 11y ago
Too bad it's doing the opposite on the privacy front, trying to collect more data than ever about Windows users, by default.
- ConceptJunkie 11y ago
  Not to mention the usability front. Windows is ugly and confusing. It didn't used to be so ugly and was less confusing in the past.
  - theklub 11y ago
    I think windows 10 is quite nice. Windows 8 is a POS.
    - digi_owl 11y ago
      Once i had my most used stuff either pinned or as a desktop shortcut, 8.1 was no biggie.
    - headmelted 11y ago
      Windows 8 was great if you went straight to the desktop and never looked back. There were some terrific upgrades to the classic desktop (even the task manager got real-time graphs and proper hierarchies for the first time). I always pictured a really talented dev team somewhere in Redmond plugging away thanklessly on things that the powers that be thought no-one cared about (like security and usability) until one day someone decreed from on high that the whole frontend would need to "beat the iPad", and it all turned to poop. This is speculation of course, but drawn on multiple similar experiences.
      - wdmeldon 11y ago
        Very true. But every time I pressed the Windows key to open an application, I was reminded of the horrors that lurked outside of the desktop.
        Sanddancer 11y ago
        Aye, but it got me really good at just typing the program name I wanted, instead of having to go poking through that pain in the ass menu.
    - gdulli 11y ago
      For $3 you could get StartIsBack and you would never know the Start menu had changed since Windows 7, or the nature of the desktop vs. the tiles screen. That made Windows 8 work just fine for me.
      - wvenable 11y ago
        For free, you can use ClassicShell. I actually forget I'm on Windows 8.1 at home vs Windows 7 at work as they're almost identical.
        ufmace 11y ago
        Or update to 10 for free too?
- ConceptJunkie 11y ago
  Not to mention the usability front. Windows is ugly and confusing. It didn't used to be so ugly and was less confusing in the past.
- scholia 11y ago
  Set telemetry to Basic, in which case it doesn't collect any data about Windows users. This whole debate has gone overboard through an inability to recognize the difference between telemtry and "spying". For example, between counting cars (important for city planning) and numberplate recognition.
- vox_mollis 11y ago
  This is the salient point. What good is platform security when the platform is keylogging and shipping telemetry to a third party not in your control?
  - caskance 11y ago
    Which third party is this?
briffle 11y ago
Not sure 10 years is an about face?
- pluckytree 11y ago
  Plus they are talking about caring about security and putting plans in place. Are they claiming they never cared and never had plans to make the situation better? This is just like reporting on government where they report an idea a President mentions as "President dramatically reverses his entire 20 year belief system" Cynically (and probably accurately), it’s a clever way to disguise a user feature (security) as a way to gather data so as to "protect" them. Sound familar?
- adrianN 11y ago
  When you have a code base as massive as Microsoft's, it is.
- AnimalMuppet 11y ago
  The "about face" was when they decided that security really mattered (as opposed to the previous month, when shipping features really mattered, and security was an afterthought).
- biot 11y ago
  It takes Saturn 15 years to do an "about face" so that it's on the opposite side of the Sun. Perhaps Microsoft's code base, when printed out, is as massive as a planet.
- collinmanderson 11y ago
  Right. They started being serious about security in 2003, it just took another 10-12 years for most people to get off of 2001's XP to actually start seeing the benefits. :)
tptacek 11y ago
This is a weird story, since professional security people would have told you the same thing back in 2007. Windows wasn't originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that's true of the Unices of the time as well, none of them had Microsoft's absurd user base, and so none of them had the same terrible malware incentives. This all came to a head around 2001-2003, when the Internet worm phenomenon got so bad that Microsoft was routinely on the front page of CNN, and serious talk of congressional action began. From what I understand, there was a dramatic top-down response, led by Gates and Ballmer, requiring software security training for developers, giving product managers the power to slip release dates to ensure bugs were caught, and funding what I believe is probably the largest 3rd-party software pentesting program in the industry. Several well-known software security firms (my old firm, Matasano, not really among them) were basically bootstrapped out of Microsoft contracts. Today, Google probably does a better job on software security than Microsoft does, but it's hard to come up with another rival. Tellingly, Google's security efforts were also a top-down reaction to a major security incident.
- JamesBarney 11y ago
  I'm just curious but why do you think Google is better at security than Microsoft? Number of exploits on Android vs Windows? Amount of funding on security research?
  - Someone1234 11y ago
    I actually agree with you (that Microsoft's internal processes are more security orientated than Google's version of the same). That being said: A lot of Android's security issues are not always Google's fault. Some of them are in generic Linux libraries, some of them are in OEM added components (Samsung), and some of them are security issues unique to an app ecosystem (i.e. on Windows Win32 user applications normally have full permissions as that user, on Android an APK running as a user has a limited set of permissions, if it exceeds those permissions this is now an "exploit" which is now an additional set of security issues), and many are simply malware being placed on an app store. Android's biggest issue isn't really that it is poorly designed (in particular with SELinux as standard). Android's biggest issue is how horribly the OS update mechanism works, so relatively minor security issues may not be fixed for years.
headmelted 11y ago
"Still, episodes of online hacking have become even more startling, including the theft of personal data from millions of Target customers and terabytes of private emails from Sony Pictures Entertainment (and both companies use some Microsoft products)." So somewhere in Sony and Target's organisations there are one or more Windows computers? This is just lazy reporting NYT. Do better.
- mcintyre1994 11y ago
  Agreed - I bet they use Google search every day and their execs have iPhones too.
  - tim333 11y ago
    Of mild interest, in the Sony hack: "The hack, which was launched Nov. 24, only affected computers with Microsoft Corp's (MSFT.O) Windows software, so Sony employees using Apple Inc (AAPL.O) Macs, including many in the marketing department, had not been affected." IMHO Microsoft still have a fairly ho hum attitude. If you want to hack a company like Sony the easiest way is to target employees still using old systems like XP and they could have mopped a lot of that up by offering free upgrades to 10 when they offered them to users of 7 and 8 but nah.
    - jerf 11y ago
      By the time of the Sony hack, any machine still using XP is a machine that would be using XP even if Microsoft did exactly what you suggest. There's been no lack of opportunities to upgrade and the cost of a Windows license is generally trivial next to the labor expense, training expense, and monetized risk of "my critical software doesn't work" of the upgrade of these systems.
loginusername 11y ago
"Microsoft was once the epitome of evrything that is wrong with security in technology." Certainly they have improved over the last decade, but who hasn't? Not to mention they have boatloads of cash to throw at the problem. But the fact^W opinion remains Windows is still the easiest target of any OS. A user can configure any OS to be less secure, and other OS can become as popular a target as Windows but there's something about Windows that makes it a far greater liability than all the rest. It's closed source. How are you ever going to assess the quality of this software in terms of security? By reading the New York Times? Boatloads of cash also buys PR.
- smackfu 11y ago
  >But the fact remains Windows is still the easiest target of any OS. How is that a fact?
- raesene4 11y ago
  That's an interesting opinion... what makes you think it's the easiest OS to target? Do you have any data to back up the claim that a modern Windows OS is less secure than it's major competitors (OSX and, in some circumstances, Linux) My feeling would be that Microsoft have done a lot in the security line and have also given a lot back to the security community (their SDL documentation which is freely avaiable for example) and that they are one of the better examples of security in the software industry these days
  - loginusername 11y ago
    The "security line" is not simply a question of "doing a lot" and "giving a lot back", ex post facto, or setting an "example" in the "security industry". It also has to do with design goals and priorities. Layer upon layer of cruft, with an OS weighing in at multiple GB, is not a confidence builder in the "security line". It also includes default configurations. There are reasons that so many Windows instances have been and are now part of botnets. There are reasons why the security updates have increased in quantity and frequency over the years and appear to be neverending. Some of those reasons have to do with design and priorities. Others with default configurations that Redmond assumes no user will ever change. No amount of PR can change reality (e.g., massive botnets of Windows users), although it might change people's perception of reality. Also, I never said "major competitors". I said "other OS". For example, the OS I use is probably not a "major competitor". It is much smaller and open source. That is what is important to me.
loginusername 11y ago
Would anyone agree that complexity provides a foundation for insecurity while simplicity makes audits easier? Large software with many parts have more potential for flaws. Small software with few parts have less potential for flaws because they are easier to find and fix. Implausible? Well, I happen to believe this. If Microsoft ever released the Windows source code, what would we find? Simplicity? How easy would it be to audit? Bias disclosure: I like small software. Windows and most all other software released by Microsoft is large, or packaged in such a way as to necessitate a large download/install.
- wvenable 11y ago
  All software is large. If you break it into smaller pieces, it's still large. If you look into how iOS devices are jailbroken, it's usually combination of bugs from different pieces of smaller software that makes it possible.
- scholia 11y ago
  > If Microsoft ever released the Windows source code, what would we find? Simplicity? Windows source code has been available for a long time under the Shared Source initiative. Some governments (including Russia), large companies, universities, partners and maybe even MVPs have had access to some versions. Email source@microsoft.com https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/
- kabdib 11y ago
  > If Microsoft ever released the Windows source code, what would we find? Simplicity? Depends on where you look. Much of the NT kernel is "simple", but it's not easy stuff to get right. There's a bunch of legacy code in the Win32 layers, especially dealing with user input, that is just frightening (comments like "This stupid hack makes the utterly broken Compaq XYZ-3000 keyboard not crash the system"). The COM stuff is just complex and arcane and top-heavy with architecture astronautics. The build system is, or was, a soul-destroying, radioactive and rotting cesspool of Perl; doing Windows builds sucked real hard. So it's a mix of really quite good code, and really quite awful code (that they're dealing with, I think), and code that makes you want to quit, every day. (Soapbox: You should never have code in your project that you are scared of touching. Never. If you do, get rid of it and replace it. Don't layer over it, don't give it to some intern to maintain, just face the problem and deal with it, or it will be the most costly code in your product).
loginusername 11y ago
"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem, in my opinion.
- mejari 11y ago
  Saying it is false and calling views "distorted" does nothing to further the conversation. If you're interested in furthering conversation on the subject try providing reasoning behind your statements instead of condescension.
  - loginusername 11y ago
    Perhaps you could explain how the statement "All software is large" "furthers the conversation"? How am I supposed to respond to that? You think that false statement is a respectable "response" to a comment on the benefits of small software? Small software exists both in the past (when memory and storage were more limited) and in the present. The very idea of small programs is a foundational one in the field of computing. "All software is large" is not a "view" that is in agreement with reality. As such, it is distorted. I am using small software every day. In fact I am writing this comment with a small program. When I write software, it is small, at least relative to anything from Microsoft. I am too dumb to write large software.
    - wvenable 11y ago
      > In fact I am writing this comment with a small program. Which small program is that?
      - loginusername 11y ago
        Are you saying you are unaware of any program that can post text to a web server that is "small"? If all you are aware of is large software, then your statement that "All software is large" makes more sense. "All software is not as large as Microsoft's software." Would you agree with that?
Artemis2 11y ago
I wouldn't say that they are "the best in class". I have recently (~3 months ago) reported a pretty important security flaw in outlook.com (including its Office 365 version). They have only found the issue a week ago or so (and it isn't fixed yet!). I like Microsoft, but their awful responsiveness doesn't make me want to use their products, or to work again for them.
renownedmedia 11y ago
> company’s co-founder, Bill Gates, once ordered all of Microsoft engineers to stop writing new code for a month Source?
- grub5000 11y ago
  Man this is a well known and often commented fact, but god damn am I having trouble searching for sources and references on this one. Can anyone help out?
- deleted 11y ago
  [deleted]
- Garbage 11y ago
  This is the closest reference I could find. http://www.cnet.com/news/gates-security-is-top-priority/ http://www.cnet.com/news/gates-security-is-top-priority/ I don't have Microsoft source though.
- mikestew 11y ago
  Valentine actually dictated it, but it did actually happen. Brian's mail was something along the lines of, "I'm tired of reading about the latest security vulnerability in the NYT, so...". And I think it was six weeks, not a month. Source: me, who worked there (in VS, not Windows) at the time. EDIT: oh, yeah, forgot about the Gates mail. References are buried in this link: http://www.microsoft.com/security/sdl/story/#chapter-1 http://www.microsoft.com/security/sdl/story/#chapter-1 I stand by the B. Valentine version, just can't find a link.
Animats 11y ago
Microsoft, after much R&D work, deployed two technologies in Windows 7 that improved the security situation considerably. The first was the Static Driver Verifier.[1] That's the formal proof-of-correctness system that checks the source code for a driver for termination, bad pointers, incorrect API calls, and anything that could result in a kernel crash. It's a symbolic path tracer - it symbolically executes all paths through the code. All drivers must pass that verifier. Before this was deployed, about half of Windows crashes were due to drivers. Now, very few are. The other technology was a classifier for panic dumps. When Windows crashes and reports data to Microsoft, that data goes into a classifier system which tries to cluster similar crashes together. So, when there's a crash bug, the reports of similar crashes are all looked at by the same person at the same time, which tends to get it fixed. Linux lacks either technology, which is a problem. [1] https://msdn.microsoft.com/en-us/library/windows/hardware/ff552808%28v=vs.85%29.aspx https://msdn.microsoft.com/en-us/library/windows/hardware/ff...
clamprecht 11y ago
So Microsoft hired a PR firm.
wsxcde 11y ago
At least part of the secret is formal verification. MSR throughout the last decade made some big advances in software verification technology. These resulted in more than just academic papers, they were used to find tons of real bugs in MS and external (as part of the driver development kit) source code. There was a point at which all of the biggest names in software verification were either academics or at MSR or at both. SLAM, Z3, DART were all tools that came out of MSR and have been incredibly influential on the whole field of software verification.
mikestew 11y ago
Though many comments here speak of engineering flaws, but to me it was a cultural flaw. The most outstanding anecdote I have to illustrate this is when I told my manager that "I can't <note that I say "can't", not "won't"> run that internal test tool (the insect farm thing, for those that were in DevDiv around 2003-ish) that runs 24/7 with complete network access because it requires <but did not need> admin privileges." That nearly got me fired. You read that right: when I point out that a sloppily written application that someone wanted the entire developer division to run was insecure, my manager basically told me to run it or else. If the dev can't even be bothered to not write to PROGRAM_FILES (which is the only reason it needed admin privileges), what other holes does it have? Well, I'm not about to find out on my dev box that's hooked to the corpnet. Running on an internal-only alpha version of the early .NET runtime to boot; what could possibly go wrong? (And as it turned out, nothing went wrong, but still...) And this was after Valentine's mail was sent. SQL Slammer had already happened. What, you thought the whole company just jumped on the security bandwagon? Yeah, I thought a new day had dawned, too. You can make 'em quit blindly using strcpy, but you won't change their minds with an email even after Valentine asks the whole company to come in and take Slammer support calls.
ZenoArrow 11y ago
"Microsoft’s latest version of its operating system, Windows 10, has a feature called Windows Hello that allows people to log in to a PC with a scan of their finger, iris or face instead of using a password — weak versions of which are a common cause of data breaches." Is that more secure in practice? http://hackaday.com/2015/11/10/your-unhashable-fingerprints-secure-nothing/ http://hackaday.com/2015/11/10/your-unhashable-fingerprints-...

158 points by hackuser 11y ago

mtgx 11y ago

Too bad it's doing the opposite on the privacy front, trying to collect more data than ever about Windows users, by default.

ConceptJunkie 11y ago
Not to mention the usability front. Windows is ugly and confusing. It didn't used to be so ugly and was less confusing in the past.
- theklub 11y ago
  I think windows 10 is quite nice. Windows 8 is a POS.
  - digi_owl 11y ago
    Once i had my most used stuff either pinned or as a desktop shortcut, 8.1 was no biggie.
  - headmelted 11y ago
    Windows 8 was great if you went straight to the desktop and never looked back. There were some terrific upgrades to the classic desktop (even the task manager got real-time graphs and proper hierarchies for the first time). I always pictured a really talented dev team somewhere in Redmond plugging away thanklessly on things that the powers that be thought no-one cared about (like security and usability) until one day someone decreed from on high that the whole frontend would need to "beat the iPad", and it all turned to poop. This is speculation of course, but drawn on multiple similar experiences.
    - wdmeldon 11y ago
      Very true. But every time I pressed the Windows key to open an application, I was reminded of the horrors that lurked outside of the desktop.
      - Sanddancer 11y ago
        Aye, but it got me really good at just typing the program name I wanted, instead of having to go poking through that pain in the ass menu.
  - gdulli 11y ago
    For $3 you could get StartIsBack and you would never know the Start menu had changed since Windows 7, or the nature of the desktop vs. the tiles screen. That made Windows 8 work just fine for me.
    - wvenable 11y ago
      For free, you can use ClassicShell. I actually forget I'm on Windows 8.1 at home vs Windows 7 at work as they're almost identical.
      - ufmace 11y ago
        Or update to 10 for free too?
ConceptJunkie 11y ago
Not to mention the usability front. Windows is ugly and confusing. It didn't used to be so ugly and was less confusing in the past.
scholia 11y ago
Set telemetry to Basic, in which case it doesn't collect any data about Windows users. This whole debate has gone overboard through an inability to recognize the difference between telemtry and "spying". For example, between counting cars (important for city planning) and numberplate recognition.
vox_mollis 11y ago
This is the salient point. What good is platform security when the platform is keylogging and shipping telemetry to a third party not in your control?
- caskance 11y ago
  Which third party is this?

briffle 11y ago

Not sure 10 years is an about face?

pluckytree 11y ago
Plus they are talking about caring about security and putting plans in place. Are they claiming they never cared and never had plans to make the situation better? This is just like reporting on government where they report an idea a President mentions as "President dramatically reverses his entire 20 year belief system" Cynically (and probably accurately), it’s a clever way to disguise a user feature (security) as a way to gather data so as to "protect" them. Sound familar?
adrianN 11y ago
When you have a code base as massive as Microsoft's, it is.
AnimalMuppet 11y ago
The "about face" was when they decided that security really mattered (as opposed to the previous month, when shipping features really mattered, and security was an afterthought).
biot 11y ago
It takes Saturn 15 years to do an "about face" so that it's on the opposite side of the Sun. Perhaps Microsoft's code base, when printed out, is as massive as a planet.
collinmanderson 11y ago
Right. They started being serious about security in 2003, it just took another 10-12 years for most people to get off of 2001's XP to actually start seeing the benefits. :)

tptacek 11y ago

This is a weird story, since professional security people would have told you the same thing back in 2007. Windows wasn't originally designed to be secure. Even NT, which is a serious multi-user kernel, was a product of 1990s C programming style. And while that's true of the Unices of the time as well, none of them had Microsoft's absurd user base, and so none of them had the same terrible malware incentives. This all came to a head around 2001-2003, when the Internet worm phenomenon got so bad that Microsoft was routinely on the front page of CNN, and serious talk of congressional action began. From what I understand, there was a dramatic top-down response, led by Gates and Ballmer, requiring software security training for developers, giving product managers the power to slip release dates to ensure bugs were caught, and funding what I believe is probably the largest 3rd-party software pentesting program in the industry. Several well-known software security firms (my old firm, Matasano, not really among them) were basically bootstrapped out of Microsoft contracts. Today, Google probably does a better job on software security than Microsoft does, but it's hard to come up with another rival. Tellingly, Google's security efforts were also a top-down reaction to a major security incident.

JamesBarney 11y ago
I'm just curious but why do you think Google is better at security than Microsoft? Number of exploits on Android vs Windows? Amount of funding on security research?
- Someone1234 11y ago
  I actually agree with you (that Microsoft's internal processes are more security orientated than Google's version of the same). That being said: A lot of Android's security issues are not always Google's fault. Some of them are in generic Linux libraries, some of them are in OEM added components (Samsung), and some of them are security issues unique to an app ecosystem (i.e. on Windows Win32 user applications normally have full permissions as that user, on Android an APK running as a user has a limited set of permissions, if it exceeds those permissions this is now an "exploit" which is now an additional set of security issues), and many are simply malware being placed on an app store. Android's biggest issue isn't really that it is poorly designed (in particular with SELinux as standard). Android's biggest issue is how horribly the OS update mechanism works, so relatively minor security issues may not be fixed for years.

headmelted 11y ago

"Still, episodes of online hacking have become even more startling, including the theft of personal data from millions of Target customers and terabytes of private emails from Sony Pictures Entertainment (and both companies use some Microsoft products)." So somewhere in Sony and Target's organisations there are one or more Windows computers? This is just lazy reporting NYT. Do better.

mcintyre1994 11y ago
Agreed - I bet they use Google search every day and their execs have iPhones too.
- tim333 11y ago
  Of mild interest, in the Sony hack: "The hack, which was launched Nov. 24, only affected computers with Microsoft Corp's (MSFT.O) Windows software, so Sony employees using Apple Inc (AAPL.O) Macs, including many in the marketing department, had not been affected." IMHO Microsoft still have a fairly ho hum attitude. If you want to hack a company like Sony the easiest way is to target employees still using old systems like XP and they could have mopped a lot of that up by offering free upgrades to 10 when they offered them to users of 7 and 8 but nah.
  - jerf 11y ago
    By the time of the Sony hack, any machine still using XP is a machine that would be using XP even if Microsoft did exactly what you suggest. There's been no lack of opportunities to upgrade and the cost of a Windows license is generally trivial next to the labor expense, training expense, and monetized risk of "my critical software doesn't work" of the upgrade of these systems.

loginusername 11y ago

"Microsoft was once the epitome of evrything that is wrong with security in technology." Certainly they have improved over the last decade, but who hasn't? Not to mention they have boatloads of cash to throw at the problem. But the fact^W opinion remains Windows is still the easiest target of any OS. A user can configure any OS to be less secure, and other OS can become as popular a target as Windows but there's something about Windows that makes it a far greater liability than all the rest. It's closed source. How are you ever going to assess the quality of this software in terms of security? By reading the New York Times? Boatloads of cash also buys PR.

smackfu 11y ago
>But the fact remains Windows is still the easiest target of any OS. How is that a fact?
raesene4 11y ago
That's an interesting opinion... what makes you think it's the easiest OS to target? Do you have any data to back up the claim that a modern Windows OS is less secure than it's major competitors (OSX and, in some circumstances, Linux) My feeling would be that Microsoft have done a lot in the security line and have also given a lot back to the security community (their SDL documentation which is freely avaiable for example) and that they are one of the better examples of security in the software industry these days
- loginusername 11y ago
  The "security line" is not simply a question of "doing a lot" and "giving a lot back", ex post facto, or setting an "example" in the "security industry". It also has to do with design goals and priorities. Layer upon layer of cruft, with an OS weighing in at multiple GB, is not a confidence builder in the "security line". It also includes default configurations. There are reasons that so many Windows instances have been and are now part of botnets. There are reasons why the security updates have increased in quantity and frequency over the years and appear to be neverending. Some of those reasons have to do with design and priorities. Others with default configurations that Redmond assumes no user will ever change. No amount of PR can change reality (e.g., massive botnets of Windows users), although it might change people's perception of reality. Also, I never said "major competitors". I said "other OS". For example, the OS I use is probably not a "major competitor". It is much smaller and open source. That is what is important to me.

loginusername 11y ago

Would anyone agree that complexity provides a foundation for insecurity while simplicity makes audits easier? Large software with many parts have more potential for flaws. Small software with few parts have less potential for flaws because they are easier to find and fix. Implausible? Well, I happen to believe this. If Microsoft ever released the Windows source code, what would we find? Simplicity? How easy would it be to audit? Bias disclosure: I like small software. Windows and most all other software released by Microsoft is large, or packaged in such a way as to necessitate a large download/install.

wvenable 11y ago
All software is large. If you break it into smaller pieces, it's still large. If you look into how iOS devices are jailbroken, it's usually combination of bugs from different pieces of smaller software that makes it possible.
scholia 11y ago
> If Microsoft ever released the Windows source code, what would we find? Simplicity? Windows source code has been available for a long time under the Shared Source initiative. Some governments (including Russia), large companies, universities, partners and maybe even MVPs have had access to some versions. Email source@microsoft.com https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/
kabdib 11y ago
> If Microsoft ever released the Windows source code, what would we find? Simplicity? Depends on where you look. Much of the NT kernel is "simple", but it's not easy stuff to get right. There's a bunch of legacy code in the Win32 layers, especially dealing with user input, that is just frightening (comments like "This stupid hack makes the utterly broken Compaq XYZ-3000 keyboard not crash the system"). The COM stuff is just complex and arcane and top-heavy with architecture astronautics. The build system is, or was, a soul-destroying, radioactive and rotting cesspool of Perl; doing Windows builds sucked real hard. So it's a mix of really quite good code, and really quite awful code (that they're dealing with, I think), and code that makes you want to quit, every day. (Soapbox: You should never have code in your project that you are scared of touching. Never. If you do, get rid of it and replace it. Don't layer over it, don't give it to some intern to maintain, just face the problem and deal with it, or it will be the most costly code in your product).

loginusername 11y ago

"All software is large." FALSE. But this statement does not surprise me. It is this distorted view of programs that is a large part of the "security" problem, in my opinion.

mejari 11y ago
Saying it is false and calling views "distorted" does nothing to further the conversation. If you're interested in furthering conversation on the subject try providing reasoning behind your statements instead of condescension.
- loginusername 11y ago
  Perhaps you could explain how the statement "All software is large" "furthers the conversation"? How am I supposed to respond to that? You think that false statement is a respectable "response" to a comment on the benefits of small software? Small software exists both in the past (when memory and storage were more limited) and in the present. The very idea of small programs is a foundational one in the field of computing. "All software is large" is not a "view" that is in agreement with reality. As such, it is distorted. I am using small software every day. In fact I am writing this comment with a small program. When I write software, it is small, at least relative to anything from Microsoft. I am too dumb to write large software.
  - wvenable 11y ago
    > In fact I am writing this comment with a small program. Which small program is that?
    - loginusername 11y ago
      Are you saying you are unaware of any program that can post text to a web server that is "small"? If all you are aware of is large software, then your statement that "All software is large" makes more sense. "All software is not as large as Microsoft's software." Would you agree with that?

Artemis2 11y ago

I wouldn't say that they are "the best in class". I have recently (~3 months ago) reported a pretty important security flaw in outlook.com (including its Office 365 version). They have only found the issue a week ago or so (and it isn't fixed yet!). I like Microsoft, but their awful responsiveness doesn't make me want to use their products, or to work again for them.

renownedmedia 11y ago

> company’s co-founder, Bill Gates, once ordered all of Microsoft engineers to stop writing new code for a month Source?

grub5000 11y ago
Man this is a well known and often commented fact, but god damn am I having trouble searching for sources and references on this one. Can anyone help out?
deleted 11y ago
[deleted]
Garbage 11y ago
This is the closest reference I could find. http://www.cnet.com/news/gates-security-is-top-priority/ http://www.cnet.com/news/gates-security-is-top-priority/ I don't have Microsoft source though.
mikestew 11y ago
Valentine actually dictated it, but it did actually happen. Brian's mail was something along the lines of, "I'm tired of reading about the latest security vulnerability in the NYT, so...". And I think it was six weeks, not a month. Source: me, who worked there (in VS, not Windows) at the time. EDIT: oh, yeah, forgot about the Gates mail. References are buried in this link: http://www.microsoft.com/security/sdl/story/#chapter-1 http://www.microsoft.com/security/sdl/story/#chapter-1 I stand by the B. Valentine version, just can't find a link.

Animats 11y ago

Microsoft, after much R&D work, deployed two technologies in Windows 7 that improved the security situation considerably. The first was the Static Driver Verifier.[1] That's the formal proof-of-correctness system that checks the source code for a driver for termination, bad pointers, incorrect API calls, and anything that could result in a kernel crash. It's a symbolic path tracer - it symbolically executes all paths through the code. All drivers must pass that verifier. Before this was deployed, about half of Windows crashes were due to drivers. Now, very few are. The other technology was a classifier for panic dumps. When Windows crashes and reports data to Microsoft, that data goes into a classifier system which tries to cluster similar crashes together. So, when there's a crash bug, the reports of similar crashes are all looked at by the same person at the same time, which tends to get it fixed. Linux lacks either technology, which is a problem. [1] https://msdn.microsoft.com/en-us/library/windows/hardware/ff552808%28v=vs.85%29.aspx https://msdn.microsoft.com/en-us/library/windows/hardware/ff...

clamprecht 11y ago

So Microsoft hired a PR firm.

wsxcde 11y ago

At least part of the secret is formal verification. MSR throughout the last decade made some big advances in software verification technology. These resulted in more than just academic papers, they were used to find tons of real bugs in MS and external (as part of the driver development kit) source code. There was a point at which all of the biggest names in software verification were either academics or at MSR or at both. SLAM, Z3, DART were all tools that came out of MSR and have been incredibly influential on the whole field of software verification.

mikestew 11y ago

Though many comments here speak of engineering flaws, but to me it was a cultural flaw. The most outstanding anecdote I have to illustrate this is when I told my manager that "I can't <note that I say "can't", not "won't"> run that internal test tool (the insect farm thing, for those that were in DevDiv around 2003-ish) that runs 24/7 with complete network access because it requires <but did not need> admin privileges." That nearly got me fired. You read that right: when I point out that a sloppily written application that someone wanted the entire developer division to run was insecure, my manager basically told me to run it or else. If the dev can't even be bothered to not write to PROGRAM_FILES (which is the only reason it needed admin privileges), what other holes does it have? Well, I'm not about to find out on my dev box that's hooked to the corpnet. Running on an internal-only alpha version of the early .NET runtime to boot; what could possibly go wrong? (And as it turned out, nothing went wrong, but still...) And this was after Valentine's mail was sent. SQL Slammer had already happened. What, you thought the whole company just jumped on the security bandwagon? Yeah, I thought a new day had dawned, too. You can make 'em quit blindly using strcpy, but you won't change their minds with an email even after Valentine asks the whole company to come in and take Slammer support calls.

ZenoArrow 11y ago

"Microsoft’s latest version of its operating system, Windows 10, has a feature called Windows Hello that allows people to log in to a PC with a scan of their finger, iris or face instead of using a password — weak versions of which are a common cause of data breaches." Is that more secure in practice? http://hackaday.com/2015/11/10/your-unhashable-fingerprints-secure-nothing/ http://hackaday.com/2015/11/10/your-unhashable-fingerprints-...