4 ms·

You're implying that makers and manufacturers could release perfect products with zero defects if they wanted to. No automobiles would ever need recall. No soft

You're implying that makers and manufacturers could release perfect products with zero defects if they wanted to. No automobiles would ever need recall. No software would ever have a security bug. You do realize that's an impossibly high standard don't you?

thechao 6y ago
Every time, a few months before product release, downstream teams start filing bugs on us that boil down to the statement: "please continue to add features, but stop adding bugs". Oh, sweet summer child: features are bugs.
Ericson2314 6y ago
A few things to counter here: 1. Considering the sloppy bullshit that is the root cause of 95%+ security vulnerabilities today, I think talking about "0 security" bugs is a distorting strawman. 2. No one said no recalls. The issue here is Microsoft is going after the exploiter rather than the bug, taking the law into their own hands over dubious pretenses. That's somewhere in between taking the drivers licenses of Corvair owners and recalling the Corvairs themselves. (We could make a better anology if a black hat actor triggered the car defect.) 3. This could easily be precedent for scenario: 1. Security researcher finds bug and discloses it 2. Big crop declines to pay up / doesn't fix in timely manner, etc. 3. Security researcher goes public 4. Malware is made with exploit 5. Big corp goes vigilante on malware like this *and* sues security researcher, using this trademark justification in *both* cases.
- withinboredom 6y ago
  They mention in the article how it spreads via emails not via exploits (in which it would be called a worm, not malware).
  - saghm 6y ago
    Isn't a worm just a type of malware? Wikipedia describes malware as "any software intentionally designed to cause damage to a computer, server, client, or computer network".
    - Talanes 6y ago
      Seconded, I've always understood malware to be a broad categorization and not a specific type of attack.
      - withinboredom 6y ago
        I'd always assumed that malware was malicious software disguised as something else; the layman term for trojan. TIL that it's much more generic than that.
- CrazyStat 6y ago
  In what sense is Microsoft "taking the law into their own hands"? They filed a lawsuit and convinced the judge to agree with their legal theory. That's how the legal system works. There is no vigilantism here.
hansvm 6y ago
No, just that they need to be willing to accept the consequences of their mistakes rather than blame third parties. If software development is inherently risky then that's still the responsibility of software developers. If that makes some businesses unviable then the system is working as intended because they were unviable anyway, just profiting by passing costs to other people. There's a separate sentiment floating around (and that _was_ the tone I caught from the parent comment, though I could be mistaken) that portions of Microsoft produce software with major design flaws that create a horde of other security and performance problems and that they should do better, but actually making better software isn't a necessary step in holding software creators accountable.
- moron4hire 6y ago
  It seems like, if Microsoft were trying to absolve themselves of responsibility for defects in their products, the thing to do would be to claim that malware is developed by third parties outside of their control, against the terms of the EULA. What Microsoft is actually doing seems a lot more like taking responsibility. They're cleaning up the mess and helping people when they don't really have a legal requirement to do so.

thechao 6y ago

Every time, a few months before product release, downstream teams start filing bugs on us that boil down to the statement: "please continue to add features, but stop adding bugs". Oh, sweet summer child: features are bugs.

Ericson2314 6y ago

A few things to counter here: 1. Considering the sloppy bullshit that is the root cause of 95%+ security vulnerabilities today, I think talking about "0 security" bugs is a distorting strawman. 2. No one said no recalls. The issue here is Microsoft is going after the exploiter rather than the bug, taking the law into their own hands over dubious pretenses. That's somewhere in between taking the drivers licenses of Corvair owners and recalling the Corvairs themselves. (We could make a better anology if a black hat actor triggered the car defect.) 3. This could easily be precedent for scenario: 1. Security researcher finds bug and discloses it 2. Big crop declines to pay up / doesn't fix in timely manner, etc. 3. Security researcher goes public 4. Malware is made with exploit 5. Big corp goes vigilante on malware like this *and* sues security researcher, using this trademark justification in *both* cases.

withinboredom 6y ago
They mention in the article how it spreads via emails not via exploits (in which it would be called a worm, not malware).
- saghm 6y ago
  Isn't a worm just a type of malware? Wikipedia describes malware as "any software intentionally designed to cause damage to a computer, server, client, or computer network".
  - Talanes 6y ago
    Seconded, I've always understood malware to be a broad categorization and not a specific type of attack.
    - withinboredom 6y ago
      I'd always assumed that malware was malicious software disguised as something else; the layman term for trojan. TIL that it's much more generic than that.
CrazyStat 6y ago
In what sense is Microsoft "taking the law into their own hands"? They filed a lawsuit and convinced the judge to agree with their legal theory. That's how the legal system works. There is no vigilantism here.

hansvm 6y ago

No, just that they need to be willing to accept the consequences of their mistakes rather than blame third parties. If software development is inherently risky then that's still the responsibility of software developers. If that makes some businesses unviable then the system is working as intended because they were unviable anyway, just profiting by passing costs to other people. There's a separate sentiment floating around (and that _was_ the tone I caught from the parent comment, though I could be mistaken) that portions of Microsoft produce software with major design flaws that create a horde of other security and performance problems and that they should do better, but actually making better software isn't a necessary step in holding software creators accountable.

moron4hire 6y ago
It seems like, if Microsoft were trying to absolve themselves of responsibility for defects in their products, the thing to do would be to claim that malware is developed by third parties outside of their control, against the terms of the EULA. What Microsoft is actually doing seems a lot more like taking responsibility. They're cleaning up the mess and helping people when they don't really have a legal requirement to do so.