5 ms·

This is the result of nearly a decade of work from MSFT, across the board. They built better tools, drilled security into every new hire all the way to the exec

by sriramk 14y ago

This is the result of nearly a decade of work from MSFT, across the board. They built better tools, drilled security into every new hire all the way to the execs, made it a part of every engineering and product process imaginable. Happy that is finally being acknowledged on the outside.

Breakthrough 14y ago
"Happy that is finally being acknowledged on the outside." Not to mention by a reputable security company in the business (we all know there's some sources whom are... biased... to put it nicely). Congrats to Microsoft, glad to see they've put security so highly on their priority list. Not to mention the involvement they try to get with hackers, and worldwide trying to stop spam botnets, etc... Very nice to see a corporation working like that.
- Centigonal 14y ago
  I think it's actually "who" in this case: the pronoun is the subject of "are biased."
psychotik 14y ago
I still remember how painful it was to ship anything, waiting in queue for security team signoff. Good to see it payoff though. Good on Microsoft - making secure products and smarter engineers in the process.
shitlord 14y ago
Now I wish Adobe would do the same thing.
- tptacek 14y ago
  They very much are, and have been, for awhile.
  - icefox 14y ago
    [citation desired]
    - tptacek 14y ago
      A good person to follow here is Brad Arkin.
  - Karunamon 14y ago
    That doesn't apply until they start actually releasing out of band updates for very, very nasty flash/reader vulnerabilities.
  - damncabbage 14y ago
    Remember this? http://www.gizmodo.com.au/2012/05/adobes-photoshop-security-reaches-new-low/ http://www.gizmodo.com.au/2012/05/adobes-photoshop-security-... They left Photo CS 5.5 users twisting in the wind, recommending customers pay to upgrade their one-year-old software to CS 6. I don't know if it was the external pressure or a slow in-house process, but it took them a month to release a fix for CS 5.5 users: http://www.adobe.com/support/security/bulletins/apsb12-11.html http://www.adobe.com/support/security/bulletins/apsb12-11.ht...
    - tptacek 14y ago
      If you wanted to put Microsoft under a microscope from 2003-2010, during the time where they were actually putting in the work to transition from a 1990's software security practice to a 201x security practice, you'd find plenty of "smoking guns" to win arguments with on message boards.
      - shinratdr 14y ago
        So you're implying what were witnessing at the moment is Adobe improving as steadily and quickly as it can? Why do I find that hard to believe. Oh right, because I've launched and used Adobe software in my life.
mark_g 14y ago
Their Secure Development Lifecycle guide can be downloaded from http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=12285 http://www.microsoft.com/en-us/download/details.aspx?display... .
sinnerswing 14y ago
"it's a trap!"
lumberjack 14y ago
What can we trace this security priority initiative of Microsoft back to?
- mcphilip 14y ago
  Jan 15, 2002 email from Bill Gates to all MSFT staff [1]. Includes some real gems, like; >So now, when we face a choice between adding features and resolving security issues, we need to choose security. Our products should emphasize security right out of the box, and we must constantly refine and improve that security as threats evolve. 1.http://www.wired.com/techbiz/media/news/2002/01/49826 http://www.wired.com/techbiz/media/news/2002/01/49826
  - ChuckMcM 14y ago
    I was hugely impressed by Bill when I read that memo, I checked with my friends who worked there to see if it was 'real' or a PR stunt, and they universally agreed it was very very real. I suspect Google is about to be tested in this way given the adoption of Android on mobile devices. It is fortunate that they have a strong security culture to begin with but nothing proves that like being battle tested.
    - elorant 14y ago
      Google isn't the first company that would come to my mind. I'd rather go for Apple. Their mobile ecosystem might be a lot more secure than Android's, but the way they acknowledge OSX vulnerabilities and how soon they fix them is a weak spot. Oracle with Java could also get a lot of heat.
      - wisty 14y ago
        Apple regularly loses security shootouts, and is widely derided by security people. Their only advantages are their niche status (which they are losing) and their lack of consideration towards old apps (they can dump old APIs which are hard to secure, and make other backwards-incompatible fixes, because they just don't care that much about backwards compatibility).
BryanStarbuck 14y ago
I agree with this comment from my time working there. Microsoft engineered their way to this level of success.

by sriramk 14y ago

Breakthrough 14y ago

"Happy that is finally being acknowledged on the outside." Not to mention by a reputable security company in the business (we all know there's some sources whom are... biased... to put it nicely). Congrats to Microsoft, glad to see they've put security so highly on their priority list. Not to mention the involvement they try to get with hackers, and worldwide trying to stop spam botnets, etc... Very nice to see a corporation working like that.

Centigonal 14y ago
I think it's actually "who" in this case: the pronoun is the subject of "are biased."

psychotik 14y ago

I still remember how painful it was to ship anything, waiting in queue for security team signoff. Good to see it payoff though. Good on Microsoft - making secure products and smarter engineers in the process.

shitlord 14y ago

Now I wish Adobe would do the same thing.

tptacek 14y ago
They very much are, and have been, for awhile.
- icefox 14y ago
  [citation desired]
  - tptacek 14y ago
    A good person to follow here is Brad Arkin.
- Karunamon 14y ago
  That doesn't apply until they start actually releasing out of band updates for very, very nasty flash/reader vulnerabilities.
- damncabbage 14y ago
  Remember this? http://www.gizmodo.com.au/2012/05/adobes-photoshop-security-reaches-new-low/ http://www.gizmodo.com.au/2012/05/adobes-photoshop-security-... They left Photo CS 5.5 users twisting in the wind, recommending customers pay to upgrade their one-year-old software to CS 6. I don't know if it was the external pressure or a slow in-house process, but it took them a month to release a fix for CS 5.5 users: http://www.adobe.com/support/security/bulletins/apsb12-11.html http://www.adobe.com/support/security/bulletins/apsb12-11.ht...
  - tptacek 14y ago
    If you wanted to put Microsoft under a microscope from 2003-2010, during the time where they were actually putting in the work to transition from a 1990's software security practice to a 201x security practice, you'd find plenty of "smoking guns" to win arguments with on message boards.
    - shinratdr 14y ago
      So you're implying what were witnessing at the moment is Adobe improving as steadily and quickly as it can? Why do I find that hard to believe. Oh right, because I've launched and used Adobe software in my life.

mark_g 14y ago

Their Secure Development Lifecycle guide can be downloaded from http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=12285 http://www.microsoft.com/en-us/download/details.aspx?display... .

sinnerswing 14y ago

"it's a trap!"

lumberjack 14y ago

What can we trace this security priority initiative of Microsoft back to?

mcphilip 14y ago
Jan 15, 2002 email from Bill Gates to all MSFT staff [1]. Includes some real gems, like; >So now, when we face a choice between adding features and resolving security issues, we need to choose security. Our products should emphasize security right out of the box, and we must constantly refine and improve that security as threats evolve. 1.http://www.wired.com/techbiz/media/news/2002/01/49826 http://www.wired.com/techbiz/media/news/2002/01/49826
- ChuckMcM 14y ago
  I was hugely impressed by Bill when I read that memo, I checked with my friends who worked there to see if it was 'real' or a PR stunt, and they universally agreed it was very very real. I suspect Google is about to be tested in this way given the adoption of Android on mobile devices. It is fortunate that they have a strong security culture to begin with but nothing proves that like being battle tested.
  - elorant 14y ago
    Google isn't the first company that would come to my mind. I'd rather go for Apple. Their mobile ecosystem might be a lot more secure than Android's, but the way they acknowledge OSX vulnerabilities and how soon they fix them is a weak spot. Oracle with Java could also get a lot of heat.
    - wisty 14y ago
      Apple regularly loses security shootouts, and is widely derided by security people. Their only advantages are their niche status (which they are losing) and their lack of consideration towards old apps (they can dump old APIs which are hard to secure, and make other backwards-incompatible fixes, because they just don't care that much about backwards compatibility).

BryanStarbuck 14y ago

I agree with this comment from my time working there. Microsoft engineered their way to this level of success.