3 ms·

> And finally, the most exciting news: we've signed a first contract with iSEC partners to evaluate large portions of the Windows software and bootloader code.

by salient 13y ago

> And finally, the most exciting news: we've signed a first contract with iSEC partners to evaluate large portions of the Windows software and bootloader code. This review will begin in January. That's huge. I assume you're not referring to having access to the Windows source code, though. Here's a crazy idea. After the whole NSA stuff, many governments are going to require Microsoft to give them access to the source code, if they want them to continue using it, or buy the new versions of Windows. Any chance you could contact such a government, to allow you to do the audit on their behalf, or to work together with them on it? That would be a win-win for everyone. They get a team of experts to review the Windows code base, and you get to know everything about Windows. They probably won't be very eager to get Americans to do this for them, though, so make sure you flaunt all of your credentials.

mintplant 13y ago
> After the whole NSA stuff, many governments are going to require Microsoft to give them access to the source code, if they want them to continue using it, or buy the new versions of Windows. That's interesting to hear. Got any more information on that?
- Maxious 13y ago
  Well this acknowledges the existence of the source code sharing program... https://www.microsoft.com/en-us/sharedsource/government-security-program.aspx https://www.microsoft.com/en-us/sharedsource/government-secu...
  - deleted 13y ago
    [deleted]
    - deleted 13y ago
      [deleted]
- mburns 13y ago
  The Chinese government has the Windows source code for a decade. Microsoft's press release: http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gspchinapr.aspx http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gs...
- Zigurd 13y ago
  Microsoft has made source code available to governments for quite a long time now. However I don't think Microsoft has ever made buildable source code available, nor does it intend to.
  - gejjaxxita 13y ago
    Can you explain what you mean? How is it the source code if it's not buildable?
    - karlmdavis 13y ago
      Think about the largest, most complex codebase you've ever worked on. Then, remove any architecture documentation, wikis, etc. used to document how it's all tied together. Then, remove the build scripts and any lib folders. Imagine how much fun it'd be trying to get that to build. Multiply the terror that inspires by (at least) 100x.
      - patio11 13y ago
        I think everything you say is likely to be accurate. However, given that we're talking about a nation state in an adversarial context, remember the relevant comparison is "Express the pain of black-box reconstructing the Windows build process in terms of ACEs (aircraft carrier equivalents)." I very much doubt that building Windows is a 10 ACE problem, or a 1 ACE problem, or a 0.1 ACE problem.
        kro0ub 13y ago
        Where can more info be found on the "ACE" metric?
        mechanical_fish 13y ago
        https://en.wikipedia.org/wiki/Jane's_Fighting_Ships https://en.wikipedia.org/wiki/Jane's_Fighting_Ships Or if you're lazy you just Google up this Wikipedia entry: https://en.wikipedia.org/wiki/List_of_aircraft_carriers_of_the_United_States_Navy https://en.wikipedia.org/wiki/List_of_aircraft_carriers_of_t... The USA has ten active Nimitz-class aircraft carriers. Wikipedia claims that the most recent, the USS George H.W. Bush, was completed in 2009 at a cost of $6.2 billion. A bargain compared to the projected cost of the USS Gerald R. Ford, now under construction with a budget of $15.5 billion. These numbers are ridiculously overlarge in this context, of course, which is the point. Access to the Windows build toolchain is not even a $10M project. It's not a technical problem. You start by just offering the money to the company. A few million dollars, plus a history of enforcing your TOP SECRET security clearances, plus credible assurances that you're not going to launch a competing product, is probably enough to convince the company to just give you what you want. Quietly, of course. No need to spook the other customers. If that doesn't work, there's always espionage.
deleted 13y ago
[deleted]
eli 13y ago
Many governments already have access to microsoft source code. Big corporate clients too.
- shootaray 13y ago
  Does that help in any way ever?

by salient 13y ago

mintplant 13y ago

> After the whole NSA stuff, many governments are going to require Microsoft to give them access to the source code, if they want them to continue using it, or buy the new versions of Windows. That's interesting to hear. Got any more information on that?

Maxious 13y ago
Well this acknowledges the existence of the source code sharing program... https://www.microsoft.com/en-us/sharedsource/government-security-program.aspx https://www.microsoft.com/en-us/sharedsource/government-secu...
- deleted 13y ago
  [deleted]
  - deleted 13y ago
    [deleted]
mburns 13y ago
The Chinese government has the Windows source code for a decade. Microsoft's press release: http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gspchinapr.aspx http://www.microsoft.com/en-us/news/press/2003/feb03/02-28gs...
Zigurd 13y ago
Microsoft has made source code available to governments for quite a long time now. However I don't think Microsoft has ever made buildable source code available, nor does it intend to.
- gejjaxxita 13y ago
  Can you explain what you mean? How is it the source code if it's not buildable?
  - karlmdavis 13y ago
    Think about the largest, most complex codebase you've ever worked on. Then, remove any architecture documentation, wikis, etc. used to document how it's all tied together. Then, remove the build scripts and any lib folders. Imagine how much fun it'd be trying to get that to build. Multiply the terror that inspires by (at least) 100x.
    - patio11 13y ago
      I think everything you say is likely to be accurate. However, given that we're talking about a nation state in an adversarial context, remember the relevant comparison is "Express the pain of black-box reconstructing the Windows build process in terms of ACEs (aircraft carrier equivalents)." I very much doubt that building Windows is a 10 ACE problem, or a 1 ACE problem, or a 0.1 ACE problem.
      - kro0ub 13y ago
        Where can more info be found on the "ACE" metric?
        mechanical_fish 13y ago
        https://en.wikipedia.org/wiki/Jane's_Fighting_Ships https://en.wikipedia.org/wiki/Jane's_Fighting_Ships Or if you're lazy you just Google up this Wikipedia entry: https://en.wikipedia.org/wiki/List_of_aircraft_carriers_of_the_United_States_Navy https://en.wikipedia.org/wiki/List_of_aircraft_carriers_of_t... The USA has ten active Nimitz-class aircraft carriers. Wikipedia claims that the most recent, the USS George H.W. Bush, was completed in 2009 at a cost of $6.2 billion. A bargain compared to the projected cost of the USS Gerald R. Ford, now under construction with a budget of $15.5 billion. These numbers are ridiculously overlarge in this context, of course, which is the point. Access to the Windows build toolchain is not even a $10M project. It's not a technical problem. You start by just offering the money to the company. A few million dollars, plus a history of enforcing your TOP SECRET security clearances, plus credible assurances that you're not going to launch a competing product, is probably enough to convince the company to just give you what you want. Quietly, of course. No need to spook the other customers. If that doesn't work, there's always espionage.

deleted 13y ago

[deleted]

eli 13y ago

Many governments already have access to microsoft source code. Big corporate clients too.

shootaray 13y ago
Does that help in any way ever?