3 ms·

Hey axod, I joined the Windows Update team at Microsoft around two months ago. While I can't give exact figures, a standard non-SSIRP update costs Microsoft ar

by sgk284 17y ago

Hey axod, I joined the Windows Update team at Microsoft around two months ago. While I can't give exact figures, a standard non-SSIRP update costs Microsoft around 6 figures to code, test, and ship. October was our biggest release in history with something like 44 updates released (you can do the math). Security incidents that are SSIRPs (effectively vulnerabilities that start actively being exploited, in particular with potential global impact) cost a lot more. Conficker.b was costing Microsoft over a million dollars a day for weeks in support calls alone. Security flaws cost Microsoft a ton of money directly and through things like damaging their brand. They invested insane amounts of money improving security for Win 7, we'll see how it works out (as best as I can tell, it should be pretty effective). disclaimer: this is my opinion, not my employer's

axod 17y ago
Sure, I appreciate it costs a lot to put things right. "damaging their brand." How can you damage Microsofts brand any more than it already is? I don't think most people buying Microsoft buy it because of the brand. Which is why I don't think OS vulnerabilities particularly cost them in lost revenue.
- tptacek 17y ago
  You are, of course, wrong. Enterprises all over the world buy Microsoft for the security. I'm not sure what that has to do with whether it costs Microsoft money to handle Vista zero-day. It clearly does.
  - rbanffy 17y ago
    "Enterprises all over the world buy Microsoft for the security." Like I said elsewhere, "Management by manager". It's when you put decisions in the hands of the least prepared to make them.
    - tptacek 17y ago
      The people that buy into other platforms for "security" are misinformed, and I say this as an inveterate Mac user who ships software on Debian VMs. A good acid test for whether someone is talking out their ass about security: they make smart-ass comments about Microsoft. It's getting harder and harder to find reputable security researchers who haven't done work for Microsoft.
      - rbanffy 17y ago
        Security is a more complex terrain than that Microsoft vs. Free Software space people keep insisting to drag the discussion into. Dragging it into this place is a straw man. A straw man compounded to your ad hominem is not up to the usual standards here. It is possible for you to hire people to secure an open platform from the ground up. It is up to Microsoft to secure Windows from top to wherever they think the cost exceeds the benefit for them. That's a key difference - it doesn't matter how much effort you spend securing Windows, if you are not Microsoft, you can never be sure of the results until you find them out the hard way. Yes. I do like Free Software and I use it extensively. I also use Sun, Oracle, IBM, SAP, PeopleSoft and, from time to time, even recommend MS SQL Server when it makes sense. It would, however, be insane to simply disregard Microsoft's software appalling security record or to oversimplify it as a Free vs Evil dichotomy. It's not. It's just that Microsoft seems to spend more money promoting their wares than properly checking and securing them. Security seems to be grafted on instead of built into. And, for the other argument, of security issues arising only from adversarial conditions and not bugs, that's simply incorrect. Software that's correct should not have holes like unchecked buffers that allow code injections. And it's not only Microsoft who's guilty here - just about every product I use seems to have fallen for this one in a given point in its history. Still, the fact others face it does not make Microsoft's products more secure. Like I said, it's a more complex issue than this false dichotomy. As for more sophisticated attacks that rely on memory access patterns, memory protection mishandling, improper erasure and so on, well... If the processor is not, itself, correct, you can't really expect the software to cover all the holes - only the possible ones.
        tptacek 17y ago
rbanffy 17y ago
"Conficker.b was costing Microsoft over a million dollars a day for weeks in support calls alone" It was not Conficker that cost Microsoft a million a day - it was the support to their customers that bought software that had uncorrected bugs that should have been detected earlier and that made Conficker possible. Shipping bugs costs a lot of money. Unless they cost more than getting rid of them, they are never corrected. And if it did cost Microsoft a million a day, it cost a lot more to their customers. If baffles me they are still customers.
- rbanffy 17y ago
  What? You make a buggy software product someone finds a way to exploit automatically and when your customers come calling asking for help to repair their systems, suddenly, you are not to be blamed? Not even a little? How so? Let's move the example from software to aerospace. Someone builds planes that, when an engine inhales a bird, explode, killing all passengers and crew. They do not know the problem exists and did as little testing as required by regulations. Knowing the problem, a kid decides to release pigeons in the path of the plane, creating a quite spectacular accident. Who will you blame? Just the kid, just the manufacturer or both? Until executive bonuses get cut, you will see no improvement over there. Unfortunately, lots of bonuses get calculated on limited scopes and don't reflect the complete lifetime of a product. This way, it's easy to close sales, pocket huge bonuses right now, get promoted, and to let the support cost bomb explode in the hands of your successor while you capitalize on your success and head up the corporate ladder. If you look them closely, big corporations are rarely more intelligent than a sponge or a coral reef.

by sgk284 17y ago

axod 17y ago

Sure, I appreciate it costs a lot to put things right. "damaging their brand." How can you damage Microsofts brand any more than it already is? I don't think most people buying Microsoft buy it because of the brand. Which is why I don't think OS vulnerabilities particularly cost them in lost revenue.

tptacek 17y ago
You are, of course, wrong. Enterprises all over the world buy Microsoft for the security. I'm not sure what that has to do with whether it costs Microsoft money to handle Vista zero-day. It clearly does.
- rbanffy 17y ago
  "Enterprises all over the world buy Microsoft for the security." Like I said elsewhere, "Management by manager". It's when you put decisions in the hands of the least prepared to make them.
  - tptacek 17y ago
    The people that buy into other platforms for "security" are misinformed, and I say this as an inveterate Mac user who ships software on Debian VMs. A good acid test for whether someone is talking out their ass about security: they make smart-ass comments about Microsoft. It's getting harder and harder to find reputable security researchers who haven't done work for Microsoft.
    - rbanffy 17y ago
      Security is a more complex terrain than that Microsoft vs. Free Software space people keep insisting to drag the discussion into. Dragging it into this place is a straw man. A straw man compounded to your ad hominem is not up to the usual standards here. It is possible for you to hire people to secure an open platform from the ground up. It is up to Microsoft to secure Windows from top to wherever they think the cost exceeds the benefit for them. That's a key difference - it doesn't matter how much effort you spend securing Windows, if you are not Microsoft, you can never be sure of the results until you find them out the hard way. Yes. I do like Free Software and I use it extensively. I also use Sun, Oracle, IBM, SAP, PeopleSoft and, from time to time, even recommend MS SQL Server when it makes sense. It would, however, be insane to simply disregard Microsoft's software appalling security record or to oversimplify it as a Free vs Evil dichotomy. It's not. It's just that Microsoft seems to spend more money promoting their wares than properly checking and securing them. Security seems to be grafted on instead of built into. And, for the other argument, of security issues arising only from adversarial conditions and not bugs, that's simply incorrect. Software that's correct should not have holes like unchecked buffers that allow code injections. And it's not only Microsoft who's guilty here - just about every product I use seems to have fallen for this one in a given point in its history. Still, the fact others face it does not make Microsoft's products more secure. Like I said, it's a more complex issue than this false dichotomy. As for more sophisticated attacks that rely on memory access patterns, memory protection mishandling, improper erasure and so on, well... If the processor is not, itself, correct, you can't really expect the software to cover all the holes - only the possible ones.
      - tptacek 17y ago

rbanffy 17y ago

"Conficker.b was costing Microsoft over a million dollars a day for weeks in support calls alone" It was not Conficker that cost Microsoft a million a day - it was the support to their customers that bought software that had uncorrected bugs that should have been detected earlier and that made Conficker possible. Shipping bugs costs a lot of money. Unless they cost more than getting rid of them, they are never corrected. And if it did cost Microsoft a million a day, it cost a lot more to their customers. If baffles me they are still customers.

rbanffy 17y ago
What? You make a buggy software product someone finds a way to exploit automatically and when your customers come calling asking for help to repair their systems, suddenly, you are not to be blamed? Not even a little? How so? Let's move the example from software to aerospace. Someone builds planes that, when an engine inhales a bird, explode, killing all passengers and crew. They do not know the problem exists and did as little testing as required by regulations. Knowing the problem, a kid decides to release pigeons in the path of the plane, creating a quite spectacular accident. Who will you blame? Just the kid, just the manufacturer or both? Until executive bonuses get cut, you will see no improvement over there. Unfortunately, lots of bonuses get calculated on limited scopes and don't reflect the complete lifetime of a product. This way, it's easy to close sales, pocket huge bonuses right now, get promoted, and to let the support cost bomb explode in the hands of your successor while you capitalize on your success and head up the corporate ladder. If you look them closely, big corporations are rarely more intelligent than a sponge or a coral reef.