Microsoft to Clean Up Code 466
the_pooh_experience writes "Microsoft has decided to beef up their security group by adding a code cleaning group according to Infoworld. As the director of MS security engineering says: 'Microsoft is a long way from its ultimate goal where users can take security for granted in its products...the majority of viruses written attack Microsoft products.'" The new group is called Security Engineering Strategy and while it may seem long overdue to many, it's still a step in the right direction for the folks in Redmond.
more of the same (Score:3, Insightful)
Poppycock. (Score:2, Insightful)
Re:more of the same (Score:5, Insightful)
About damned time (Score:5, Insightful)
And, yes, please somebody respond to the oxymoronic notion of "business ethics," I'm just begging for it.
Incorrect (Score:5, Insightful)
Pity.
sceptic (Score:5, Insightful)
Hiring Somebody to Do the Dirty Work (Score:5, Insightful)
Now I do not write the cleanest code in the world... but when writing with a group, I can take the time and effort to make ultra clean code--especially if my paycheck depended on it!
Why hire somebody else to do _your_ job?
I've never programmed in a huge group before... so maybe I missing the experience to understand.
Davak
This must be a joke (Score:5, Insightful)
Microsoft is a long way from its ultimate goal where users can take security for granted in its products
This is precisely the problem we have now. People already take security for granted (they don't think about it). Their goal should be to beef up security and to educate everyone about the features so that they become more security concious, rather than just take it for granted.
Taking security for granted (Score:5, Insightful)
Blimey, they gotta be careful... (Score:5, Insightful)
Fix 1 security hole.
Introduce 100 bugs.
Hmmm.
Code audits will help, but... (Score:5, Insightful)
What is really needed from Microsoft is flat-out redesign, and that means breaking a few eggshells.
The most telling bit from this article: "...the majority of viruses written attack Microsoft products..." Yes, it is certainly true that some of them exploit real bugs, but the majority of viruses target Microsoft software design, not buffer overflows.
I'm willing to bet the code audit team members don't have redesign authority; nor should they. Hopefully, they do have easy access to people who can make the design decisions and can raise issues quickly. Necessary design changes are going to break things.
You can audit the code all day and all night and you will end up with a more secure product in the end. But to solve the real problems with Microsoft security, the product needs to be designed with that security in mind.
The only thing that will save MSFT's code.. (Score:5, Insightful)
ok, i did not mean for that to rhyme, but you get my point. Microsoft is a big self reliant entity that hires like minded people. Thats not who they need reviewing their code. They need objective 3rd parties with real world experience in security and systems. I'm not saying they need to put the code to WinNT on an FTP server for all to see, but loosening their grip a little.
Once MSFT realizes that they dont have to be nazi-esque with their firm grips around their code base, and they can succeed by opening up a little, they will do great things, imho. They havent quite learned that yet..
That's pretty funny (Score:3, Insightful)
The way I hear it, most people already take security for granted with MS products.
And are proven idiots.
krystal_blade
they previously did not have such engineer team? (Score:1, Insightful)
what a company!
Re:Slashdot's Microsoft Obsession (Score:2, Insightful)
You must be new around here...
Here's a tip for you: go to your Preferences and filter out what you don't want to see.
Re:Clean Code? (Score:3, Insightful)
Don't be dismissive (Score:5, Insightful)
Think about the success of OpenBSD [openbsd.org]. In terms of security holes it's probably an order of magnitude better than other free operating systems, and Windows. This result was largely obtained through code auditing. If we aren't careful, in a few years, Microsoft will turn the tables on us. The code auditing they've done will have paid off, and we'll have it all still to do (for the typical Linux distribution, OpenBSD is different).
Laughing at your competitors is a risky strategy.
Re:This proves it! (Score:2, Insightful)
Fool me once, shame one you
Fool me twice, shame on me
Fool me over and over and I must be the IT selection manager/commitee/group at a fortune 500 firm.
Anyone remember Douglas Adams' concept of the SEP field generator? It generates a sense that something is Someone Else's Problem and people's natural predisposition to overlook it makes the something invisible. Makes me wonder if that's not built into the code somewhere...
Re:Incorrect (Score:5, Insightful)
Re:Credit Where Due (Score:2, Insightful)
Yes, considerably more humble. At least Microsoft knows better. That's a lesson Larry hasn't been able to learn from Microsoft's mistakes, so now he's learning the hard way.
The bottom line is that staying under the radar doesn't mean your software is stable. Any company with Microsoft's faithful hate troop would be humiliated by their own software. Oracle is just one example.
Re:more of the same (Score:1, Insightful)
MS has always given users what they want, the majority that is (not at the prices they want, but thats a different issue). This is my opinion, and it is based on the number of ppl using MS products.
Now, a few years back, MS was completetly open about the fact that they priorities functionality. Most ppl know that there is a tradeoff between functionality and security, so this simply means they were not prioritising security.
They have just started to focus on securtiy, so it will obviously take them a while to fix it. Just because they have a lot of money doesn't mean it will go quicker. You cant throw 100 developers on one project and expect it to go twice as fast as 50 developers.
Re:Port to Java! (Score:2, Insightful)
Coorporations believe in a lot of things, and miss a lot of other things in doing so.
In the early 90's, everyone expected Unix to collapse and NT to take over the server market. A decade later, Unix market share has grown via. Linux and NT is in the minority on the web.
Microsoft believed in MSN and almost completely missed the Internet revolution.
Sun believed in NeWs and X stomped it into the ground.
Sun also believed in JINI. Remember that? I doubt you do.
Microsoft believed in Passport & Hailstrom, then scaled back their plans, then buried most of it.
Now Sun believed in Java and Microsoft believes in
By the way, do you remember what
But it IS important (Score:5, Insightful)
Secondly, I believe it's very important to keep track of any and all movments of the biggest, richest, most powerful company in the world.
Of the company that controls 95% of the desktop market that Linux might, hopefully, break into.
If they're looking into new strategies, even ones that are years behind their time, we should know about it. When you only look at yourself, you'll sometimes see innovation or monopolism take over while you're busy staring at your shoes.
A company with such terrible operating practices [lindows.com] should be watched closer than any other company, and I'm all for it.
Despite your obvious trolling, I will agree that it might seem a bit much, but I'll tell you, I'm glad we're looking too hard, than not looking hard enough.
I wait for these same comments about the SCO case in a few days.
Re:GROW UP!!! (Score:1, Insightful)
Re:Taking security for granted (Score:5, Insightful)
I dunno, two remote holes in 7 years is pretty good. If you want to use slashdot as a forum for anti-OpenBSD trolling, point out that the default install does pretty much nothing, and it's the services that people install anyway that are usually abused (telnet, ftp, etc.). That's more of a point than 'Only one? They probably have two!' which is just blatant trolling.
--Dan
A good thing (Score:5, Insightful)
Working in an environment that is purely MS based on the desktop, with significant MS server infrastructure, I can only applaud any efforts they are making to clear up the mess that is obviously present. No, it's not going to happen overnight - Just as the company I work for is not going to replace all it's investment in MS tech overnight.
Unfortunately, being a developer does not make you a security expert. Some are, others will continue to allow simple flaws, such as buffer overruns, into their code. Having a group of people who focus on security review that code is without a doubt a good thing. While this may not be the potentially rigorous code review that OSS gets, it's better what presently happens at MS.
As for the issue of scapegoats...from an external point of view, getting MS to recognise bugs can be a difficult job at the best of times. Internally, if a group of security "experts" fail to recognise security flaws in a piece of code...then surely they are failing at their job?
Finally, there's been a lot of flaming about the fact that this is yet-another-initiative from MS in the security field. I welcome all of them, in parallel, as moving towards sorting out some of the many issues they have. The less time I have to spend working on patching buggy MS software, the happier I will be.
Re:Don't be dismissive (Score:5, Insightful)
Security is not a methodology which you can apply like any other tool -- it is a mindset which has to be cultivated in the original coders AND carried over to the ones who bugfix/test the code.
Re:This must be a joke (Score:2, Insightful)
Re:This proves it! (Score:2, Insightful)
Now they are telling the world they want to clean it up. They have a team on it.
Corporate buyers want to hear this. They like to know that the dollars they are spending are going into making the product better. Knowing that they software will be better/more secure in the next revision keeps them from making the choice to move to a different platform.
In business, money talks. They understand the concept that Microsoft NEEDS to do this, to keep making money. It's hard to understand the driving factor that causes people to spend time inproving Linux- in general it isn't dollars.
That's the marketing portion, and it really does make sense.
Of course, they will need to deliver the goods too- and Windows users will benefit from that.
So by announcing to the world that they are working on it- they get a big marketing push. By actually doing the job, their products will get more and more secure. It may take a while, but as long as they are working on it, people will continue to buy.
Most of the anecdotes on Slashdot have to do with Windows 95, 98 (ME!) and NT. 2000 and XP are not perfect, or even wonderful, but the amount of improvement in stability is amazing. If this trend continues, their efforts will have paid off- and there will be a lot less reason to switch over to a different operating system.
Re:Can you spell political? (Score:1, Insightful)
The marketing department is never decides when a product is to be shipped.
What Microsoft needs is a overhaul of its testing procedures.
Testing compatability with MS' own and partner products takes a huge amount of hardware and manpower resources.
Its a tough problem to solve.
This new group will be one additional layer on top of 3 or 4 layers of testing/reviewing which some groups already have.
Re:more of the same (Score:2, Insightful)
Do you really believe that? I view it as MS always does what THEY want with a PR screen twisting it to appear to be to your advantage. The things they do strictly for the consumer are always an after thought and only implemented when the PR machine can't "fix" the problem, security being a major one. Wouldn't it be nice if IE had half the user controls and advanced features of every other browser made like cookie blocking, web bug identification, ability to block certain scripts. I'm sure the users would like these things. How about allowing Windows update from other browsers. Any reason they could not make a small standalone app to get updates like every other software maker has? Why is the MS Office file format not fully open and documented for compatibility? How about some more specs for SMB transactions? How about getting rid of the constant nagging with passport and Hotmail on XP?
You may view people that complain or "trash" MS as trolls and winers but there are major issues with the way they do business (monopoly) that causes problems and frustration for computer users and IT folks everywhere.
Re:Fat Chance (Score:3, Insightful)
As to your statement that the same thing happens among Linux vendors in the 3/4 points, that is just totally off base. It is true that some vendors (*cough* redhat *cough*) have a history of adopting totally new, uncompatible versions of major packages before those versions reach 'stable' (glibc, gcc for example), but it is not meant to break compatibility. Especially with gcc, the promise of the new x86 backend was so great and it was thought at the time the final gcc 3.0 would be ABI/API compatible, and that the codebase was extremely close to release and very stable. They found out that neither was the case and got stuck with a bastardized gcc '2.96', but it was hardly a strategy to push other vendors out. The ultimate point is that all these technologies that are used that break inter-distro compatibility are open, well documented technologies, and thus by definition cannot be used to secretly push out competition and make compatiblity impossible. Also, in each case, there were real, compelling reasons for the changes.
Meanwhile, MS has a proven history of making trivial changes for the express purpose of breaking competitor products (Windows being changed to not run on DR-DOS for example). With a closed codebase, this becomes a real possiblity.
Taking for Granted... (Score:1, Insightful)
Wasn't taking security for granted the problem in the first place? We see where that got Microsoft...
I'd also like to point out (love 'em or hate 'em) what Bob X said about cleaning up code [pbs.org]...
Re:The only thing that will save MSFT's code.. (Score:5, Insightful)
there are obvious drawbacks to microsoft opening their source, including a large collapse of their main revenue streams and huge impact on their existence as a company. at least, as microsoft is structured now, opening their source is not a good business decision (no matter your feelings on microsoft as a company).
open source is not the software savior it's often made out to be. all software will not be open source. ever. demanding that every software company do just that is both unreasonable and generally unhelpful. we should be demanding that software companies produce more secure, stable, and user-centered software. however each company chooses to do that shouldn't matter, as long as that end goal is reached.
Re:Don't Stow Thrones in Grass Houses (Score:3, Insightful)
Taking Secuirty for Granted. (Score:3, Insightful)
Personally, I do not think that security should ever be taken for granted. I think it has been proven that this lax security awareness leads to problems independent of the software (e.g. stolen credit card numbers and identity theft from insecure websites and to a lesser extent the proliferation of spam). Most people do not take the locks on their front dor for granted, why should the computer be any different. Especially now that many individuals use the computer as the primary portal to the outside world.
What was that name again? (Score:3, Insightful)
According to the article, the new group will be called outa'sync (um, no, wrong article. Hang on. Ok). The new group will called the (drum roll, please):
Anything group that has the word "strategy" in it will spend their time writing memos about how this piece of already written code could be better.
These memos will then be ignored by everybody so they can meet their deadlines.
odd timing. (Score:5, Insightful)
Here's something to worry about. Does the timing, that the U.S. Gov just instituted a new position for this (the cyber-security chief) which I have already commented on here [slashdot.org], seem odd to anyone else?
This looks remarkably like the same type of handwaving smoke and mirror show that the government is trying to put on. "look at us, we're doing something(tm) about security!
makes me wonder if this is microsoft's way of making sure it has a chance to influence what the gov. considers secure.
Re:No kidding! (Score:3, Insightful)
Re:No kidding! (Score:2, Insightful)
Perhaps, but I have this nagging feeling that a company that does software should have been more focused on quality and security from the beginning. What they're doing now is expending the effort that should have been there all along. It's like all their code was written with some starry-eyed optimism that noone would ever think to misuse it or exploit lax security. Kinda like an automaker who builds a cars that can go 100 mph but has not seatbelts, no airbags and brakes that ask if you're sure you really want to hit them, under the knowledge that it runs and the assumptions that you'd never speed or drive recklessly.
It really is the R&D cost they're talking about putting in over the next 10-15 years before , by their own admission, the code should be totally secure and trustworthy. What other industry, besides perhaps tobacco, could get away with something as audacious as that? Last, the staggeringly amazing thing is, people seem fine with that. Cripes!
Microsoft will get it right one day... (Score:5, Insightful)
Windows 3 was crap.
Windows 95 is unstable.
Windows 2000 Server is insecure.
If they progress as far in the next decade as in the past decade, they will be delivering stable, relyable and secure servers. If that happens I dont see Linux based systems able to offer too much competition.
The first paragraph says it all (Score:2, Insightful)
Not "to sell secure software" you'll notice, but to make customers "take security for granted".
So presumably if the security stinks but everyone assumes the system is secure, they will be satisfied.
Everything I dislike about the company in a nutshell
Re:Hiring Somebody to Do the Dirty Work (Score:3, Insightful)
I mean, really. A "Clean Code" group is good and all, but it's not a very efficient or effective way to make new products hassle-free, and it certainly doesn't resolve the problems caused by frequent patching. Plus, knowing the scale of large corporations (read: NOT just MSFT), the "Clean Code" group will probably be in the Canadian wilderness, hundreds of miles from the application developers. Be prepared for bogus patches that break more than they fix. I do suppose, though, since Microsoft will never rewrite code from scratch [joelonsoftware.com], this is the only way to get older projects up to speed.
Here's hoping the "Clean Code" group at least includes some of the original developers, to move things along. Windows is so incredibly bloated that I doubt we'll see them finish debugging it inside this decade. I guess that's Open Source's biggest strength -- anybody can be a "Clean Code" reviewer, and you don't need an NDA or a fancy degree to do it. You don't even need to ask for permission!
Jasin Natael
Re:A good thing (Score:5, Insightful)
The small projects aren't usually popular enough to attract sufficient attention. The big ones are too large an undertaking for anything but a cursory inspection which will only reveal the most blatant of security flaws; consider how long it's taken to find all the ptrace flaws in the linux kernel.
Re:more of the same (Score:2, Insightful)
First: Many of the problems with MS software are not code bugs; but bad decisions regarding what you allow code to do. So a cleaning team will not really address the issue of whether or not you allow Outlook to run X or Y.
Second: If they do clean up their code, it will help to entrench them. XP and 2000 have already sparked comments of "They've come a long way with... or
Re:Fat Chance (Score:3, Insightful)
Re:No kidding! (Score:4, Insightful)
Not to mention the frequent crashing, loss of data, forced upgrade cycles, etc.
Last, the staggeringly amazing thing is, people seem fine with that. Cripes!
Exactly. No one wants a single thing to go wrong with their car or telephone, but the software we use is acceptable. It's funny/scary to see how many people actually accept and think it's fine to reboot their PC every hour.
Re:OH come on now (Score:5, Insightful)
Security is one of the main areas that MS gets blasted for. While the security in their server products has some merits, it's undermined by the bugs that continuously appear and the total lack of lockdown in out-of-the-box config. Their push on security would have to address all these issues - Removing issues from the code prior to shipping, improving their response to the bugs that still appear, locking down products and educating users to unlock them as appropriate, and most importantly of all, concentrating on designing their systems to incorporate security from the start, rather than trying to tack it on later. There's been some movement in some of these areas...but nowhere near enough yet.
So will they do it? You're right in that there is little evidence so far. Given the constant slating they receive in this area, there is certainly a motive to improve it. But given the apparent lifetime of legacy code in Windows, it's not going to show significant results any time soon in that arena. I would suspect it would be more evident in "new" products such as
Trustworthy computing was launched in Jan 2002, there's some info on what they claim to have achieved on their site [microsoft.com].
I do agree with you about Clippy tho
Re:This must be a joke (Score:3, Insightful)
When in fact it is far from the truth.
This false sense of security is exactly what makes their product very vulnerable.
MS needs to admit the security flaws publicly, loudly, and stop preaching bullshit.
Re:A good thing (Score:5, Insightful)
The problem is that as far as Microsoft is concerned "security" is a synonym for "DRM".
Whenever Microsoft talks about security, one always has to wonder how much of what they are doing actually means securing the machine against outside attackers (a good thing), and how much of it means securing the machine against it's owner (a bad thing).
The article makes refferences to things like "Trustworthy Computing" and "Next Generation Security". Both of which actually mean "DRM enforcment".
"Normal" computers cannot be adaquately secured against their owners. As far as Microsoft is concerned this is a "security flaw". Microsoft intends to "fix" this "flaw" by introducing new and crippled computers.
The article says Microsoft's "ultimate goal being that customers will take security for granted". Do you really think they mean that people will take it for granted that Microsoft software is bug free?? Or do they mean that their DRM mechanisms will be an "invisible", integrated, and omni-present part of using a computer?
They want you to take it for granted that the computer is invisibly and seamlessly enforcing DRM restrictions when you read your E-mail or surf the web. People are not supposed to notice that the option to "save image" has dissapeared from the menu when you right-click an image in the browser. Not only is that option gone, but the computer is phyically incapable of saving that image. The image is copyrighted of course, and wrapped in DRM. If people never see the DRM, they will just take it for granted when various options vanish, or other things become mandatory.
If Microsoft is cleaning up their code, then yes, this is a good thing. But a careful reading of the article suggest that this is at best a mixed project. And that is not a good thing.
-
Re:Don't be dismissive (Score:2, Insightful)
http://msdn.microsoft.com/msdntv/episode.aspx?x
Take a look at this video, it is from one of their security groups. Listen to the changes made in Windows 2003 Server. The box is closed by default, does nothing until you enable services.
They've hardened IE on servers, games can't be installed, Services are now being re-worked so they don't require elevated privilages.
People can criticize all they want for the past sins, but I think it's important to keep an open mind about reality.