Microsoft to Clean Up Code 466
the_pooh_experience writes "Microsoft has decided to beef up their security group by adding a code cleaning group according to Infoworld. As the director of MS security engineering says: 'Microsoft is a long way from its ultimate goal where users can take security for granted in its products...the majority of viruses written attack Microsoft products.'" The new group is called Security Engineering Strategy and while it may seem long overdue to many, it's still a step in the right direction for the folks in Redmond.
more of the same (Score:3, Insightful)
Re:more of the same (Score:5, Insightful)
A good thing (Score:5, Insightful)
Working in an environment that is purely MS based on the desktop, with significant MS server infrastructure, I can only applaud any efforts they are making to clear up the mess that is obviously present. No, it's not going to happen overnight - Just as the company I work for is not going to replace all it's investment in MS tech overnight.
Unfortunately, being a developer does not make you a security expert. Some are, others will continue to allow simple flaws, such as buffer overruns, into their code. Having a group of people who focus on security review that code is without a doubt a good thing. While this may not be the potentially rigorous code review that OSS gets, it's better what presently happens at MS.
As for the issue of scapegoats...from an external point of view, getting MS to recognise bugs can be a difficult job at the best of times. Internally, if a group of security "experts" fail to recognise security flaws in a piece of code...then surely they are failing at their job?
Finally, there's been a lot of flaming about the fact that this is yet-another-initiative from MS in the security field. I welcome all of them, in parallel, as moving towards sorting out some of the many issues they have. The less time I have to spend working on patching buggy MS software, the happier I will be.
Re:A good thing (Score:5, Insightful)
The problem is that as far as Microsoft is concerned "security" is a synonym for "DRM".
Whenever Microsoft talks about security, one always has to wonder how much of what they are doing actually means securing the machine against outside attackers (a good thing), and how much of it means securing the machine against it's owner (a bad thing).
The article makes refferences to things like "Trustworthy Computing" and "Next Generation Security". Both of which actually mean "DRM enforcment".
"Normal" computers cannot be adaquately secured against their owners. As far as Microsoft is concerned this is a "security flaw". Microsoft intends to "fix" this "flaw" by introducing new and crippled computers.
The article says Microsoft's "ultimate goal being that customers will take security for granted". Do you really think they mean that people will take it for granted that Microsoft software is bug free?? Or do they mean that their DRM mechanisms will be an "invisible", integrated, and omni-present part of using a computer?
They want you to take it for granted that the computer is invisibly and seamlessly enforcing DRM restrictions when you read your E-mail or surf the web. People are not supposed to notice that the option to "save image" has dissapeared from the menu when you right-click an image in the browser. Not only is that option gone, but the computer is phyically incapable of saving that image. The image is copyrighted of course, and wrapped in DRM. If people never see the DRM, they will just take it for granted when various options vanish, or other things become mandatory.
If Microsoft is cleaning up their code, then yes, this is a good thing. But a careful reading of the article suggest that this is at best a mixed project. And that is not a good thing.
-
Re:A good thing (Score:3, Interesting)
Re:A good thing (Score:5, Insightful)
The small projects aren't usually popular enough to attract sufficient attention. The big ones are too large an undertaking for anything but a cursory inspection which will only reveal the most blatant of security flaws; consider how long it's taken to find all the ptrace flaws in the linux kernel.
Re:OH come on now (Score:5, Insightful)
Security is one of the main areas that MS gets blasted for. While the security in their server products has some merits, it's undermined by the bugs that continuously appear and the total lack of lockdown in out-of-the-box config. Their push on security would have to address all these issues - Removing issues from the code prior to shipping, improving their response to the bugs that still appear, locking down products and educating users to unlock them as appropriate, and most importantly of all, concentrating on designing their systems to incorporate security from the start, rather than trying to tack it on later. There's been some movement in some of these areas...but nowhere near enough yet.
So will they do it? You're right in that there is little evidence so far. Given the constant slating they receive in this area, there is certainly a motive to improve it. But given the apparent lifetime of legacy code in Windows, it's not going to show significant results any time soon in that arena. I would suspect it would be more evident in "new" products such as
Trustworthy computing was launched in Jan 2002, there's some info on what they claim to have achieved on their site [microsoft.com].
I do agree with you about Clippy tho
Re:more of the same (Score:5, Funny)
Re:more of the same (Score:5, Funny)
Credit Where Due (Score:5, Interesting)
Re:Credit Where Due (Score:5, Informative)
Microsoft also got hit a lot harder every time they claimed some semblance of security. They've learned their lesson, albeit slowly. Now they only claim to be working on improving security, considerably different than Larry's claims.
woof.
Re:Credit Where Due (Score:2, Insightful)
Yes, considerably more humble. At least Microsoft knows better. That's a lesson Larry hasn't been able to learn from Microsoft's mistakes, so now he's learning the hard way.
The bottom line is that staying under the radar doesn't mean your software is stable. Any company with Microsoft's faithful hate troop would be humiliated by their own software. Oracle is just one example.
Re:Credit Where Due (Score:5, Interesting)
You don't "fix" 50 million lines of code overnight, especially not when it has taken 10 years (or more) to write. However, all of the developers really did take a few days to go through a set of classes on how to write secure code, and then spent the next month reviewing their code for security problems. All of the program managers really did go to classes to learn about security vulerabilities and how to find security weaknesses in their designs, and then went back and updated designs where needed. All of the testers really did go to classes to learn how to find security bugs and then created security test plans and spent a month doing nothing but looking for security bugs.
It probably isn't perfect, if Microsoft went for perfect you would be paying ten to twenty times more for the software, but for the first stab at really fixing the server operating system so that it is secure out of the box, I would say that 6 months of effort went into making Windows Server 2003 secure that wasn't in the plan prior to the trustworthy computing initiative.
Re:more of the same (Score:2)
It's certainly not the first. [slashdot.org]
Re:more of the same (Score:2, Flamebait)
Why is this considered newsworthy?
On second thoughts...
No kidding! (Score:5, Funny)
NEWSFLASH!: Microsoft invents quality control! source code reveiw measures, internal cooperation among units, standardized enterprise wide security measures! Patents soon to follow!
It certainly makes me wonder what the hell they've been doing all these years, besides making gigantic amounts of profit...
Oh... right, less money on development costs == more profits. Now I see why Steve Ballmer and Bill have been selling off so much stock.
Re:No kidding! (Score:3, Insightful)
Re:No kidding! (Score:4, Insightful)
Not to mention the frequent crashing, loss of data, forced upgrade cycles, etc.
Last, the staggeringly amazing thing is, people seem fine with that. Cripes!
Exactly. No one wants a single thing to go wrong with their car or telephone, but the software we use is acceptable. It's funny/scary to see how many people actually accept and think it's fine to reboot their PC every hour.
Re:more of the same (Score:4, Interesting)
So, here's a rather obvious 1-2-3-profit list
Poppycock. (Score:2, Insightful)
Insightful? (Score:2, Funny)
Re:Poppycock. (Score:5, Funny)
vi commands are not known by your browser. Please use backspace.
Fat Chance (Score:5, Interesting)
The OSS model of peer review on a large scale is the sole reason for such reliable security.
Proprietary companies still have an edge. If people programmed according to a planned set of pre/post conditions, and tested their modules with black box testing, then a large portion of the controllable errors can be caught. Whether or not Microsoft does this is questionable since we can't see their code.
Oh, and BOUNDS CHECK EVERYTHING. Buffer overflow errors should have been non-existant for a half a decade by now.
Re:Fat Chance (Score:4, Interesting)
Let's have a debate at Ask Slashdot. Is it EVER possible to make Windows secure? Not maybe in the same league as Linux or Unix, but even marginally better than what entails now?
The challenges:
1. An integrated all-in-one tightly coupled design - anything breaks, everything compromised.
2. Proprietary standards (if that isn't an oxmoron)
3. Newer OS releases atleast once a year, to break competing code.
4. Newer releases to support existing apps (3 and 4 directly contradict)
5. Code size and complexity - I doubt anyone, even at MS has access, let alone modification rights to the variuos code bases.
Put simply, Mission Impossible.
Re:Fat Chance (Score:2)
I agree - and that's why Microsoft would be best off, for their long-term interests, with a team of software engineers who would redesign the Windows codebase from scratch. I'd bet a lot of the "millions of lines" of code in Windows XP is legacy Windows NT code--in which case MS should take a fresh look at what the code does, if it could be designed more efficiently and securely, and (more importantly) if any other parts of the Windows code actually use it. Of course, such measures would take years and wo
Re:Fat Chance (Score:5, Informative)
Re:Fat Chance (Score:3, Insightful)
Re:Fat Chance (Score:5, Interesting)
Case in point, I was on a team that redesigned an entire large-scale system from scratch. The old system was built in lots of little parts using various languages (shell, perl, java, c++, c, python, lisp), multiple databases from various vendors, had virtually no internal documentation on how anything worked, etc. They system was quite unstable crashing multiple times a day, and very difficult to enhance without breaking shit. Kinda like Windows...
We re-built the entire system in about a year (about 750K lines of code which was about half the size of the original code.) The result was amazing. After the initial deployment period where the bugs were worked out, the system was rock solid being able to stay up for months at a time, was Very easy to enhance, had tones more features and flexability. We had a great team, and a solid commitment from senior management providing the needed resources.
Netscape's biggest problem was not starting over from scratch, but poor project management (not keeping people within original design constraints) and a lack serious commitment from senior managment. Rather than having a very tight set of requirements and design goals, things were very nebulous and got out of control very quickly. No longer were they building a new browser, but a cross-platform framework for any kind of application they could think of. When you look at projects such as Galeon, most of that bloat is ripped out.
Rather than folling a bad example of how to run a re-design project (mozilla) MS could EASILY afford a new team to start Windows from scratch, leaving the existing team in place to continue to enhance / maintain the existing code base. This is the step that Netscape missed. They only used a small fraction of their people to maintain (and NOT enhance) the old code.
Joel is making his claim by using the worst case example. Kinda like if I claimed that you should never put the gas tank in the back of a car pointing to the Pinto as my evidence, ignoring the thousands of other car designs that worked.
Re:Fat Chance (Score:5, Interesting)
They already tried that, it's called "NT". Things got better for a while, then the application mafia got their fingers in and it degenerated back to the current mess.
So they could start that process over again, and be finished in 5 years, just in time to see their stock make the final dive into the subbasements. Or they could learn from Apple once again, and switch to BSD, it's free
Re:Fat Chance (Score:3, Insightful)
About damned time (Score:5, Insightful)
And, yes, please somebody respond to the oxymoronic notion of "business ethics," I'm just begging for it.
I'm suprised... (Score:5, Interesting)
Oh well. as they said - it's a step in the right direction.
Re:I'm suprised... (Score:5, Funny)
Incorrect (Score:5, Insightful)
Pity.
Re:Incorrect (Score:5, Insightful)
sceptic (Score:5, Insightful)
Re:sceptic (Score:5, Interesting)
1. Stuff works. It's the easiest time I've ever had configuring a server. It's like flipping a switch.
2. Stuff is locked down. Everything out of the box is turned off. When you do turn it on, it's locked down by default. Everything runs with the lowest privelege possible to get the job done.
3. Reliable. Nearly anything can be done without restarting the machine. The only exception I've had so far is making it a domain controller.
Frankly, I'm looking forward to working with it in a production environment.
in a nutshell (Score:5, Funny)
Re:in a nutshell (Score:2)
But we do know it will involve cigars....
Re:in a nutshell (Score:4, Funny)
It could work.. (Score:3, Funny)
Hiring Somebody to Do the Dirty Work (Score:5, Insightful)
Now I do not write the cleanest code in the world... but when writing with a group, I can take the time and effort to make ultra clean code--especially if my paycheck depended on it!
Why hire somebody else to do _your_ job?
I've never programmed in a huge group before... so maybe I missing the experience to understand.
Davak
Re:Hiring Somebody to Do the Dirty Work (Score:2)
"Hey, why waste time on those sanity checks, let's use gets(), the security monkeys will clean it up anyway!"
Re:Hiring Somebody to Do the Dirty Work (Score:2)
Re:Hiring Somebody to Do the Dirty Work (Score:3, Insightful)
Where have I seen this before... (Score:5, Interesting)
For the world's sake (Score:3, Interesting)
More Innovation from MS! PeerReview.Net++(R)TM (Score:2)
Yeah, I can clean it too: (Score:5, Funny)
Seriously, though, this is a good step for them, and I hope other software companies follow their good example.
This must be a joke (Score:5, Insightful)
Microsoft is a long way from its ultimate goal where users can take security for granted in its products
This is precisely the problem we have now. People already take security for granted (they don't think about it). Their goal should be to beef up security and to educate everyone about the features so that they become more security concious, rather than just take it for granted.
Re:This must be a joke (Score:3, Insightful)
When in fact it is far from the truth.
This false sense of security is exactly what makes their product very vulnerable.
MS needs to admit the security flaws publicly, loudly, and stop preaching bullshit.
hope this works... (Score:2)
And I can't imaging their top coders rushing to join this team.
Still, it could work...
Taking security for granted (Score:5, Insightful)
Re:Taking security for granted (Score:5, Insightful)
I dunno, two remote holes in 7 years is pretty good. If you want to use slashdot as a forum for anti-OpenBSD trolling, point out that the default install does pretty much nothing, and it's the services that people install anyway that are usually abused (telnet, ftp, etc.). That's more of a point than 'Only one? They probably have two!' which is just blatant trolling.
--Dan
Blimey, they gotta be careful... (Score:5, Insightful)
Fix 1 security hole.
Introduce 100 bugs.
Hmmm.
Slashdot's Microsoft Obsession (Score:3, Interesting)
The trolling editors seem desperate to generate pageviews and posting a Microsoft piece almost guarantees to inflame and troll enough users to accomplish this.
Look at this story...what's really that new or interesting here? This looks like just another opportunity for slashbots and "M$" haters to get their kicks.
The more reasonable readers don't get off on that kind of stuff. Please editors, this is getting old and boring.
Re:Slashdot's Microsoft Obsession (Score:2, Insightful)
You must be new around here...
Here's a tip for you: go to your Preferences and filter out what you don't want to see.
Re:Slashdot's Microsoft Obsession (Score:5, Funny)
You're new here, aren't you?
krystal_blade
But it IS important (Score:5, Insightful)
Secondly, I believe it's very important to keep track of any and all movments of the biggest, richest, most powerful company in the world.
Of the company that controls 95% of the desktop market that Linux might, hopefully, break into.
If they're looking into new strategies, even ones that are years behind their time, we should know about it. When you only look at yourself, you'll sometimes see innovation or monopolism take over while you're busy staring at your shoes.
A company with such terrible operating practices [lindows.com] should be watched closer than any other company, and I'm all for it.
Despite your obvious trolling, I will agree that it might seem a bit much, but I'll tell you, I'm glad we're looking too hard, than not looking hard enough.
I wait for these same comments about the SCO case in a few days.
Re:Slashdot's Microsoft Obsession (Score:2)
Hmm.
1. Get adverts from Microsoft,
2. Run lots of Microsoft stories,
3. Get more adverts from Microsoft
4. Profit
5. Switch Slashdot to IIS
6. Lose profit.
Re:Mod Parent Up - 5: Right On! (Score:2)
I thought this site is supposed to be about the promotion of open source software, and educating the public on its benefits over closed source commercial software.
I thought I would come to this site finding compelling information that would convince me to switch to open source software.
Instead, we rarely see anything but attacks on the competition, and hypocritical attacks at that.
Code audits will help, but... (Score:5, Insightful)
What is really needed from Microsoft is flat-out redesign, and that means breaking a few eggshells.
The most telling bit from this article: "...the majority of viruses written attack Microsoft products..." Yes, it is certainly true that some of them exploit real bugs, but the majority of viruses target Microsoft software design, not buffer overflows.
I'm willing to bet the code audit team members don't have redesign authority; nor should they. Hopefully, they do have easy access to people who can make the design decisions and can raise issues quickly. Necessary design changes are going to break things.
You can audit the code all day and all night and you will end up with a more secure product in the end. But to solve the real problems with Microsoft security, the product needs to be designed with that security in mind.
Some name suggestions.. (Score:3, Funny)
A weak name, I suppose. Some suggestions:
1. Next Generation Secure Computing Strategy.
2. Social Engineering Strategy.
3. Brainwashing Services (BS, for short).
4. Severe Acute Repair Services Group (SARS group)
5. Purity Enhancing Networked Information Services. (figure it out)
You Cannot Clean The Code.. (Score:4, Funny)
The only thing that will save MSFT's code.. (Score:5, Insightful)
ok, i did not mean for that to rhyme, but you get my point. Microsoft is a big self reliant entity that hires like minded people. Thats not who they need reviewing their code. They need objective 3rd parties with real world experience in security and systems. I'm not saying they need to put the code to WinNT on an FTP server for all to see, but loosening their grip a little.
Once MSFT realizes that they dont have to be nazi-esque with their firm grips around their code base, and they can succeed by opening up a little, they will do great things, imho. They havent quite learned that yet..
Re:The only thing that will save MSFT's code.. (Score:5, Insightful)
there are obvious drawbacks to microsoft opening their source, including a large collapse of their main revenue streams and huge impact on their existence as a company. at least, as microsoft is structured now, opening their source is not a good business decision (no matter your feelings on microsoft as a company).
open source is not the software savior it's often made out to be. all software will not be open source. ever. demanding that every software company do just that is both unreasonable and generally unhelpful. we should be demanding that software companies produce more secure, stable, and user-centered software. however each company chooses to do that shouldn't matter, as long as that end goal is reached.
Doesn't look like they'll fix existing code (Score:5, Informative)
Second, there are only ten people on this task force. Will they have enough time to fix the programming methodology for all Microsoft software? Somehow, I doubt it -- and it doesn't take much imagination to guess that the Mac products, for example, aren't likely to be the primary targets, as well as any spyware that Microsoft finds convenient (*cough*WMP
So it's a step in the right direction but I think they need to use more manpower to solve this problem. God knows they have plenty of it. Until they do, across the board, I don't think many of us will ever trust Microsoft's security. (I'll leave the question of trusting Microsoft itself to another discussion.)
-- shayborg
Manpower? More MS myth tossing (Score:4, Interesting)
What is Microsoft's full-time worldwide headcount? Current employment headcount as of 6/30/02: Worldwide: 50, 030
GE operates in more than 100 countries and employs 313,000 people worldwide. Now, that's manpower. Anything under 250,000 is just an excuse to have vending machines in the lobby.
That's pretty funny (Score:3, Insightful)
The way I hear it, most people already take security for granted with MS products.
And are proven idiots.
krystal_blade
Open it up (Score:2, Interesting)
Code Review ? (Score:2)
- Jalil Vaidya
The fearless leader (Score:2)
In other news, (Score:2, Funny)
the horses have run away.
Is that a new mission statement I hear? (Score:2)
And here I always thought Microsoft's "ultimate" goal was world domination...
I mean, that's what I've read here on slashdot...
(cognitive dissonance takes over...)
They must have gotten that statement screwed up...
krystal_blade
Don't be dismissive (Score:5, Insightful)
Think about the success of OpenBSD [openbsd.org]. In terms of security holes it's probably an order of magnitude better than other free operating systems, and Windows. This result was largely obtained through code auditing. If we aren't careful, in a few years, Microsoft will turn the tables on us. The code auditing they've done will have paid off, and we'll have it all still to do (for the typical Linux distribution, OpenBSD is different).
Laughing at your competitors is a risky strategy.
Re:Don't be dismissive (Score:5, Insightful)
Security is not a methodology which you can apply like any other tool -- it is a mindset which has to be cultivated in the original coders AND carried over to the ones who bugfix/test the code.
I am part of this group.. (Score:2)
hmmm... (Score:2)
Microsoft is a long way from its ultimate goal where users can take security for granted in its products
Oh, yeah - that dude is so fired. This is sort of like that moment during the 98 demo that the scanner blue screened the computer while Bill Gates himself was doing a presentation. He had the gall to say "I guess that's why it hasn't been released yet."
I couldn't get over the feeling of how surreal it was to imagine Bill Gates having a single thought about product quality, much less expressing that
I'm telling you again - Hire Theo. (Score:5, Interesting)
Pay boffo bucks, send a Gulfstream to get him and give him some Bill face time.
He'll give you a seminar on code cleaning you'll never forget.
Re:I'm telling you again - Hire Theo. (Score:4, Funny)
Knowing Theo, he'd tell billg to get stuffed.
Suddenly it all makes sense now (Score:3, Funny)
2) Plan to clean up code.
All they have to do is start swapping files.
April Fools? (Score:2)
Can you spell political? (Score:2)
Taking Secuirty for Granted. (Score:3, Insightful)
Personally, I do not think that security should ever be taken for granted. I think it has been proven that this lax security awareness leads to problems independent of the software (e.g. stolen credit card numbers and identity theft from insecure websites and to a lesser extent the proliferation of spam). Most people do not take the locks on their front dor for granted, why should the computer be any different. Especially now that many individuals use the computer as the primary portal to the outside world.
What was that name again? (Score:3, Insightful)
According to the article, the new group will be called outa'sync (um, no, wrong article. Hang on. Ok). The new group will called the (drum roll, please):
Anything group that has the word "strategy" in it will spend their time writing memos about how this piece of already written code could be better.
These memos will then be ignored by everybody so they can meet their deadlines.
odd timing. (Score:5, Insightful)
Here's something to worry about. Does the timing, that the U.S. Gov just instituted a new position for this (the cyber-security chief) which I have already commented on here [slashdot.org], seem odd to anyone else?
This looks remarkably like the same type of handwaving smoke and mirror show that the government is trying to put on. "look at us, we're doing something(tm) about security!
makes me wonder if this is microsoft's way of making sure it has a chance to influence what the gov. considers secure.
Microsoft will get it right one day... (Score:5, Insightful)
Windows 3 was crap.
Windows 95 is unstable.
Windows 2000 Server is insecure.
If they progress as far in the next decade as in the past decade, they will be delivering stable, relyable and secure servers. If that happens I dont see Linux based systems able to offer too much competition.
its easy (Score:3, Funny)
Re:Port to Java! (Score:5, Funny)
Re:Port to Java! (Score:3, Interesting)
Methinks you're a disgruntled C programmer feeling the world's leaving you behind.
Get with it - there's tools for every job - pick the one that works best.
My original point was made in humor partly - but the main point was that normal security exploits attacking buffer overflows, for example, are a non-issue in my 'interpereted
Re:Port to Java! (Score:2, Interesting)
and everything works perfectly*.
*Perfectly is taken to mean "Works about right as long as that system has the same brand and minor revision of the JRE"
Seriously though, every Java based piece of software we have looked at has been total crap. Many of them require a certain runtime, such as one web service from a major company we looked at, that only works with Apple's runtime. Other's only work with MS Java runtimes. The list goes on.
Re:Port to Java! (Score:3, Informative)
Nope, don't think so... I develop on 1.4.1, and my stuff runs fine on 1.2.2 and up.
Re:Port to Java! (Score:2)
Did you stomp your feet when doing so?
If it cannot be programmed with a real language, I don't wanna do it.
Oh, that's brilliant. Do you tell your management that?
Re:Port to Java! (Score:2, Insightful)
Coorporations believe in a lot of things, and miss a lot of other things in doing so.
In the early 90's, everyone expected Unix to collapse and NT to take over the server market. A decade later, Unix market share has grown via. Linux and NT is in the minority on the web.
Microsoft believed in MSN and almost completely missed the Internet revolution.
Sun believed in NeWs and X stomped it into the ground.
Sun al
Re:Clean Code? (Score:3, Insightful)
Re:This proves it! (Score:2, Insightful)
Fool me once, shame one you
Fool me twice, shame on me
Fool me over and over and I must be the IT selection manager/commitee/group at a fortune 500 firm.
Anyone remember Douglas Adams' concept of the SEP field generator? It generates a sense that something is Someone Else's Problem and people's natural predisposition to overlook it makes the something in
Of course you know.... (Score:2)
Forever is the release date.
;-)
Re:Linux (Score:2)
Oh c'mon. This is one horse that's been flogged on /. a million times already. Most attacks aren't directed at desktop users (though those are the ones that get the most publicity) but at servers. And that's one market which MS certainly doesn't dominate. Why are there still far more attacks directed at MS products? Do you really think the frequ
Re:Linux (Score:2)
On the other hand, most servers on the 'Net run Apache; but most servers that are compromised via software bugs are Microsoft IIS servers. Go figure.
Re:Don't Stow Thrones in Grass Houses (Score:3, Insightful)