IT Employment

Ask something
Discussion Locked

Will Windows source code help security?

0 helpful
11 replies

by debate

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Do you think Microsoft's limited release of Windows source code will help the company find and fix bugs? Has your company considered moving to open source to bypass Microsoft's notorious security issues? Tell us what you think about the quality of Windows security, as featured in this week's Internet Security Focus e-newsletter. Than, rate the helpfulness of this column from 1 to 5, with 5 being the highest.

11 replies

by kurt

Microsoft has long maintained "privileged" shared source
code with specific vendors, principally those involved
either in device driver production or a few large business
customers that they felt they needed to keep happy. This
program is not a radical departure from that concept, save
that it opens up the source code to the IT managers of
specific countries rather than companies.

It is worth noting that such a program sounds like a serious
move on the surface, but there are still a number of
significant caveats that render this more as a marketing
move than any significant change in policy.

1) A governmental entity may see how the code is written,
but has no ability to alter that code in any way save by
including it in a customer wish list that may, possibly, end
up in a patch. In other words, even if a bug is found, the
entity can do nothing directly to change it.

2) There is no guarantee that the code that they see is in
fact the code thataffects the product, nor is there
necessarily any guarantee that the code involved may be
considered a Windows product rather than Windows itself
(such as MS Office) and not be included with the
distributed code.

3) The people who are given access to this code will be
under strict NDA concerning informing others about the
code, and may not use this information to create similar
products elsewhere. Nor can they compile the code from
the codebase.

As such, the gesture has some meaning, but not a huge
amount. If the cost of engaging in this practice comes that
the countries involved must forfeit their rights to utilize
open source development (and I have no doubt there is
something to that effect in the contract) then the cost is too
high for the value that they will receive.

Ultimately, I suspect that Microsoft will discover that it will
need to move to a model wherein it open

by kurt

Ultimately, I suspect that Microsoft will discover that it will
need to move to a model wherein it opens up .NET to the
same level that Java is currently opened (or more), with an
active community process akin to what Sun currently
utilizes.This will in fact be good for Microsoft in the long
run, as it will cause many of the developers that are now
abandoning it to return to the fold, will improve the level of
trust that people have in the code, and may even spur a
new explosion in .NET windows development and a much
needed boost to get the industry revving again.

Note that this process does not even need to be free,
though that would help. By making the SDK and its sources
both available via a subscription service Microsoft would
probably still make developing with this code palatable
even though any fees they place on it will act as something
of an impedence.

The Linux GPL works by creating a disincentive to outright
theft ... if you create an application that utilizes GPL'd code,
you basically make that application (or in LGPL, the part of
the application that utilized the code) GPL. This has been
upheld in court as valid and enforceable. Perhaps it would
behoove Microsoft to examine their current licensing
models and see if in fact a MPL consonant with a Microsoft
community development model could be used to protect
their IP investments while simultaneously making the source
(and the ability to compile the source) available to that
community. This, and in likelihood, only this will likely stem
the juggernaut that Linux is becoming to them.

by lotta_anger

M$ has been working on this code since whenever nt made its debut. The problems with this os are in the original concept and they need to start fresh with os's that are targeted to users not to some general concept that all users are essentially thesame. As for the source code of the current abomination the borg summed it up best "that is irrelevent"

by fachtopia

I would like just to say, that as well as, some other person stated that is a loss cause. M$ has lot of problems since OS design structure. And, unfortunately, for them, Linux has proven to be more reliable, secure, and stable as well as give goodperformance for less architecture. In general those are the features that Co. look in the process of production.

Nowadays, apart from those issues, M$ is totally expensive and unbeliable that they ask for more money in licensing.

Finally, to pay more and more, is not exactly what companies are looking for.

I'm Linux admin for a long time, I don't have complaints

Cheers

by jah_1

Why would programmers devote their time to fix M$ code for free? One reason Linux is fixed so readily is that some good can come out of it by sharing the code with others free of charge. Fix M$ code for free just to have people be forced to buy the upgrade is a totally different mentality than that of the Linux community. I don't believe it will win back any loyalty from x-M$ users.

by mpapacon

Re: "Paying too much"

I think this responder's succinct comments hit the proverbial nail on the head.

by teprice

Imagine what will happen after the source code leaks (and it will if government gets its hands on it) and rather than good citizens offering fixes, the opposite happens....

With an open play book coming (like open source has had) everyone may want to step up the migration away from Windows to stay ahead of the mass of security breaches that are undoubtedly coming.

by lrund

No one is going to freely help Micrsoft with their coding problems. But allowing vendors access to the code will help the third party vendors to develope systems that interface better with the OS.
Back in the start of the mainframe era (60's and 70's), IBM was facing the same monopoly problems that MS is facing now. IBM in their wisdom, volunterily supplied the source with every license to stop the lawsuits.
It seems like every new generation does not learn from the previous and we keep having to play the same record over again about every 20-30 years.

TBN

by ron larson

Since M$ announced moving 350,000 to india including programers, developers. We don't have to worry about security Everyone will be able to access everything. Kind of scary if you ask me

by mrockwell

Bravo, and I agree. However, training vendor centic shops to work with Open-Source will, no doubt, be an interesting evolution to watch.

by smckay1128

The most significant reason we know so many of the security features in MS operation systems is because of a business term, Return On Investment. I for one will not spend time developing a security feature exploit in some obscure OS when I can exploit a security feature in one of the worlds most prolific OS.
Keep in mind, if it was not for DOS and MS Win, the PC would still be a tool of the elite engineer and not something of which almost every home in the US has one of and every home in Canada has two of, connected in such a fashion that disreputable "feature" exploiters can access with little or no effort on their part.
As for the open source OS, I understand you can get any number of free OS downloads from any number of sites, pre-configured with all the security features already exploited, how convenient.

This discussion is closed to new replies.