Why Microsoft will never make Windows as secure as Linux or MacOS X

[benburch]

Because too few eyes look at Microsoft's code!

Microsoft has a code base they guard jealously, and which few people see all of. Worse, even they do not know what much of the code is supposed to do! (I know this from many conference calls with them while working on a USB WinModem driver a few years ago.) There is basically no way to validate all of that code against stack overrun attacks or to insert code to do bounds and range checking because they are mortally afraid of breaking it and so breaking software that people already own and expect to have run. And they would break software because that software often depends on the bugs, intentionally or not, in order to do what it does! See, the lack of support from Microsoft for developers on obscure features means that people explore the code's operation for themselves, and if they find a way to use it and make happen what they want, they do it. This has the effect of locking-in mistakes in the code in such a way that fixing them makes everything break. And Microsoft often patches things by masking a bad behavior. They don't remove the offending code, which they don't understand, they just layer some code ahead of it (a head patch) or behind it (a tail patch) to fixup the mess that they need to fix up, and simply cannot be sure that they have made it work except in the one case of the bug report they are working on at the time. This is why Microsoft so often has to patch patches.

MacOS 1-9 was in a similar bind. People could and did explore the code for themselves and would make use of unpublished features!

Linux, BSD, and Darwin (the BSD-derived Microkernel OS upon which MacOS X is based) are open source code. Anybody can look at the code. Anybody can contact the developers of the code. And anybody can submit a bug fix with the expectation that it will be in the next release if it makes sense to the maintainers. And the code is criticized extensively by developers and so gets stronger with each release. There is not a single line of code in any of those that is not understood and which cannot be changed if an exploitable hole is found. Moreover, patches for holes come more quickly from such a process than they ever could for the Microsoft code base.

Even the Mac OS GUI API, Cocoa, and its little brother, Carbon, are far more open than the MS code base. And they have APIs where undocumented features are discouraged and where the developers are trained not to depend on them. And they do not need to depend on any of that because Apple is responsive to developers in the construction of those APIs, so nobody needs to grope in the dark to get something done. And because the APIs are clean, the underlying code can be changed at will as long as it passes the qualifying tests for the API without breaking any user applications, and so any hole that is discovered can be closed quickly and efficiently.

[sendero]

1. Not only that..

.... but Microsoft coders are mostly hacks. Crap like buffer overrun exploits are only possible if you write kindergarten code.

You cannot add security to a piece of software after it's built it, that's like trying to add quality. Either it is designed in from the start or it will never happen.

Supposedly the new "vista" OS was rewritten from scratch, but somehow, knowing how software development is actually done, I have my doubts.

[Atman]

5. Vista has been delayed -- again -- even after MS stripped out features

Vista is going to be another MS disaster. They're trying to write in OSX features, but they've delayed its release for so long that Apple will be on OX Brazillion by the time MS releases it. MS knows they're fooked. They announced a release date they couldn't possibly meet, missed that, so then stripped out half the features and announced another release date they'll miss.

Knowing MS's past behavior, even the recent announcement that malware had overtaken them, and users should just re-install from the ground up, sounds like a marketing department ploy to scare people into pre-release sales of Vista.

Anyone who is an early adopter of Vista would be nuts.

[sendero]

14. "Anyone who is an early adopter of Vista would be nuts."

Hehe, anyone who is an early adopter of anything MS has ever done was nuts.

I've been with PCs since the very beginning, and used most of MSs products. The only stuff they've ever done that wasn't a crashy, buggy piece of shit is their development tools. Visual Studio is a decent program, used it for years and it's pretty solid.

Why corporate America puts up with Microsoft is beyond me. Just another example of the general lack of vision corporate America is infused with...

[harpo]

27. actually its the opposite...if you don't get involved early you are nuts..

you can get all YOUR issues fixed early :)

[400Years]

2. all the legacy compatibility has rendered windows to unwieldy to manage

I was reading about this last week.

They had to shift the release date of Vista back because of their inability to finish it.

[harpo]

17. and their delay is bad....why?

Isn't it a good idea to delay a product when it isn't ready? Or would you rather they ship a version that isn't ready....you know like Linux.

[northzax]

44. it's not the delay that's the real issue

the real issue is the reverse compatability requirement (the legacy deal) they'd be better off scrapping everything before XP and moving on. It's what Apple does, if the demand for the programs exists, people will rewrite.

[harpo]

46. there are lots of corps who care about legacy...and they pay $$$$$$$$$

[400Years]

83. you've completely missed the point

Microsoft admits windows is getting to the point where they can't manage it anymore.

It has nothing to do with what I want or don't want. Facts are facts.

[benburch]

84. Exactly!!! nt

[stepnw1f]

3. This Is What Was Explained to Me Before

And by using the PC for graphics mainly, I have seen some whacky stuff happen. Anyway... I'm happy with OSX. It's the way to go for aveage users who want stability. Problems here and there get fixed pretty fast with OSX.

[SnoopDog]

4. All they would have to do is to change the c compiler...

Most compilers cause exceptions when you try to move more data into an array than the size of the array.

Like putting 10 pounds of potatoes into a 5 pound sack - can't do it and an exception is raised...

[benburch]

6. Some software breaks when it cannot overflow bounds in Windows.

Thats the big problem. Things that worked before stop working when you do that.

[SnoopDog]

18. That is the most ridiculous programming technique I ever heard of...

For a programmer to count on buffer overflows is stupid and indeed is why their software sucks. No programmer worth they keep would ever program that way.

[benburch]

24. Indeed!

But usually they are not aware that they are overflowing anything. Rather, this has always worked and they just assumed that it was correct. And to change it now would result in many, many legacy applications (some no longer in production) failing at once. From a user's point of view, this would be a bug in Microsoft's OS, rather than a bug removed from it.

[davidwparker]

8. A previous post said they were rewriting it. Might they have started

eating their own dog food by writing all but really low-level code in C#?

Personally, I don't care what they do since I use OS X personally and develop for Solaris mostly at work.

edit: spelling

[alfredo]

16. I read it was a 60% rewrite. They are pulling people off Xbox

development to help out.

[Beelzebud]

29. Turned out to be an internet rumor..

Shocking.. A rumor on the net. :D

No one was pulled from the xbox360 to rewrite Vista. That doesnt' even make any sense...

[benburch]

34. Agreed that makes no sense.

xbox OS was totally different (and does not need to be secure in ANY way.)

[alfredo]

39. It did seem counter intuitive. The Xbox is probably a bigger

revenue source right now.

[old_techie]

11. Right

Ada, the DOD language had strong typing since 1983. You cannot assign one type to a different type even if they happen to be the same size.

[harpo]

43. if its so easy then why hasn't someone written and told them?

Or better yet written your own c compiler...

[SnoopDog]

74. So, you think I should write a c compiler?

And that will solve the problem?

[longship]

7. More than that.

Another issue which has recently come up is Microsoft's insane adherence to legacy support. Windows XP still supports code libraries for the old legacy 16-bit Windows. These libraries are undoubtedly littered with code written in a time before Bill Gates finally acknowledged that the Internet was an important force. Both Linux and Darwin were written with a presumption that the computers were to be globally connected.

All that legacy code is a ball and chain on Windows OS.

[kenny blankenship]

9. Having chronic security holes is necessary

to sell the next version. CLose some holes as they're exposed, but never all of them--never redesign to prevent new exploits from being discovered. Then when it's time to steal everybody's money again you say the new version will be secure! and refuse to patch the old ones after a minimal period to push everyone to the newer, but also strategically insecure product. The wonderful logic of monopoly capitalism.

[Feron]

37. Isn't MS also going into the AV biz??

I think it's called OneCare or something like that. From what I understand, it will be a paid subscription so that would give MS even more of a profit motive to peddle buggy software.

Personally, I switched away from Windows partially because of DRM. With Vista on the horizon, it sounds to me like Microsoft is trying to lock down your PC for "security" and "piracy" reasons. Schemes like the Sony rootkit are another reason. Perhaps I spend too much time at Slashdot, but I want sole control over my computer.

[harpo]

10. Well that's sure a subject that's open to debate and not set in stone...

Rackspace...
mms://wm.microsoft.com/ms/windowsserversystem/facts/videos/Rackspace/GTF_Rackspace_300k.wmv

Forrester...
http://www.microsoft.com/windowsserversystem/facts/analyses/vulnerable.mspx


Obviously someone disagree's with the premise of this thread.

[WillyT]

12. LOL... Just Google 'Problems With Windows XP Service Pack 2'...

All sorts of complaints.

Microsoft itself has a long list (on it's knowledge base pages) of what can go wrong when you install SP2.

IBM has supposedly forbidden their IT people to install it.

And the "fix", SP3, is not supposed to be out until mid-2007!

:wtf:

:banghead:

:crazy:

:shrug:

[harpo]

41. No one said a "fix" is sp3....that's a bunch of horseshit...

and if you can find a documented problem where Microsoft says it will be fixed in sp3...than I sure would like to see it because you won't.

[WillyT]

54. I Said It... Cause I Assumed That If SP2 Was Such A Fuck-Up...

then surely they'd wanna correct their errors with the next Service Pack.

Am I wrong to assume that?

:shrug:

[harpo]

68. Yes, assuming is bad...xpsp2 is great, instead of saying there

are a bunch of issues with it..how about list the issues YOU ran into...generalizing by saying this sp is crap, well that's a pretty WIDE net don't ya think?

[WillyT]

75. Sorry Man, Didn't Realize You Worked For Microsoft...

Link: http://www.google.com/search?hl=en&q=problems+windows+xp+service+pack+2&btnG=Google+Search

Link: http://support.microsoft.com/?kbid=842242

Link: http://www.crn.com/sections/breakingnews/breakingnews.jhtml?articleId=23905071

Link: http://software.silicon.com/os/0,39024651,39123000,00.htm

Enjoy!!!

:evilgrin:

[harpo]

77. so these are random problems and none say sp3...what's your point?

Did you specifically run into these problems? What programs stopped working, etc?...see my point?

Oh and you are assuming again.

[WillyT]

78. I'm Still Trying To Figure Out Your Point...

From Microsoft: http://support.microsoft.com/sp

Service Packs

Service packs are the means by which product updates are distributed. Service packs may contain updates for system reliability, program compatibility, security, and more. All of these updates are conveniently bundled for easy downloading.

****************************************************************************************************

Now why would one need an update for their system reliability, unless their system wasn't quite reliable?

Maybe we're arguing semantics here, but I consider such updates a 'fix'. You might consider them an 'improvement'. Either way, it takes what was, and makes it better.

And my reference to SP3 is hoping for those improvements to be included there. The problem I had, was with a USB Wireless Network Adapter. Was working just fine until I installed the XP updates from the Windows Update site. Did a restart, and poof the machine did not recognize the adapter. Reinstalled the adapter software (and BTW, you have to go through all sorts of conniptions for XP as opposed to Win 2000), but kept getting 'Cable Unplugged' messages. Finally fixed that, but kept getting 'Low or No Connection Present' messages.

Now this adapter went in and worked lickity-split with both Win 2000 and Win ME, AND XP SR1. It wasn't until I installed SP2 that everything went to hell. So...

Hoping that SP3 might have a fix for such a problem, I went to see when it would be coming out. Turns out, not until 2007.

Link: http://www.microsoft-watch.com/article2/0,2180,1911773,00.asp

And the story that IBM was telling it's IT Managers NOT to install SP2 (confirmed or not) says volumes.

:shrug:

[Crazy Guggenheim]

58. I've installed SP2 on many peoples machines and have not had

a problem. One thing is have as many background apps turned off as possible. Make *sure* to turn off the anti-virus and firewall. One other thing is to download the Developers Version of SP2. It's better than the standard package. You can save it to CD/DVD and use it later.

:popcorn: :popcorn:

[Beelzebud]

13. Great, and when those other OS's do as much, let me know.

I tried out Linux over the past week, and everything I want to do I either have to recompile my own damn install to run it, or dual boot back to windows.

It's not there yet for what I use my PC for.

If I ran a server, or used it strictly for business apps, it would be fine, but I likes me some entertainment.

One thing that will not get people to make the switch: Pretentiousness.

When you have to read for 2 hours to figure out how to just install video drivers for Linux, I'd say it isn't quite ready yet.

Security isn't everything to me, I don't run servers.

[harpo]

15. I run servers...I choose Windows

[benburch]

20. Dear gods! Why?

I cannot imagine anything that would make me choose Windows on a server unless there was an application that HAD to have Windows that I was forced to use.

[MyNameGoesHere]

21. Because most

"other OS snobs" don't work for companies that purchase Windows Server. I rely on them for a paycheck to maintain the IT infrastructure. So surely an "Other OS snob" can figure out why people use windows?
Oh and BTW I have enough skill to maintain any OS. Not only Windows.

[benburch]

22. Well, then you are forced to use it.

Would you choose it if given the choice?

And I'm no "Other OS snob"; I and a Windows driver writer. As a result of this intimate experience, I know Windows far too well to ever trust it.

[MyNameGoesHere]

23. Forced is a harsh

statement. I have to weigh many options and criteria before I suggest or implement anything. I am not bound by one system over another. Now the real deal and always has been bottom line. I don't buy the systems so the person with the cash is the final decision maker in ANY IT environment. And if I had my way I would rather have system admins that work, instead of those people that sit around and bash Windows. In othre words, it's my job to make it work regardless of the system or OS.

[harpo]

25. It works...its secure...its more cost effective...and I like it!

[benburch]

28. More cost effective how?

I fail to see how Windows server/IIS is more cost effective than a BSD or Linux system with Apache?

Educate me here?

[harpo]

38. It just is...I've done the math for my environment...

I know some folks will never be convinced that Windows is cheaper overall but that's how it is for me.

[benburch]

47. Wish I could see that analysis!

Because it makes no sense to me!

[IsIt1984Yet]

49. Do you run a network for a mid to large scale business or

is your experience mostly with your web page?

[benburch]

55. Used to run networks...

But years and years ago. I know the five servers I run, which serve 90 GB of data on any given day not including the live streaming, have been far more cost effective for me with Debian Linux/Apache than Windows Server/IIS could ever be!

[IsIt1984Yet]

56. Microsoft has come a long way, ben.

Seriously, it's an amazing company. Admittedly, I am an MS "groupie" and I am NOT ashamed of it. They are an amazing company with amazing people and the Gates Foundation and Bill's general vibes of philanthropy make me altogether warm and fuzzy about MS. I've met several dozen MS employees - just in the past week and a half. Developers, marketing reps, product managers, executives - every one of them incredibly helpful and accommodating. I think Microsoft is a great company and I am proud to use their products and work with their people. Spring for Deluxe Support with them - it's well worth every dime.

[benburch]

59. I was soured by how they treated my dear friend long ago.

Destroyed his business with legal threats based on lies to the court.

And I know how he screwed Paul Allen out of a lot of his stock.

The Gates Philanthropy started the minute the antitrust cases heated up, so it does not give me any sort of warm fuzzy.

[Crazy Guggenheim]

62. Ben, I have to agree with you on that! Gates had only given away

$100M by 1999 - I think - and it was mainly software donations to schools.

:popcorn: :popcorn: :popcorn:

[benburch]

65. Which actually cost him MAYBE 5% of that. nt

[IsIt1984Yet]

63. It must suck to be so cynical. $28BIL to US Education and world health

is certainly a phenomenal contribution. Seriously, who are you to question the motives of that kind of charity?

You know the story about how much money he's trusted to his kids, don't you? And, the rest will go to the foundation.

I obviously can't comment on your friend's case as I know nothing of it, but we'd be in a very different world right now if it weren't for MS. I think the Linux geeks are jealous because it's a far cry from the exclusive 'club' it used to be. Microsoft came in and changed the world. And - guess what? They are turning a great deal of profit into amazing causes. Does Apple to that? Or Red Hat? Or, the Waltons? I don't understand how anyone can't have some sense of respect for that. But... whatever.

[Crazy Guggenheim]

64. I heard that Gates might "die broke" in that all the $ will go to charity

except for $10M to each of his kids. Could be a rumor.

:popcorn:

[IsIt1984Yet]

67. TWENTY-EIGHT BILLION to the Gates Foundation.

And, I got to see/hear him speak last week. If you've every seen him speak of the charity, it's clearly from the heart.

I heard the same thing, and based on his previous actions, I don't doubt it. If true, you know the trusts have been set up and are probably accumulating interest as I type, and that there will likely be assets and property that the kids will get... but I think he intends to will the bulk to the foundation. And... I find that awesome. Absolutely awesome.

http://gatesfoundation.com/default.htm

[benburch]

72. An impressive amount of money to you or me.

Nothing to him.

[IsIt1984Yet]

73. NOTHING?!?

Whatever. Like I said, must suck to be THAT cynical... to be that much more rightous and worthy than everyone... to have the ability to read into the motives behind the charitable actions of others.

How self-serving of him to donate that money, huh? The same could be said of ALL charitable contributions, financial or other. We help because it makes us feel good about ourselves.

Well, some of us do. Others tear down others and judge others to make us feel better.

[benburch]

79. But I am not cynical.

I just know that criminals often do such things to assuage their guilt.

Alphonse Capone opened soup kitchens during the Depression. In fact, he ORIGINATED the concept of the soup kitchen. Without a doubt he kept many from starvation. The idea that milk should have a spoilage date on it at retail sale was his, too, and came from his deep love for children. He thought of himself as a benefactor to mankind. But he was a cold-blooded killer.

Do I think I am morally superior to Al Capone? Yes. I do. Don't YOU think you are morally superior to Capone? Or is this more of my cynicism talking?

[benburch]

69. Rockefeller only started giving away money...

...when the heat was on too. Now, the Rockefeller Foundation was a great thing, but that does not mean that Rockefeller himself was anything but a robber baron.

Bill Gates destroyed many people on his way up. Nice of him to give back some of that, but, like Lady Macbeth, no amount of washing will rid him of that damned spot.

[IsIt1984Yet]

71. Ah jeez

:eyes:

[harpo]

70. well if you worked for me then maybe you would...but since you don't

forget about it

[benburch]

19. A LOT depends on which distribution of Linux you use!!!

Some make you do almost everything from scratch; Gentoo and Slackware for example

Others do almost everything for you; Unbuntu and Knoppix fall into that camp

They are not all the same from a user experience or installation experience whatsoever.

So, what did you pick?

[Beelzebud]

33. I tried out Madriva and Red Hat's free distro.

I'll have to look into Unbuntu and Knoppix. I like the desktop environment, but I was literally beating my head off teh desk just trying to do simple things like install drivers, and flash for firefox...

It just seems too user unfriendly still. I'm no dummy, I can figure it out, but at some point I always ask myself: "Is all this trouble worth it for what little I'll do with the OS?". I always reach the conclusion of "no".

[benburch]

35. Lots and lots of good information here.

http://distrowatch.com/

[Beelzebud]

36. Thanks, I'll have a go at it again this weekend.

[Crazy Guggenheim]

53. I don't generally like Linux but try Ubuntu!! It's easy to install and I

think they got it right!

:popcorn: :popcorn: :popcorn:

[Beelzebud]

61. I'll try it out first! :) ty for the suggestion

[FormerDittoHead]

76. Second on the Ubuntu.. then third for Suse...

I found Fedora TERRIBLE! There's a known bug in the INSTALL, for crying out loud! (the CD crc check) - had hardware detection errors (Redhat 9 was BETTER!)

I use Ubuntu on my HP notebook - it was the only distro that detected my wireless PC card AND got it to work right out of the box.

...Novell Suse has good corporate support options, so I might invest some time there, if you're so interested...

[Beelzebud]

80. Just downloaded the DVD ISO of ubuntu. Will give it a go ASAP.

[benburch]

81. Isn't broadband great?

I remember downloading my first Slackware distribution via a 33.6 modem... Took a weekend.

[Beelzebud]

82. LOL yeah, typing something like "just downloaded a DVD ISO" is still fun!

:)

[LSK]

26. because the hacker community loves linux and hates microsoft

[Beelzebud]

30. The elephant in the middle of the room is revealed.

So true. LOL

[benburch]

32. I disagree.

See comment below.

[benburch]

31. I think that black hat hackers play no favorites.

They are in this for monetary gain, largely, and would attack anything that they could.

And as a hacker of the old school, where the word hacker meant "systems internals wonk", I detest the word "hacker" being used to mean a criminal computer vandal.

[harpo]

40. they are in it for exposure and bragging rights, not money

and because of this mentality they go after the one that will get them the biggest headlines...Windows!

[benburch]

42. Not the ones I have tangled with.

They wanted corporate charge card and other information for sale. Likely they were from some country where the law doesn't much care that they do this. We never figured out who they were, exactly, but we got a ransom note saying they would stop if we paid them. We didn't pay them, and shut them down by changing the systems to BSD/Apache - They just gave up trying to get in when we did that.

[IsIt1984Yet]

51. Ding! Ding! Ding! That and look at the install base numbers.

Why hack to such a small percentage of installs?

[Swamp Rat]

45. yep

:thumbsup:

UNIX roolz! ;)

[Crazy Guggenheim]

48. Linux sucks ......

:popcorn: :popcorn: :popcorn: :popcorn:

How ya doing Ben?

[benburch]

50. Doing great!

Oh, and, loved that graphic you did!

[Crazy Guggenheim]

52. Which one? The Moran or the Admins?

:popcorn: :popcorn:

[benburch]

57. The Brazillian Scream! nt

[Crazy Guggenheim]

60. This one? EP did it.

I did this one.



And - not as good though - this one. BTW, I did get the ok from Skinner to use the photo.

[benburch]

66. Ah! OK.

I was confused!!!