Posted on 05/22/2002 6:49:45 AM PDT by NativeNewYorker
The cat is out of the bag. During testimony before a federal judge, Microsoft executive Jim Allchin has admitted that some code critical to the security of Microsoft products is so flawed it could not be safely disclosed to other developers or the public.
Allchin was arguing against efforts by nine states and the District of Columbia to impose antitrust remedies that would require Microsoft to disclose its code. He constructed dire scenarios of U.S. national security and the war against terrorism being compromised if such disclosure were required.
Now turn this around. Allchin has testified under oath in a Federal court that software Microsoft knows to be fatally flawed is deployed where it may cost American lives. We'd better hope that Allchin is lying, invoking a "national security" threat he doesn't actually believe in to stave off a disclosure requirement. That would merely be perjury, a familiar crime for Microsoft.
If Allchin is not committing perjury, matters are far worse -- because it means Microsoft has knowingly chosen to compromise national security rather than alert users in the military to the danger its own incompetence has created. Implied is that Microsoft has chosen not to deploy a repaired version of the software before the tragedy Allchin is predicting actually strikes. These acts would be willful endangerment of our country's front-line soldiers in wartime. That is called treason, and carries the death penalty.
Perjury, or treason? Which is it, Mr. Allchin?
There is another message here: that security bugs, like cockroaches, flourish in darkness. Experience shows that developers knowing their code would be open to third-party scrutiny program more carefully, reducing the odds of security bugs. And had Microsoft's source code been exposed from the beginning, any vulnerabilities could have been spotted and corrected before the software that they compromised became so widely deployed that Allchin says they may now actually threaten American lives.
Thus Mr. Allchin's testimony is not merely a self-indictment of Microsoft but of all non-open-source development for security-critical software. As with many other issues, the legacy of 9/11 is to raise the stakes and sharpen the questions. Dare we tolerate less than the most effective software development practices when thousands more lives might be at stake?
Closed source. Who dares call it treason?
When I first heard of this, I thought of this story from Sep 3, 1999.
Andrew Fernandes of Cryptonym in Mississauga, Ontario, has investigated Microsoft's "CryptoAPI" architecture for security flaws, and found that in WindowsNT4's Service Pack 5, the company neglected to remove annotations identifying the security components, according to a Cryptonym statement. Apparently there are two keys used by Windows, one of which belongs to Microsoft and allows the secure loading of encryption services, but the second was annotated in the code with the letters NSA. Fernandes' investigation was building on the work of encryption experts Nicko van Someren and Adi Shamir, according to the company statement.The holder of the second key, if it is indeed the NSA (the acronym by which the National Security Agency is often referred), could easily load unauthorized security services on any copy of Microsoft Windows, according to Cryptonym.
Although in fairness, maybe MS' code just sucks and there is no nafarious plot :)
/john
If you'd ever seen MS code, such as that in Windows CE, you'd understand why they want to keep it all secret from not only the public but developers as well. One word: pedestrian.
It is well-established law that the seller is responsible if he knows of a significant risk, conceals it from the buyer, and the buyer could not reasonably know the risk on his own. All three conditions would be met here (unless, of course, Allchin is perjuring himself).
M$'s flaws are glaring. No one needs to see the source code to know that. I won't employ M$ products in any mission critical positions within my business, so why should the government?
/john
That said, if I were running a large commercial/govt enterprise where security and stability were central issues (as opposed to interoperability with 99% of my vendors) I'd choose Linux without a second thought.
Why the govt would use an insecure, unstable OS is beyond me.
Against the Dead Hand, by Brink Lindsey and Basic Economics, by Thomas Sowell.
You may find answers there.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.