02.07.10
Another Misdirected Response from the Government to the Company “Not Engineered for Security”
“Our products just aren’t engineered for security.”
–Brian Valentine, Microsoft executive
Summary: Another terrible month for Microsoft insecurity and the government is still unable to respond sensibly to the threat
YESTERDAY we wrote about Microsoft's lobbying for an Internet "Driver's Licence" policy. Rather than blocking the real culprit (Windows) it might only block BSD and GNU/Linux. More importantly, it would resolve absolutely nothing for the reasons just explained by Mike Masnick:
And an internet driver’s license is even more ridiculous. Unlike a car, the internet is something that people have to use all the time. No driver’s license is going to stop people from getting suckered by scammers.
Exactly. And what does the US government do? Rather than mimic Australia’s plan to ban many Windows machines [1, 2], the US government throws some more money into “research”. US taxpayers will once again pay for Microsoft's incompetence, just like in Germany.
The US House of Representatives has overwhelmingly passed a bill that would direct almost $400m toward research designed to shore up the nation’s cybersecurity defenses.
Microsoft’s software will never be secure. Microsoft itself has admitted that its “products just aren’t engineered for security.” Based on the news, there is yet another Internet Explorer flaw:
CURSED BY ITS HAIRBALL CODE, Microsoft has released another security warning relating to a bug in Internet Explorer.
There have been so many such flaws recently [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12] that it’s hard to keep track of which is which. Many are highly severe and there was also an IE flaw reported just the day after Microsoft had released an emergency IE patch (for a flaw it knew about and willingly ignored for almost 6 months, demonstrating Microsoft’s negligence [1, 2, 3] and infinite arrogance).
Based on CNET, Microsoft is to bring patches for no less than 26 holes next week:
Microsoft will patch 26 holes next week, including critical ones in Windows, one affecting the kernel of 32-bit versions, and several holes in Office, the company said Thursday in a preview of its Patch Tuesday.
That’s just a lower bound though. As we already know, Microsoft is patching many flaws without even telling the public in order to embellish its public record. This is a company of systematic liars, a company that is unable to make secure software, let alone patch it in a responsible (and timely) fashion. Had the government tried to resolve its security issues, then it would impose and use greater pressure to move to UNIX and Linux [1, 2]. █
Jose_X said,
February 7, 2010 at 10:03 pm
Anyone know who is getting what fraction of the $400 cybersecurity money? If Linux is represented, then a “drop Windows wherever possible” as a solution might get proposed. Is the MS related cyberchief (iirc) in charge of accepting proposals?