10.20.10

Gemini version available ♊︎

Bruce Schneier: “Keeping Control of Your Source Code Didn’t Magically Make Windows Secure”

Posted in Security, Windows at 12:39 am by Dr. Roy Schestowitz

Bruce Schneier
Bruce Schneier photo by sfllaw

Summary: Harsh words about Windows security from a security guru but promotion from the MSBBC

India’s “Grand Secret OS” (developed with involvement of the Indian government) has just led Bruce Schneier to making this statement which reminds us that transparency — not control — may be the key to making software more secure.

The only way to protect it is to design and implement it securely. Keeping control of your source code didn’t magically make Windows secure, and it won’t make this Indian OS secure.

Recall some of the latest (published this month) Microsoft security propaganda from the MSBBC [1, 2, 3]. “Who does Maggie Shiels work for? MS or the BBC It’s getting harder to tell,” argues our valued regular ThistleWeb, who respond to this latest advertisement from Maggie Shiels. She has been doing this for a while (pretending or neglecting to state that zombie PCS are a Windows issue). ThistleWeb adds, regarding this same article: “prepare for a new wave of malware, all powered by the infected MS cloud, instead of regular powered MS desktops”

Well, here is another new report about such issues:

A recently discovered category of malware — advanced evasion techniques — can sneak through most intrusion-prevention systems to deliver even well-known exploits such as Sasser and Conficker to targeted machines without leaving a trace of how they got there, researchers say.

When will the world’s governments realise that secure platforms are produced by collaboration rather than secrecy? And when will the BBC cease to be the second home of Microsoft UK? It has become embarrassing for a network which taxpayers are forced to fund.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

5 Comments

  1. mcinsand said,

    October 20, 2010 at 7:24 am

    Gravatar

    Open or closed, there is no friggin’ way Windows could ever be secure given its current architecture. With everything coded together as a massive megalithic blob, cracking your way into one area gives access potential to everything else. Opening up the code would help MS out of their self-created security mess somewhat, but they can never be anything but a suite of security holes until they fix fundamental design flaws, such as getting the browser, and many non-OS utilities, out of the OS.

    Regards,
    mc

    Dr. Roy Schestowitz Reply:

    The problem is, in some countries like Korea the ties between the OS and ‘the’ MSIE are very close due to ActiveX. Web sites too will need to get ‘fixed’.

    mcinsand Reply:

    The world needs to recognize that MSIE is one of it’s greatest security risks. I have a neighbor that is an agent with the US State Department, and they have actually woken up; using MSIE is a terminable offense because of security. Countries will have to decide whether they want to leave citizens open to attack or have cute eye candy. Granted, Java has security concerns, too, but they are not nearly so great as having an browser integrated into the OS.

    In the US, there are also only two manufacturers of gasoline (petrol) handling pumps, and these are now sophisticated enough to connect to the internet, call for shipments, and arrange deliveries. One of these companies uses MSIE-only, and an executive (another neighbor) dismissed customers that want to avoid MSIE for security reasons as ‘whiners.’ Petrol is dangerous and, in today’s world, we can’t leave tanks open to crackers to mishandle or misroute.

    MSIE is a global security risk that we cannot afford.
    Regards,
    mc

    Dr. Roy Schestowitz Reply:

    There is a whole book called “Don’t Click on the Blue E!”

    http://oreilly.com/catalog/9780596009397

  2. mcinsand said,

    October 20, 2010 at 4:30 pm

    Gravatar

    Thanks! That book might make a nice holiday gift for some family members.

    Regards,
    mc

DecorWhat Else is New


  1. [Meme] EPO Applicants Unwittingly Fund the War on Ukraine

    As we’ve just shown, António Campinos is desperately trying to hide a massive EPO scandal



  2. EPO Virtue-Signalling on the Ukrainian Front

    António Campinos persists in attention-shifting dross and photo ops; none of that can change the verifiable facts about the EPO’s connections to Lukashenko’s 'science park' in Minsk



  3. Links 19/05/2022: PostgreSQL 15 Beta 1 and Plasma 5.25 Beta

    Links for the day



  4. A Libera.Chat Anniversary and Happy Birthday (Maybe the Last) to 'Leenode'

    What became known as the so-called ‘Leenode’ is a cautionary tale, but maybe it is also a blessing in disguise because IRC as a whole seem to have become a lot more decentralised (as everything should be)



  5. Links 19/05/2022: The Gradual Fall of Netflix/DRM

    Links for the day



  6. IRC Proceedings: Wednesday, May 18, 2022

    IRC logs for Wednesday, May 18, 2022



  7. Links 18/05/2022: Qt Company Loses Chief; OpenSUSE Leap Micro 5.2 and RHEL 9 Final

    Links for the day



  8. Jim Zemlin's Wife is Funded by Puppies (Microsoft)

    Jim Zemlin — like his wife — is bagging millions from Microsoft, but that’s clearly a conflict of interest for the Linux Foundation



  9. Links 18/05/2022: More Defections From WordPress to Gemini

    Links for the day



  10. Links 18/05/2022: PikaScript and cURL's Annual User Survey

    Links for the day



  11. IRC Proceedings: Tuesday, May 17, 2022

    IRC logs for Tuesday, May 17, 2022



  12. Phoronix: Microsoft and Phoronix Sponsor (and Close Microsoft Partner) AMD All Over the Place

    When you’re taking massive 'gifts' from AMD (and also some from Microsoft) maybe it’s not surprising that editorial decisions change somewhat…



  13. EPO Has No F-ing Oversight

    Earlier today SUEPO mentioned this new article demonstrating that EPO President António Campinos can very obviously and blatantly violate the Code of Conduct of the Office without facing any consequences; there are translations too, so the report is now available in four languages



  14. [Meme] Linux-Rejecting Foundation

    The Linux Foundation never really leads by example; by default, it uses proprietary software



  15. Linux Foundation Almost Never uses Open Source

    The Linux Foundation uses proprietary software (look where they hire and take money from) and be sure they're probably not even aware of it



  16. Links 17/05/2022: Many More Games on GNU/Linux, YaST Development Report

    Links for the day



  17. Links 17/05/2022: Rocky Linux 8.6 and Budgie Desktop in Fedora

    Links for the day



  18. Patent Examiners Rising Up Against EPO Abuse

    Unhappy with the law-breaking autocracy (the EPO‘s management breaks the law as a matter of routine), fast-deteriorating working conditions and rapidly-decreasing quality of work (or lack of compliance with the law), workers have escalated further, topping off strikes and industrial actions with a large-scale petition



  19. [Meme] What Managers (Really) Mean by Acting Professionally

    The myth of 'professionalism' needs to die along with the façade of conformity as prerequisite for employment (Linus Torvalds can work just fine in a bathrobe in his own home)



  20. Internal Poll: 93% of European Patent Office (EPO) Workers Are Unhappy With the EPO

    On top of strike/s and industrial action/s there are now also petitions; at the EPO, almost all staff is "disgruntled" because of utterly corrupt and defunct leadership



  21. Links 17/05/2022: OpenSUSE Leap 15.4 Release Candidate

    Links for the day



  22. IRC Proceedings: Monday, May 16, 2022

    IRC logs for Monday, May 16, 2022



  23. Links 16/05/2022: FreeBSD 13.1 and Inkscape 1.2 Released

    Links for the day



  24. Archiving Latest Posts in Geminispace (Like a Dated Web Directory But for Gemini)

    Earlier today we saw several more people crossing over from the World Wide Web to Gemini; we're trying to make a decent aggregator and archive for the rapidly-expanding Geminispace, which will soon have 2,500 capsules that are known to Lupa alone



  25. Microsoft Vidal Does Not Want to Listen (USPTO is Just for Megacorporations)

    Microsoft Vidal knows her real bosses. They’re international corporations (multinationals like Microsoft), not American people.



  26. Links 16/05/2022: China Advances on GNU/Linux and Maui 2.1.2 is Out

    Links for the day



  27. Jim Zemlin: Chief Revenue Officer in 'Linux' Seat-Selling Foundation

    Board seats in the Linux Foundation are basically a product on sale, based internal documents



  28. Reminder: Linux Foundation's Last IRS Filing is Very Old (Same Year the CFO Left)

    People really need to ask the Linux Foundation, directly, why its filings are years behind; this seems like a sensitive subject



  29. Linux Foundation Does Not Speak for GNU/Linux Users

    There's a serious problem in the "Linux" world as the so-called 'Linux' Foundation claims to speak for us (the GNU/Linux community) while in fact speaking against us (on the payroll of those looking to extinguish us)



  30. IBM's Lennart Poettering on Breaking Software for Pseudo Novelty

    Recently-uploaded ELCE 2011 clip shows a panel with Linus Torvalds, Alan Cox, Thomas Gleixner, Paul McKenney, and Lennart Poettering (relevant to novelty or perceived novelty that mostly degrades the experience of longtime users, e.g. Wayland and systemd)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts