10.29.21

Gemini version available ♊︎

Microsoft: Still a National Security Threat

Posted in Deception, Microsoft, Security at 1:10 am by Guest Editorial Team

Guest article by Mitchel Lewis

Windows ransomware

In 1998 for Computerworld and later in 2001 for PBS’s Frontline, Paul Strassmann, the former CIO of Xerox, NASA, and the DOD, highlighted an interesting analog between agricultural monocultures and software monocultures (monopolies), specifically Microsoft’s, in that they are naturally more susceptible to disease and pests, viruses and hackers if you will, than less prominent alternatives. Strassmann went on to suggest that Microsoft’s overly complex, defective, and vulnerable systems, which have become vastly more complex, defective, and vulnerable since this was written mind you, exacerbated this “monoculture effect” to the point of embodying a new threat to the national security and systematic reliability of our computer-based society.

Microsoft-National-Security-Threat-by-Paul Strassmann

Never one to stay quiet and in response to Strassmann’s monoculture analogy and designation of Microsoft as a national security threat, Microsoft, by way of Steve Lipman and Howard Schmidt, insinuated that “the analysis made in his paper suffers both from a fundamentally flawed assumption and from a series of errors in analyzing the state of computer security and its causes.”. And much like a squid deploying their ink, Microsoft went on to insist that “Computers aren’t potatoes”, and opted to drag this discussion into the ontological weeds with a few buzzwords thrown in for good measure. And everyone pretty much left it at that.

“Given Microsoft’s modern monopoly on botnet, malware, ransomware, virus, and zero-day exploits along with rudimentary brute-force attacks and advanced phishing schemes, none of which is proportional to their market share, it’s painfully evident that Strassmann not only won this debate but that his monoculture analog and his reasoning hold up to this day.”Much to the chagrin of Microsoft though, to say that Strassmann’s analogy and assessments have aged well is an understatement. Given Microsoft’s modern monopoly on botnet, malware, ransomware, virus, and zero-day exploits along with rudimentary brute-force attacks and advanced phishing schemes, none of which is proportional to their market share, it’s painfully evident that Strassmann not only won this debate but that his monoculture analog and his reasoning hold up to this day.

That said, I think enough time has elapsed to confirm that Paul Strassmann is an authority on such matters and that Microsoft is precisely who he said they were. Further and with hindsight in our pocket, it seems as if Microsoft was merely projecting when they said Strassmann’s paper was flawed and that he made errors in analyzing the state of computer security and its causes in light of their 95–99% monopoly on ransomware infections alone and that ransomware is already considered to be a national security threat.

However, this should have been everyone’s assumption by default when a rebuttal is as poorly framed and laden with fallacies as Microsoft’s was presented as a counter-argument to Strassmann. With regard to rhetoric, fallacies of this magnitude are not only smoke signals for bad arguments, but can also be indicative of superior ignorance, zeal, and/or nefarious motives aimed at gaslighting and subverting the truth for profit which is essentially what corporate counsel and PR, Microsoft or otherwise, exists to accomplish.

Monocultures

For example, Microsoft kicks off their rebuttal with a straw man/reduction to absurdity fallacy with a low-key ad hominem attack minced in by stating that Strassmann confused potatoes for computers for the purposes of re-framing his argument into something absurd while discrediting him as confused rather than addressing the validity of his argument; Microsoft didn’t want one bit of that smoke. Meanwhile, Strassmann was merely suggesting that there is an overlap on the Venn Diagram between farms and information systems at scale.

“…Microsoft kicks off their rebuttal with a straw man/reduction to absurdity fallacy with a low-key ad hominem attack…”In the same paragraph, Microsoft also asserted that farms and potatoes are natural systems, which is categorically false, and that there was no option to alter the attributes of potatoes and the like to resist new threats, also false; even GMO foods were already around for a decade by then.

For those unaware, there’s no such thing as a natural farm. All of our food has been genetically engineered by humans via selective breeding over the course of thousands of years to look, feel, taste, smell, and transport to our liking while being cultivated on things called “farms” that have to be vigorously maintained because they are unnatural and constantly under attack by nature. Genetic engineering of food has only sped up this process while giving us a few new tools.

Vulnerabilities

Ironically and as shown to the left, Microsoft goes on to showcase just how little they know about farming by describing the inorganic nature of managing computers in a manner that is eerily similar to that of…farming. And in doing so, Microsoft inadvertently offered further agricultural analogs in support of Strassmann’s monoculture analog.

Call me crazy, but didn’t we engineer our food in a manner that forced it to evolve to our standards? Aren’t farms built, operated, and maintained by teams of skilled people? Don’t farmers and agriculture workers, many of whom have technical and scientific degrees mind you, apply expertise in various specialties, including the security, development, operation, and maintenance of their farms in a hostile environment? Or if a particular crop or patch of land is vulnerable to a specific sort of attack, then can’t farmers also intervene and change those properties in pursuit of profit?

Don’t Sysadmins and the like spend a lot of their time optimizing and doing disease/pest control just as farmers are planning, spraying, weeding, trapping, and crop-dusting? Hell, has anyone else referred to a collection of servers as a server farm? I have, even while working at Microsoft. It’s almost like potatoes and computers are relatable to some extent or something.

“Another glaring problem with their fleet analogy is that it’s hard to see how everyone wouldn’t be dead if we drove cars or flew in planes that were engineered and manufactured by Microsoft given their fast and loose approach to quality.”Adding insult to injury, Microsoft then proceeded to liken their products to that of fleets of trucks and aircraft and that their prominence is the result of “fleet operators” (businesses) flocking to them after being deemed “best of breed”. One immediate problem with this analogy is that it doesn’t take into account Microsoft’s anti-competitive heritage and that is notorious for impeding free markets and grenading merit-based assessments. From their products being designed for maximal lock-in to Microsoft finding all matter of ways to drown out their competition rather than having to meet them on merit alone, Microsoft is built in the image of Bill Gates, for subversion and domination, and appear to be genuinely terrified of an honest, head-on competition.

Another glaring problem with their fleet analogy is that it’s hard to see how everyone wouldn’t be dead if we drove cars or flew in planes that were engineered and manufactured by Microsoft given their fast and loose approach to quality. One consequence of an anticompetitive monopoly, especially in the technology space, is that they have little to no regulations, especially in 1998, don’t have to compete on quality, and consequently have a much higher rate of defect than entities like Boeing or Ford who have far more regulations, competition, and oversight than Microsoft. But if you’re waiting for Microsoft employees to admit their anticompetitive DNA, a monopoly share, or even quality issues plaguing their entire ecosystem then you had better pack a lunch.

Later in this rebuttal, Microsoft exclaimed that when they get exploited, it’s not just Microsoft solutions getting exploited but other interconnected solutions from other vendors too that are necessary to secure Microsoft solutions being exploited before ultimately exploiting Microsoft. While this is absolutely true, most of these vendors are monocultures in their own right, are also Microsoft partners, and are suffering the same fate as Microsoft because of this while others are merely filling Microsoft’s competence gaps. However, none of them have anywhere near the rate of defect, overall complexity, or threat surface as the Microsoft ecosystem. And it’s often the complex architecture of the Microsoft ecosystem itself that necessitates their involvement in the first place. Simpler environments mitigate the necessity of many of these vendors.

Failure-prone code

Digging the hole deeper, Microsoft also insisted that Strassmann was basing his analogy on one virus in the desktop market, the “I Love You” virus to be exact. Besides drawing his critique from a core set of fundamental principles that are apparently omitted from the University of Phoenix curriculum where Schmidt graduated, Strassmann clearly and correctly anticipated similar problems for Microsoft’s Web and cloud ambitions. In fact, almost half of his article on Computerworld covers Microsoft’s ambitions beyond that of the desktop market while neither this article nor his follow-up on PBS’s frontline mentioned Windows by name. Oddly enough, Microsoft appears to be the one focusing on the desktop space, not Strassmann.

“Oddly enough, Microsoft appears to be the one focusing on the desktop space, not Strassmann.”Microsoft went on to say that they’re too heavily invested in the enhancement of the security of their products to even list all of their accolades. One problem with this is that they cannot be invested in maximizing security without also being simultaneously being invested in complexity, cost, defect, and instability reduction. And upon accepting Microsoft’s aforementioned monopoly on <insert attack here> for the past 25 years on top of them consistently offering the most complex, expensive, defective, and unstable solutions available, it’s difficult to dignify such claims without sacrificing one’s credibility in the process.

Microsoft then proceeded to assert that being large simply makes them an easy target and that many of the problems they face would be faced by Linux, Unix, and the like, which is true to some extent. But while Linux and Unix aren’t fool-proof, their rate of exploit per attack is far below that of Windows. This isn’t because they’re attacked less, but because they have open sources and are under constant quality revision from countless perspectives. Meanwhile at Microsoft, source code is a trade secret and SDETs, QAs, and the like are hard to come by, further exacerbating Microsoft’s quality woes.

Microsoft concluded their rebuttal with the following:

Security and responsibility

While the majority of this is unimpeachable, it’s hard to consider Microsoft a strong supplier when it’s mostly just good at getting its way by bullying competition and dragging things out forever in court like some affluenza’d son of a prominent Halliburton attorney instead of simply shipping the best products possible. And this is especially the case when the company was founded by Bill Gates, who is literally the affluenza’d son of a Halliburton attorney whose firm also represented the slimy likes of Wells Fargo, Bank of America, Goldman Sachs, Blackwater, Merrill Lynch, Microsoft, and god knows who else; what a mensch.

In summary and rather than refuting Strassmann’s monoculture analogy, Microsoft ignorantly fortified his stance with their fleet analogy in their counter-argument after invoking several fallacies about Strassmann confusing computers for potatoes. Rather than refuting Strassmann’s assessment that Microsoft’s software monoculture and the horrid approach towards quality has culminated into a national security threat, Microsoft’s offered irrational counter-arguments and a glimpse into the extreme level of ignorance, delusion, and denialism one must embody in order to work at Microsoft, let alone climb its ranks; similar to those within the vatican ignoring the ritualistic rape of children among countless other atrocities.

ransomware-by-system

As far as Microsoft being a national security threat is concerned, given that ransomware has been deemed a national security threat while Microsoft is home to 95–99% of all ransomware attacks, it’s not exactly a reach to saddle Microsoft with part of the blame and designate their systems as threats to national security just as same Strassmann did decades ago. And this argument only becomes more compelling when you begin to consider their monopoly on countless other attacks in the desktop and cloud spaces.

For what it’s worth, I also don’t think it’s a coincidence that the countries exploiting the United States via the Microsoft ecosystem the most, China and Russia, happen to be the same countries migrating away from the Microsoft ecosystem in favor of Linux. Although they’ve never stated their reasoning, I can’t help but think that national security wasn’t a motivational force behind such moves given their international exploits with Windows.

There was some truth to Microsoft’s rebuttal though. They are indeed targeted largely in part due to how big their market share is, but this is equally due to how defective they are. But upon agreeing on this, you can easily mitigate the onslaught of attacks that Microsoft solutions attract by simply migrating away from them to Linux and macOS. Although the entry burden to these alternatives can be high, this is due in part to Microsoft’s lock-in tactics (re: anti-competition), the long-term effect is an IT infrastructure that is less expensive, simpler, more secure, attacked less, and exploited at a lesser rate than anything that slithers down Microsoft’s leg.

I’d act like I’m perplexed by the government’s lackluster response to Microsoft’s blatant monopoly or the threat their systems pose to national security, but just as history teaches us that Strassmann was spot-on, history also shows us that governments all around the world have a penchant for turning a blind eye to the behavior of monopolies, hence why there are so many monopolies at present, and this is especially true of their relationship with Microsoft.

To be fair, it’s easy to see why they do nothing given how successfully regulating Microsoft in a manner they truly deserve, regulating them out of existence, would almost immediately create a multi-trillion dollar burden for the government to modernize IT infrastructure that is presently standardized on Microsoft legacy solutions. Rumor has it that taking Microsoft to court can be quite expensive and time-consuming too.

Besides this, Microsoft’s partner network alone employs over 17 million IT professionals around the world and this doesn’t even account for the majority of privately retained IT professionals in Microsoft-centric positions; many of these jobs would disappear if Microsoft were to be regulated. And let’s also not forget that Microsoft is a defense contractor, biting and scratching for government contracts, and a major IT vendor for the government as a whole and I can’t imagine that regulating bodies don’t consider the impact to the government when evaluating charges.

But without Microsoft being sanctioned and without businesses/government entities being heavily incentivized to migrate to Linux and macOS to balance out the market share, I don’t see Microsoft’s dominance or the threat said dominance poses to the US or anyone else around the world relying on their systems going anywhere anytime soon.

With Microsoft unchecked and given the relationship between cryptocurrency and ransomware, we might have to consider banning cryptocurrency instead. But in doing this, we would only be removing the financial incentive for digital pirates to attack business and government entities who would otherwise remain vulnerable to foreign governments seeking to exploit our weak IT infrastructure for reasons beyond that of immediate financial gain.

However, I’d like to think that Microsoft would get creative if the government were to sanction Microsoft by allowing allow citizens and businesses impacted by ransomware to bill Microsoft for the cost of the ransom and their losses in productivity. And although Microsoft cannot be faulted for the attacks, they can be faulted for their shit-in-hand approach to quality and security while sanctioning them until they actually take a common-sensical approach to quality and security appears to be the simplest means of combating ransomware and mitigating the threat it poses to our national security.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. IRC Proceedings: Wednesday, January 19, 2022

    IRC logs for Wednesday, January 19, 2022



  2. Links 20/1/2022: Linuxfx 11.1 WxDesktop 11.0.3 and FreeIPMI 1.6.9 Released

    Links for the day



  3. Links 19/1/2022: XWayland 22.1 RC1 and OnlyOffice 7.0 Release

    Links for the day



  4. Links 19/1/2022: ArchLabs 2022.01.18 and KDE's 15-Minute Bug Initiative

    Links for the day



  5. When Twitter Protects Abusers and Abuse (and Twitter's Sponsors)

    Twitter is an out-of-control censorship machine and it should be treated accordingly even by those who merely "read" or "follow" Twitter accounts; Twitter is a filter, not a news/media platform or even means of communication



  6. IRC Proceedings: Tuesday, January 18, 2022

    IRC logs for Tuesday, January 18, 2022



  7. Links 19/1/2022: Wine 7.x Era Begins and Istio 1.12.2 is Out

    Links for the day



  8. Another Video IBM Does Not Want You to Watch

    It seems very much possible that IBM (or someone close to IBM) is trying to purge me from Twitter, so let’s examine what they may be trying to distract from. As we put it 2 years ago, "Watson" is a lot more offensive than those supposedly offensive words IBM is working to purge; think about those hundreds of Red Hat workers who are black and were never told about ethnic purges of blacks facilitated by IBM (their new boss).



  9. What IBM Does Not Want You to Watch

    Let's 'Streisand it'...



  10. Good News, Bad News (and Back to Normal)

    When many services are reliant on the integrity of a single, very tiny MicroSD card you're only moments away from 2 days of intensive labour (recovery, investigation, migration, and further coding); we've learned our lessons and took advantage of this incident to upgrade the operating system, double the storage space, even improve the code slightly (for compatibility with newer systems)



  11. Someone Is Very Desperate to Knock My Account Off Twitter

    Many reports against me — some successful — are putting my free speech (and factual statements) at risk



  12. Links 18/1/2022: Deepin 20.4 and Qubes OS 4.1.0 RC4

    Links for the day



  13. Links 18/1/2022: GNOME 42 Alpha and KStars 3.5.7

    Links for the day



  14. IRC Proceedings: Monday, January 17, 2022

    IRC logs for Monday, January 17, 2022



  15. Links 17/1/2022: More Microsoft-Connected FUD Against Linux as Its Share Continues to Fall

    Links for the day



  16. The GUI Challenge

    The latest article from Andy concerns the Command Line Challenge



  17. Links 17/1/2022: digiKam 7.5.0 and GhostBSD 22.01.12 Released

    Links for the day



  18. IRC Proceedings: Sunday, January 16, 2022

    IRC logs for Sunday, January 16, 2022



  19. Links 17/1/2022: postmarketOS 21.12 Service Pack 1 and Mumble 1.4 Released

    Links for the day



  20. [Meme] Gemini Space (or Geminispace): From 441 Working Capsules to 1,600 Working Capsules in Just 12 Months

    Gemini space now boasts 1,600 working capsules, a massive growth compared to last January, as we noted the other day (1,600 is now official)



  21. [Meme] European Patent Office Space

    The EPO maintains a culture of illegal surveillance, inherited from Benoît Battistelli and taken to a whole new level by António Campinos



  22. Gemini Rings (Like Webrings) and Shared Spaces in Geminspace

    Much like the Web of 20+ years ago, Gemini lets online communities — real communities (not abused tenants, groomed to be ‘monetised’ like in Facebook or Flickr) — form networks, guilds, and rings



  23. Links 16/1/2022: Latte Dock 0.11 and librest 0.9.0

    Links for the day



  24. The Corporate Cabal (and Spy Agencies-Enabled Monopolies) Engages in Raiding of the Free Software Community and Hacker Culture

    In an overt attack on the people who actually did all the work — the geeks who built excellent software to be gradually privatised through the Linux Foundation (a sort of price-fixing and openwashing cartel for shared interests of proprietary software firms) — is receiving more widespread condemnation; even the OSI has been bribed to become a part-time Microsoft outsourcer as organisations are easier to corrupt than communities



  25. EPO's Web Site Constantly Spammed by Lies About Privacy While EPO Breaks the Law and Outsources Data to the United States

    The António Campinos-led EPO works for imperialism, it not only protects the rich; sadly, António’s father isn’t alive anymore and surely he would blast his son for doing what he does to progress his career while lying to staff and European citizens



  26. Links 16/1/2022: Tsunami and Patents

    Links for the day



  27. IRC Proceedings: Saturday, January 15, 2022

    IRC logs for Saturday, January 15, 2022



  28. Links 16/1/2022: Year of the GNU/Linux Desktop and Catch-up With Patent Misinformation

    Links for the day



  29. Patrick Breyer, Unlike Most German Politicians, Highlights the Fact That Unified Patent Court (UPC) and Unitary Patent Are Incompatible With EU Law

    A longtime critic of EPO abuses (under both Benoît Battistelli and António Campinos leadership), as well as a vocal critic of software patents, steps in to point out the very obvious



  30. Links 15/1/2022: Flameshot 11.0 and Libvirt 8.0

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts