Bonum Certa Men Certa

Microsoft: Still a National Security Threat



Guest article by Mitchel Lewis

Windows ransomware



In 1998 for Computerworld and later in 2001 for PBS’s Frontline, Paul Strassmann, the former CIO of Xerox, NASA, and the DOD, highlighted an interesting analog between agricultural monocultures and software monocultures (monopolies), specifically Microsoft’s, in that they are naturally more susceptible to disease and pests, viruses and hackers if you will, than less prominent alternatives. Strassmann went on to suggest that Microsoft’s overly complex, defective, and vulnerable systems, which have become vastly more complex, defective, and vulnerable since this was written mind you, exacerbated this “monoculture effect” to the point of embodying a new threat to the national security and systematic reliability of our computer-based society.

Microsoft-National-Security-Threat-by-Paul Strassmann



Never one to stay quiet and in response to Strassmann’s monoculture analogy and designation of Microsoft as a national security threat, Microsoft, by way of Steve Lipman and Howard Schmidt, insinuated that “the analysis made in his paper suffers both from a fundamentally flawed assumption and from a series of errors in analyzing the state of computer security and its causes.”. And much like a squid deploying their ink, Microsoft went on to insist that “Computers aren’t potatoes”, and opted to drag this discussion into the ontological weeds with a few buzzwords thrown in for good measure. And everyone pretty much left it at that.

"Given Microsoft’s modern monopoly on botnet, malware, ransomware, virus, and zero-day exploits along with rudimentary brute-force attacks and advanced phishing schemes, none of which is proportional to their market share, it’s painfully evident that Strassmann not only won this debate but that his monoculture analog and his reasoning hold up to this day."Much to the chagrin of Microsoft though, to say that Strassmann’s analogy and assessments have aged well is an understatement. Given Microsoft’s modern monopoly on botnet, malware, ransomware, virus, and zero-day exploits along with rudimentary brute-force attacks and advanced phishing schemes, none of which is proportional to their market share, it’s painfully evident that Strassmann not only won this debate but that his monoculture analog and his reasoning hold up to this day.

That said, I think enough time has elapsed to confirm that Paul Strassmann is an authority on such matters and that Microsoft is precisely who he said they were. Further and with hindsight in our pocket, it seems as if Microsoft was merely projecting when they said Strassmann’s paper was flawed and that he made errors in analyzing the state of computer security and its causes in light of their 95–99% monopoly on ransomware infections alone and that ransomware is already considered to be a national security threat.

However, this should have been everyone’s assumption by default when a rebuttal is as poorly framed and laden with fallacies as Microsoft’s was presented as a counter-argument to Strassmann. With regard to rhetoric, fallacies of this magnitude are not only smoke signals for bad arguments, but can also be indicative of superior ignorance, zeal, and/or nefarious motives aimed at gaslighting and subverting the truth for profit which is essentially what corporate counsel and PR, Microsoft or otherwise, exists to accomplish.

Monocultures



For example, Microsoft kicks off their rebuttal with a straw man/reduction to absurdity fallacy with a low-key ad hominem attack minced in by stating that Strassmann confused potatoes for computers for the purposes of re-framing his argument into something absurd while discrediting him as confused rather than addressing the validity of his argument; Microsoft didn’t want one bit of that smoke. Meanwhile, Strassmann was merely suggesting that there is an overlap on the Venn Diagram between farms and information systems at scale.

"...Microsoft kicks off their rebuttal with a straw man/reduction to absurdity fallacy with a low-key ad hominem attack..."In the same paragraph, Microsoft also asserted that farms and potatoes are natural systems, which is categorically false, and that there was no option to alter the attributes of potatoes and the like to resist new threats, also false; even GMO foods were already around for a decade by then.

For those unaware, there’s no such thing as a natural farm. All of our food has been genetically engineered by humans via selective breeding over the course of thousands of years to look, feel, taste, smell, and transport to our liking while being cultivated on things called “farms” that have to be vigorously maintained because they are unnatural and constantly under attack by nature. Genetic engineering of food has only sped up this process while giving us a few new tools.

Vulnerabilities



Ironically and as shown to the left, Microsoft goes on to showcase just how little they know about farming by describing the inorganic nature of managing computers in a manner that is eerily similar to that of…farming. And in doing so, Microsoft inadvertently offered further agricultural analogs in support of Strassmann’s monoculture analog.

Call me crazy, but didn’t we engineer our food in a manner that forced it to evolve to our standards? Aren’t farms built, operated, and maintained by teams of skilled people? Don’t farmers and agriculture workers, many of whom have technical and scientific degrees mind you, apply expertise in various specialties, including the security, development, operation, and maintenance of their farms in a hostile environment? Or if a particular crop or patch of land is vulnerable to a specific sort of attack, then can’t farmers also intervene and change those properties in pursuit of profit?

Don’t Sysadmins and the like spend a lot of their time optimizing and doing disease/pest control just as farmers are planning, spraying, weeding, trapping, and crop-dusting? Hell, has anyone else referred to a collection of servers as a server farm? I have, even while working at Microsoft. It’s almost like potatoes and computers are relatable to some extent or something.

"Another glaring problem with their fleet analogy is that it’s hard to see how everyone wouldn’t be dead if we drove cars or flew in planes that were engineered and manufactured by Microsoft given their fast and loose approach to quality."Adding insult to injury, Microsoft then proceeded to liken their products to that of fleets of trucks and aircraft and that their prominence is the result of “fleet operators” (businesses) flocking to them after being deemed “best of breed”. One immediate problem with this analogy is that it doesn’t take into account Microsoft’s anti-competitive heritage and that is notorious for impeding free markets and grenading merit-based assessments. From their products being designed for maximal lock-in to Microsoft finding all matter of ways to drown out their competition rather than having to meet them on merit alone, Microsoft is built in the image of Bill Gates, for subversion and domination, and appear to be genuinely terrified of an honest, head-on competition.

Another glaring problem with their fleet analogy is that it’s hard to see how everyone wouldn’t be dead if we drove cars or flew in planes that were engineered and manufactured by Microsoft given their fast and loose approach to quality. One consequence of an anticompetitive monopoly, especially in the technology space, is that they have little to no regulations, especially in 1998, don’t have to compete on quality, and consequently have a much higher rate of defect than entities like Boeing or Ford who have far more regulations, competition, and oversight than Microsoft. But if you’re waiting for Microsoft employees to admit their anticompetitive DNA, a monopoly share, or even quality issues plaguing their entire ecosystem then you had better pack a lunch.

Later in this rebuttal, Microsoft exclaimed that when they get exploited, it’s not just Microsoft solutions getting exploited but other interconnected solutions from other vendors too that are necessary to secure Microsoft solutions being exploited before ultimately exploiting Microsoft. While this is absolutely true, most of these vendors are monocultures in their own right, are also Microsoft partners, and are suffering the same fate as Microsoft because of this while others are merely filling Microsoft’s competence gaps. However, none of them have anywhere near the rate of defect, overall complexity, or threat surface as the Microsoft ecosystem. And it’s often the complex architecture of the Microsoft ecosystem itself that necessitates their involvement in the first place. Simpler environments mitigate the necessity of many of these vendors.

Failure-prone code



Digging the hole deeper, Microsoft also insisted that Strassmann was basing his analogy on one virus in the desktop market, the “I Love You” virus to be exact. Besides drawing his critique from a core set of fundamental principles that are apparently omitted from the University of Phoenix curriculum where Schmidt graduated, Strassmann clearly and correctly anticipated similar problems for Microsoft’s Web and cloud ambitions. In fact, almost half of his article on Computerworld covers Microsoft’s ambitions beyond that of the desktop market while neither this article nor his follow-up on PBS’s frontline mentioned Windows by name. Oddly enough, Microsoft appears to be the one focusing on the desktop space, not Strassmann.

"Oddly enough, Microsoft appears to be the one focusing on the desktop space, not Strassmann."Microsoft went on to say that they’re too heavily invested in the enhancement of the security of their products to even list all of their accolades. One problem with this is that they cannot be invested in maximizing security without also being simultaneously being invested in complexity, cost, defect, and instability reduction. And upon accepting Microsoft’s aforementioned monopoly on <insert attack here> for the past 25 years on top of them consistently offering the most complex, expensive, defective, and unstable solutions available, it’s difficult to dignify such claims without sacrificing one’s credibility in the process.

Microsoft then proceeded to assert that being large simply makes them an easy target and that many of the problems they face would be faced by Linux, Unix, and the like, which is true to some extent. But while Linux and Unix aren’t fool-proof, their rate of exploit per attack is far below that of Windows. This isn’t because they’re attacked less, but because they have open sources and are under constant quality revision from countless perspectives. Meanwhile at Microsoft, source code is a trade secret and SDETs, QAs, and the like are hard to come by, further exacerbating Microsoft’s quality woes.

Microsoft concluded their rebuttal with the following:

Security and responsibility



While the majority of this is unimpeachable, it’s hard to consider Microsoft a strong supplier when it’s mostly just good at getting its way by bullying competition and dragging things out forever in court like some affluenza’d son of a prominent Halliburton attorney instead of simply shipping the best products possible. And this is especially the case when the company was founded by Bill Gates, who is literally the affluenza’d son of a Halliburton attorney whose firm also represented the slimy likes of Wells Fargo, Bank of America, Goldman Sachs, Blackwater, Merrill Lynch, Microsoft, and god knows who else; what a mensch.

In summary and rather than refuting Strassmann’s monoculture analogy, Microsoft ignorantly fortified his stance with their fleet analogy in their counter-argument after invoking several fallacies about Strassmann confusing computers for potatoes. Rather than refuting Strassmann’s assessment that Microsoft’s software monoculture and the horrid approach towards quality has culminated into a national security threat, Microsoft’s offered irrational counter-arguments and a glimpse into the extreme level of ignorance, delusion, and denialism one must embody in order to work at Microsoft, let alone climb its ranks; similar to those within the vatican ignoring the ritualistic rape of children among countless other atrocities.

ransomware-by-system



As far as Microsoft being a national security threat is concerned, given that ransomware has been deemed a national security threat while Microsoft is home to 95–99% of all ransomware attacks, it’s not exactly a reach to saddle Microsoft with part of the blame and designate their systems as threats to national security just as same Strassmann did decades ago. And this argument only becomes more compelling when you begin to consider their monopoly on countless other attacks in the desktop and cloud spaces.

For what it’s worth, I also don’t think it’s a coincidence that the countries exploiting the United States via the Microsoft ecosystem the most, China and Russia, happen to be the same countries migrating away from the Microsoft ecosystem in favor of Linux. Although they’ve never stated their reasoning, I can’t help but think that national security wasn’t a motivational force behind such moves given their international exploits with Windows.

There was some truth to Microsoft’s rebuttal though. They are indeed targeted largely in part due to how big their market share is, but this is equally due to how defective they are. But upon agreeing on this, you can easily mitigate the onslaught of attacks that Microsoft solutions attract by simply migrating away from them to Linux and macOS. Although the entry burden to these alternatives can be high, this is due in part to Microsoft’s lock-in tactics (re: anti-competition), the long-term effect is an IT infrastructure that is less expensive, simpler, more secure, attacked less, and exploited at a lesser rate than anything that slithers down Microsoft’s leg.

I’d act like I’m perplexed by the government’s lackluster response to Microsoft’s blatant monopoly or the threat their systems pose to national security, but just as history teaches us that Strassmann was spot-on, history also shows us that governments all around the world have a penchant for turning a blind eye to the behavior of monopolies, hence why there are so many monopolies at present, and this is especially true of their relationship with Microsoft.

To be fair, it’s easy to see why they do nothing given how successfully regulating Microsoft in a manner they truly deserve, regulating them out of existence, would almost immediately create a multi-trillion dollar burden for the government to modernize IT infrastructure that is presently standardized on Microsoft legacy solutions. Rumor has it that taking Microsoft to court can be quite expensive and time-consuming too.

Besides this, Microsoft’s partner network alone employs over 17 million IT professionals around the world and this doesn’t even account for the majority of privately retained IT professionals in Microsoft-centric positions; many of these jobs would disappear if Microsoft were to be regulated. And let’s also not forget that Microsoft is a defense contractor, biting and scratching for government contracts, and a major IT vendor for the government as a whole and I can’t imagine that regulating bodies don’t consider the impact to the government when evaluating charges.

But without Microsoft being sanctioned and without businesses/government entities being heavily incentivized to migrate to Linux and macOS to balance out the market share, I don’t see Microsoft’s dominance or the threat said dominance poses to the US or anyone else around the world relying on their systems going anywhere anytime soon.

With Microsoft unchecked and given the relationship between cryptocurrency and ransomware, we might have to consider banning cryptocurrency instead. But in doing this, we would only be removing the financial incentive for digital pirates to attack business and government entities who would otherwise remain vulnerable to foreign governments seeking to exploit our weak IT infrastructure for reasons beyond that of immediate financial gain.

However, I’d like to think that Microsoft would get creative if the government were to sanction Microsoft by allowing allow citizens and businesses impacted by ransomware to bill Microsoft for the cost of the ransom and their losses in productivity. And although Microsoft cannot be faulted for the attacks, they can be faulted for their shit-in-hand approach to quality and security while sanctioning them until they actually take a common-sensical approach to quality and security appears to be the simplest means of combating ransomware and mitigating the threat it poses to our national security.

Recent Techrights' Posts

Nobody Knows What's in Our Fridge! Wow, Spooky!
Freedom means you can also purchase things anonymously
 
Our 18+ Years of Freedom-Fighting
We always fight back
Gemini Links 11/11/2024: Men Losing Grip and "You're Relaxing Wrong"
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, November 10, 2024
IRC logs for Sunday, November 10, 2024
Freedom Must Always Be Fought For (All the Time)
Ridicule of "freedom fighters" in the digital realm is typically orchestrated by dictators or wannabes.
Gemini Links 10/11/2024: Taking Jokes and Writing Dense Assembly
Links for the day
Links 10/11/2024: Meaning of Life and iPhone ‘Inactivity Reboot’
Links for the day
Links 10/11/2024: Microsoft Adds Surveillance to Notepad and Paint, TikTok Shutdown Order
Links for the day
Gemini Links 10/11/2024: Scrawlspace and California
Links for the day
Links 10/11/2024: Politics, Economics, and Ticketmaster Issues
Links for the day
Linux Foundation: We've Shut Down the Mailing Lists and Fired Everyone at Linux.com So We Can Spend Money Buying Puff Pieces and Paying Clickfraud/Spammers
deeply rogue
The 'Other' Bruce... on Openwashing at OSI (and Not Bruce Perens, the OSI's Co-founder)
Openwashing people (connected to Microsoft) already do "open weights"
Gemini Links 10/11/2024: A Writer's Block, VIM Tips and Tricks
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, November 09, 2024
IRC logs for Saturday, November 09, 2024
[Meme] Linux Foundation Cuts
money is spent by the million on highly dubious things
Politics Becoming Way Too 'Toxic'
'Toxic' political discourse ought to be covered, but reducing the toxicity of coverage itself (e.g. inaccurately covering things to incite "the left" and "the right") is still challenging
"Paperless Office" (Incompatible With the Law) as a Threat to Workers' Health at the EPO, Europe's Second-Largest Institution and Largest Patent Office
"Software Ergonomics need to be brought back to the agenda at a high level!"
Linux Foundation is Rebuilding the Berlin Wall (to Keep Russians Out of Linux)
So the Linux Foundation is basically acting a bit like oppressive Soviets
Linux Foundation is a Scam Like 'Crypto' (So is the Company of Jim Zemlin's Wife, Bakkt)
To us, the Linux Foundation is just a massive scam
Remembering and Respecting Fallen Ones by Avoiding or Stopping Wars (and Boycotting Companies That Want Wars)
The people who die tend to be the least privileged and connected
EPO is Blasting Its Own Foot (There Will be No EPO Left)
If the EPO carries on shooting its own foot, there will be nothing left of it
There's Always a Way to Improve
Self-improvement is a perpetual task
Joel Espy Klecker, unpaid, terminally ill youth labor & Debian knew it
Reprinted with permission from Daniel Pocock
List of Debian lies and deception
Reprinted with permission from Daniel Pocock
Links 09/11/2024: More Mass Layoffs and Concerns About Musk Working Like Trump Aide
Links for the day
Gemini Links 09/11/2024: Operating the Temple System and SeaweedFS
Links for the day
[Teaser] [Meme] Central Occupational Health, Safety and Ergonomics Committee (COHSEC) at European Patent Office (EPO)
These are not teenage gamers
Links 09/11/2024: Further Restrictions on Social Control Media, CASIO Cracked Again
Links for the day
Why Brown CIT Oughtn't Be Named After Thomas J. Watson (Like Many Faculties Ought Not be Named After Bill Gates)
In their own words
Reminder That Mass Layoffs Are Going on All Month This Month at IBM
The "silent" layoffs continue until the end of this month if not longer
[Meme] Just Blame Whoever Takes Advantage of Your Back Doors
The media will even sympathise with malicious and/or incompetent companies if they blame "Russia"
This Remembrance Sunday We Must Also Remember That Some 'Security Companies' Want More Cyberwar
Some companies profit from the cyberwar; hence, their objective is not to end the war
Non-Tech Enshittification: Post Office Perils and the Czech is in the Mail
We still hope that the parcel will be recovered (maybe at customs) or will be sent back some day
[Meme] Don't Try This at Home (But a Datacentre Might be OK)
Quit outsourcing to Social Control Media
There's No Free Lunch in Video Hosting
they say there's no free lunch; if you aren't paying for hosting and serving of "your" videos, you're not the customer and those videos, once uploaded, aren't quite yours anymore
Parroting Microsoft Talking Points About Computer Security
This past summer Richard M. Stallman (RMS) openly complained in a public event that the term "security" had come to mean all sorts of ridiculous things, including the very oppose of real security
Visits to OpenAI's Site Plunged by More Than 67% in the Past Half a Year Alone
'autocorrect on steroids' is mostly worthless
Pocock Running for Office Again
Pocock dealt with all sorts of 'politics' in Free software and, unlike many politicians, he has a background in science and technology
[Meme] Turning the EPO Into a Speculation Bank, Monetising It by Breaking the Law, Playing Real Estate (and Mortgage) Financial Games
travesty
Real Estate and Workplace Problems at the European Patent Office, Which Grants Fake Patents Under the Guise of "Law"
Report on the 54th meeting of the Munich LOHSEC of 20 June 2024
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Friday, November 08, 2024
IRC logs for Friday, November 08, 2024
Links 09/11/2024: Politics, Climate, and Why Physical Cash is Crucial
Links for the day
Gemini Links 09/11/2024: Minerals, Rants, and Maintaining Planetary Balance
Links for the day