Comments

• David Mohring (NZheretic)

  2007-06-04 06:43:56

  Roy, ever see the movie "fight club"? QUOTE Narrator: A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one. Business woman on plane: Are there a lot of these kinds of accidents? Narrator: You wouldn't believe. Business woman on plane: Which car company do you work for? Narrator: A major one. UNQUOTE
  
  See Our Data:an appeal - a "Plimsoll line" for apps http://itheresies.blogspot.com/2005_10_01_archive.html#112890721608678496 "Bruce Schneier claimed that for change to occur the software industry must become libel for damages from "unsecure" software. However, historically this has not always been the case, since most businesses can insure against damages and pass the cost along to the consumer."

• Roy Schestowitz

  2007-06-03 15:38:51

  As far as patents are concerned, I don't think that it's likely to end up in court. To Microsoft this would be like sticking a pie in their own face.
  
  
  
  As far as 'predatory licences' are concerned, it's Microsoft and/or Novell that could strike preemptively, which is why I posted this item earlier today.

• John Drinkwater

  2007-06-03 20:22:44

  That's a cake, not a pie!
  
  Otherwise, keep it up.

• David Mohring (NZheretic)

  2007-06-04 00:25:22

  What about the REAL relative risk for Microsoft's own customers...
  
  Due to the amount of patent leverage from SUN and IBM, in reality there is little risk of Microsoft suing end users deploying open source, and that includes customers of RedHat and Canonical. But what of the risk to Microsoft's own customers from continuing to use Microsoft's demonstratably more insecure products.
  
  If a business or government body is not taking due care with the private information they hold on the public which could lead to identity theft then they are at risk of being sued.
  
  1) Demand the business or government body disclose copies of the anti virus logs for all of their desktops and laptops. 2) Generate a list of all the malware that a) was cleaned up post infection ( the malware was actually executed and run ) AND b) exploited vulnerabilities in Microsoft applications and operating system prior to an update fix being made available by Microsoft.
  
  In comparison to MacOSX or Linux based desktop, Microsoft's desktop operating systems and Microsoft's desktop applications face a disproportionally higher risk of being "infected" with hostile malware. Just relying on third party Antivirus software to prop up Microsoft's flagging security record in no way puts you any closer to the level of security that a switch to another vendors desktop platform can provide. ( Just updating to Vista is no guarantee of better security in comparison to another vendors platform )
  
  A business or government body is not taking due care with the private information they hold on the public if they continue to use Microsoft desktop OS environments or Microsoft desktop applications. That is your credit card data, banking details , health care info and social security information. If switching to Linux or MacOSX based desktops would greatly reduce the risk of further intrusion why should not organizations be "encouraged" to make the move.
  
  If anyones customers are at greater risk of being sued for using a product it is Microsoft's own customers.

• Roy Schestowitz

  2007-06-04 01:09:11

  David, on the subject of liability, I have some bit which could suggest the software vendor is liable when (knowingly) insecure software gets distributed, e.g.
  
  'Ah, from the horse's mouth: Microsoft just might be held legally responsible for selling software that is insecure.'
  
  http://www.groklaw.net/article.php?story=2006112223522439
  
  Experts are calling for product liability for software
  
  "Product liability does not apply to software," Gerald Spindler of the Faculty of Law of the University of Göttingen complained. "But what if a whole company comes to a standstill due to faulty software?" he mused.
  
  http://www.heise.de/english/newsticker/news/86932/from/rss09
  
  It is worth adding that Microsoft was aware of security issues when it finalised Windows Vista. This, for example, is why they consider banning virtualisation altogether. But it takes us off topic...

• Roy Schestowitz

  2007-06-04 07:05:21

  I watched “Fight Club”, but I can't recall that dialogue, which is both interesting and truthful.
  
  About Schneier, whose writings I follow regularly, well... he makes a fine point and more recently he took a somewhat controversial stance (even Alax Cox would seem to disagree with his assessment).
  
  http://news.zdnet.com/2100-1009_22-6179500.html
  
  Schneier questions need for security industry
  
  "We shouldn't have to come and find a company to secure our e-mail. E-mail should already be secure. We shouldn't have to buy from somebody to secure our network or servers. Our networks and servers should already be secure."
  
  http://www.wired.com/politics/security/commentary/securitymatters/2007/05/securitymatters_0503
  
  Do We Really Need a Security Industry?
  
  "Aftermarket security is actually a very inefficient way to spend our security dollars; it may compensate for insecure IT products, but doesn't help improve their security. Additionally, as long as IT security is a separate industry, there will be companies making money based on insecurity -- companies who will lose money if the internet becomes more secure."

• Ian

  2007-06-04 12:44:19

  With each passing week, and unfilfilled threat, it becomes more and more apparent that Microsoft’s intention is to keep the community focused on collective sandbag-piling and allow Microsoft to catch-up technologically, rather than risk testing their spurious software patents in a court of law.
  
  Do you honestly think that a majority of the developer community is really paying a lot of attention to what Microsoft is doing in this aspect? While I'm certainly not going to defend Microsoft here, I don't think its completely accurate to extrapolate the feelings and mission of the open source advocacy community onto the developer community.
  
  In my personal opinion, while some might be upset at the whole situation, development is most likely continuing as always.

• Shane Coyle

  2007-06-04 12:48:48

  At this point, MS is essentially asserting ownership and collecting royalties over many Free Software developers' code, if they aren't watching what MS is doing, I would be shocked.

• Roy Schestowitz

  2007-06-04 13:30:42

  To support Shane's point, have a look at this one:
  
  http://boycottnovell.com/2007/06/02/coupons-portion/
  
  Microsoft confirmed what was said to us by Jeremy Allison months ago. Behind the scenes, Microsoft scares customers and collects money for 'protection' that covers Free software. This is inexcusable. Sadly, many of the developers of the tools for which money is being paid are still unaware of this. Microsoft keeps a low profile and as Jeremy said, they do this 'off the record'. Essentially, they give software for free while Microsoft makes money from that software. How would you feel as a developer?

• Ian

  2007-06-04 14:46:54

  How would I feel? It's hard to say. I probably wouldn't be overly happy. But if I really cared about it, I'd probably say something.