Feeds

Open source review would aid Windows security: Gartner

Aargh... Not the garlic

  • alert
  • submit to reddit

The smart choice: opportunity from uncertainty

Microsoft should dump security via obscurity, and submit its software to open source review, according to Gartner.

The open source review bit is something so utterly alien, communist and horrible to the mind of Bill Gates that it's almost worth us running a competition to find what he'd rather do (Sacrifice of firstborn? Auction wife on eBay? Tell Steve Jobs he was right?) - but actually, Gartner is perpetrating a small piece of sensationalism by saying it agrees with Gates about security, "and believes that open source review of Microsoft's code is necessary to meet security goals."

Which is not the same as saying this is what Bill believes, but they had us going for a moment there.

Gartner contrasts the assertion by Jim Allchin, Microsoft's senior vice president for Windows, that Windows boxes would be more vulnerable to attack if the company had to disclose technical information to rivals with previous pronouncements by his Billness.

But computer hackers have had little difficulty breaking into Microsoft's closed-source software, it notes.

Gartner analyst John Pescatore writes : "a strategy of relying on security through obscurity (hiding source code) has already proven a failure for Microsoft. To make future products more trustworthy, Microsoft will have to become more expert at developing code that can withstand external review."

Over the long term open documentation and public review of program interfaces between OSs and applications will lead to better security for Microsoft, Gartner believes, even though it notes some short term problems.

"Attackers may exploit the exposed interfaces in the short term as the process brings to light existing yet undiscovered vulnerabilities. But this approach simply means that insecure code will become secure more rapidly," Pescatore writes.

Allchin's belief that security offers a valid reason to reject making source code visible is misplaced, the analysts conclude.

The disclosure by Microsoft of technical information to rivals, which would allow them to make sure their software works better with Windows, is among the remedies put forward by the nine dissenting states during the current anti-trust trial. ®

Related stories

Eight new IIS security holes exposed
MS taunted with 'trustworthy computing' Web page
MS' highest priority must be security - Billg
MS asks time-out to re-consider states' demands
Ballmer weeps for Windows - video clip
MS opponents may testify
Little comfort for MS in dissenting states' memo

Securing Web Applications Made Simple and Scalable

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.