Feeds

Open source review would aid Windows security: Gartner

Aargh... Not the garlic

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Microsoft should dump security via obscurity, and submit its software to open source review, according to Gartner.

The open source review bit is something so utterly alien, communist and horrible to the mind of Bill Gates that it's almost worth us running a competition to find what he'd rather do (Sacrifice of firstborn? Auction wife on eBay? Tell Steve Jobs he was right?) - but actually, Gartner is perpetrating a small piece of sensationalism by saying it agrees with Gates about security, "and believes that open source review of Microsoft's code is necessary to meet security goals."

Which is not the same as saying this is what Bill believes, but they had us going for a moment there.

Gartner contrasts the assertion by Jim Allchin, Microsoft's senior vice president for Windows, that Windows boxes would be more vulnerable to attack if the company had to disclose technical information to rivals with previous pronouncements by his Billness.

But computer hackers have had little difficulty breaking into Microsoft's closed-source software, it notes.

Gartner analyst John Pescatore writes : "a strategy of relying on security through obscurity (hiding source code) has already proven a failure for Microsoft. To make future products more trustworthy, Microsoft will have to become more expert at developing code that can withstand external review."

Over the long term open documentation and public review of program interfaces between OSs and applications will lead to better security for Microsoft, Gartner believes, even though it notes some short term problems.

"Attackers may exploit the exposed interfaces in the short term as the process brings to light existing yet undiscovered vulnerabilities. But this approach simply means that insecure code will become secure more rapidly," Pescatore writes.

Allchin's belief that security offers a valid reason to reject making source code visible is misplaced, the analysts conclude.

The disclosure by Microsoft of technical information to rivals, which would allow them to make sure their software works better with Windows, is among the remedies put forward by the nine dissenting states during the current anti-trust trial. ®

Related stories

Eight new IIS security holes exposed
MS taunted with 'trustworthy computing' Web page
MS' highest priority must be security - Billg
MS asks time-out to re-consider states' demands
Ballmer weeps for Windows - video clip
MS opponents may testify
Little comfort for MS in dissenting states' memo

Intelligent flash storage arrays

More from The Register

next story
That dreaded syncing feeling: Will Microsoft EVER fix OneDrive?
Microsoft's long history of broken Windows sync
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
SLURP! Flick your TONGUE around our LOLLIPOP – Google
Android 5 is coming – IF you're lucky enough to have the right gadget
Nokia's N1 fondleslab's HIDDEN BRILLIANCE: The 'Z Launcher'
Sugarcoating Android's Lollipop makes tab easier to swallow
Bug fixes! Get your APPLE BUG FIXES! iOS and OS X updates right here!
Yosemite fixes Wi-Fi hiccup, older iOS devices get performance boost
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
Meet Windows 10's new UI for OneDrive – also known as File Explorer
New preview build continues Redmond's retreat to the desktop
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.