Feeds

Vista: fit for purpose...

Slip of the tongue - or the brain

High performance access to file storage

Comment The UK Developer launch of Windows Vista and the 2007 Microsoft Office System was pretty impressive, as such things usually are.

A 3D representation of the London Underground system from Lars Lindstedt's Microsoft Technology Centre at Thames Valley, complete with trains moving around in real-time, was particularly impressive (although only a "proof of concept" for now).

Nevertheless, the presentations were rather preaching to the converted. At one stage, the audience was asked who was using Outlook and more-or-less everyone (bar yours truly) stuck up their hand.

However, my ears really picked up as I heard Sanjay Parthasarathy (VP of the Developer and Platform Evangelism Group at Microsoft Corp [`VP of evangelism’ - Why not just call him the archbishop? - Martin Banks] and keynote speaker) say something like “Vista can guarantee the privacy of the individual”.

Well, I had a chance to talk to Sanjay afterwards and followed up on his privacy remark. And do you know what? Face-to-face, he said that was a slip of the tongue and he didn't mean it... Which is possibly fair enough, given his travel schedules [can't Microsoft afford to get him a good night's sleep before keynote presentations?] but it's a real lost chance to differentiate Vista, because you could only really be sure of satisfying such a promise if the platform code had some level of implied "fitness for purpose" warranty – and that's an idea that's long overdue.

It would probably be unfair to expect an operating system, say, to be "proven correct" in any significant way [irony is your friend]; but if its security and ID management subsystems were warranted "fit for purpose" (so that errors in the security and identity management systems could be fixed at some especially high priority, and at no cost to the customer, or something like that), it'd be a really good basis for reliable business computing. Oh well, something for the next generation of OS after Vista, I suppose - we can't expect to run before we can walk...

Except that, I'm sure that I remember, from some 25 years ago and in a different galaxy and on a different OS (MVS), that IBM "guaranteed" that two users in different address spaces couldn't access each other's information. What that really meant was that IBM took any reports of such a breach very seriously and fixed them at the highest priority, without charging you. So surely, going a bit beyond this, a fitness for purpose warranty isn't too much to expect of a 21st century OS?

Apparently it is. It's not just Microsoft that has a pusillanimous approach to warranting its products as "fit for purpose". The CDDL open Source license (used for OpenSolaris), for example, says (here):

5. DISCLAIMER OF WARRANTY

COVERED SOFTWARE IS PROVIDED UNDER THIS LICENSE ON AN AS IS BASIS, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, WARRANTIES THAT THE COVERED SOFTWARE IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE COVERED SOFTWARE IS WITH YOU.

All in CAPS too. Software isn't cheap, neither are the people producing it – is this really good enough?

And don't say that it is impractical to give guarantees for software – you'll be saying "software must have bugs" next. Because if I remember correctly, a firm called Praxis in Bath currently warrants that its software meets its spec, (it'll fix any deviation from spec for nothing), which is lots better than most software vendors can manage. Of course, that warranty isn't much of a risk when independent assessments of your systems find zero defects (a consequence of using formal proof and static analysis to generate code that is right first time) – and, again of course, some of the savings from the use of "correct by construction" methods have to be ploughed back into validating the spec.

But why isn't all software, or at least the critical parts of a general platform such as device drivers and security modules - built the way Praxis builds software? And, by the way, IBM was using formal specification languages (an Oxford University collaboration with IBM Hursley, under Sir Tony Hoare; see here and here) in building CICS transaction processing back in the eighties. Which is perhaps partly why there's so much CICS still around (although CICS delivers nothing like the security guarantees, nor the overheads, of MVS or zOS, to my mind).

No, software should have at least a limited "fitness for purpose”" warranty. It costs enough (even Freeware costs money to provision, support and de-provision) and it is critical to many businesses. Mind you, such a limited warranty would be hard to formulate in practice – but without it there's the suspicion that software companies are really admitting that they can't write code they can be confident in. ®

High performance access to file storage

More from The Register

next story
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Windows XP still has 27 per cent market share on its deathbed
Windows 7 making some gains on XP Death Day
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
US taxman blows Win XP deadline, must now spend millions on custom support
Gov't IT likened to 'a Model T with a lot of things on top of it'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.