Slashdot Log In
Microsoft Opens Its Security Research Cookbooks
Posted by
Soulskill
on Thu Dec 27, 2007 10:31 PM
from the now-cook-me-up-some-pie dept.
from the now-cook-me-up-some-pie dept.
greg65535 writes "Today Microsoft launched a blog about the internals of their IT security research and patch development process. There are already some posts that you will not find in the official security bulletins or KB articles. One of the posts says, 'We periodically identify workarounds or mitigations like this that we can't use for official guidance because they're either too nuanced or have some exception cases. When we discover something potentially useful but are uncomfortable listing it in the bulletin, we'll do our best to describe it here in this blog.' It looks like Microsoft is making an effort to become more 'open' in the area of security research and communication."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Microsoft Security Protocols (Score:5, Funny)
Chapter 1.
If someone knocks on the door, use the little peep hole.
Re: (Score:3, Funny)
BAMF! (Score:3, Funny)
An unidentified program wants to use your little peep hole.
The source and purpose of this little peep hole is unknown. Don't use the peep hole unless you have used it before or know where it's from.
CANCEL/ALLOW?
Re: (Score:2)
"Heyyy.. Is thaatt a bug?? Give me a hug..."
Re:Microsoft Security Protocols (Score:5, Insightful)
Security is about the best tool for the job and it's not always the Open Source tool, with the "street cred". When you say you're an IT professional, do you by chance mean you work for a small business, supporting other small businesses, (with pirated copies of Windows)?
No one avenue is the correct choice for security. You should chose the complete set of tools from a variety of vendors, who offer total support. Good luck getting official support with tripwire on Debian.
Cisco are a proprietary vendor - are you telling me they have no quality solutions? I suppose you don't use Symantec or another vendors AV, on your client desktops? Microsoft ISA actually offers a very robust and powerful firewalling system, for exampling, allowing you to internally spoof/proxy SSL certificates to domain members so you can even inspect encrypted packets on the network. Maybe not a polite thing to do but clearly useful in some organisations.
And while we're on it, Domains... Active Directory is a security tool in itself. Locking down desktops and client machines is a key security method and AD offers about the best way to do this on the market - I suppose you use Samba and about 500 perl scripts, instead, do you?
What utter garbage...
Parent
Re:Microsoft Security Protocols (Score:4, Informative)
Luck has nothing to do with it. Reading the extensive list of consultants [debian.org] categorised by country on the Debian site has everything to do with it.
Parent
MOD PARENT FUNNY Re:Microsoft Security Protocols (Score:3, Funny)
Quoted for hilarity. Up to that point I thought your post was actually serious. Haven't seen a punchline that good in ages.
yeah but (Score:4, Funny)
That's just because they haven't found a way to launch chairs at people through the internet.
Re: (Score:2)
Not now Kato you fool!!!!! (Score:4, Funny)
Microsoft Security Research: Do you know what kind of a bomb it was?
Clouseau: The exploding kind.
A question for Mahatma Ghandi (Score:5, Funny)
Answer: I think it would be a good idea.
depends on the meaning (Score:2, Offtopic)
That depends on what the meaning of is is.
But will they release source code... (Score:5, Insightful)
Microsoft likes to throw around the word "open" a lot these days, but most smart people in the industry remain skeptical. Take, for example, what open standards advocate Russell Ossendryver has to say about Microsoft's supposed open OOXML format [fanaticattack.com]: So how open is open? Unless the code is considered open under OSI standards or Free under FSF guidelines, it's really still just a pig with lipstick and a dress.
Re:But will they release source code... (Score:4, Interesting)
Parent
Re:But will they release source code... (Score:5, Insightful)
When I provide code for people, projects, or even companies who's software I use, I could really give a rats behind if its open source or not. Sure it would be NICE but hardly REQUIRED by me at least.
If you don't like what will be done with your free labour then don't provide it, no one is forcing you to. I like people who contribute and provide there free time, but I don't like it when those same people feel that since its so called FREE LABOUR that they can start imposing what can and should be done with there FREE LABOUR. It just doesn't work that way
Yes you are providing a service, yes it is welcome by the recipient and community, NO you shouldn't have a say in what way your contributions are disseminated because it was your choice to provide the service and no one else's.
I don't know about you but I provide my code because I want a better end product, not because I want it to be free in the open. If the code I provide will make my life easier then do with it as you will. Just because its not OPEN SOURCE like you say doesn't mean that it doesn't perform any good for the community of users for software X. Besides you wrote the stuff, unless you signed a legal waver to your code then nothing is stopping YOU from releasing it OPEN SOURCE style.
Parent
Too nuanced? (Score:5, Insightful)
I'll tell you why...because they assume that Windows administrators are idiots. Now, I've known some stupid Windows administrators in my day, but I wouldn't go so far as to think that most of them are idiots.
Re: (Score:3, Insightful)
If they say it, thousands of customers will implement it without understanding the things that might break by removing that setting.
Then they call Microsoft for help fixing it. (Oddly enough, you'd think that would actually drive them to do this, since it would guarantee more
Blog tuesday! (Score:2)
So what... (Score:2, Insightful)
The real problem is twofold... first, denial; for so long Microsoft (as well as many other mainstream software companies) refused to admit that there was a problem and didn't spend any time or money on the problem. This
Wireshark (Score:3, Interesting)
Re: (Score:3, Informative)
Microsoft Opens Its Security Research Cookbooks (Score:2)
Re: (Score:2, Insightful)
Re: (Score:3, Insightful)
A statement of intent and two example postings is "making an effort"?
You're being very generous to a company with a long history of abandoned promises and vapourware.
How about we wait and see how they perform for a few months instead of offering immediate praise?
Re:Can we revisit the tag thing? (Score:4, Funny)
- that there is a 35 character tag
- or that you took the time to count it
Parent