Microsoft Unveils Open Source Exploit Finder 310
Houston 2600 sends this excerpt from the Register about an open-source security assessment tool Microsoft presented at CanSecWest:
"Microsoft on Friday released an open-source program designed to streamline the labor-intensive process of identifying security vulnerabilities in software while it's still under development. As its name suggests, !exploitable Crash Analyzer (pronounced 'bang exploitable crash analyzer') combs through bugs that cause a program to seize up, and assesses the likelihood of them being exploited by attackers. Dan Kaminsky, a well-known security expert who also provides consulting services to Microsoft, hailed the release a 'game changer' because it provides a reliable way for developers to sort through thousands of bugs to identify the several dozen that pose the greatest risk."
auto-hack or brute force? (Score:5, Insightful)
Does this bombard all exposed functions with garbage data and look for overflows, or does it actually comb source code, look for off-by-one bugs and try to outwit the code by using boundary conditions? It's nice for Kaminsky to praise his pimps, but how does this tool really differ from any of the other leak-detectors and bug-finding tools that already exist?
Re:Open Source?! Wait for it... (Score:3, Insightful)
Definitely not.
Microsoft doesn't have anything about open source actually. They're perfectly fine with the BSD for instance, which they can incorporate in their products. They're also fine with their own "shared source" deal, which goes from "non commercial" to "you can only look at it".
What MS really despises is the GPL. They can't use it, and can't buy the source out in many cases. Of course they could technically use it, but they could apply the "embrace and extend" tactics, and would have to give out any improvements.
Re:This is M$ double speak for "Finding Free Sofwa (Score:3, Insightful)
Also, your suicide joke wasn't funny.
Re:This is M$ double speak for "Finding Free Sofwa (Score:5, Insightful)
yeah, FOSS exploits are cuddlier
But strange that in the 20 years I've been using Microsoft OSes, I've never had a virus or trojan or malware. I must be doing something wrong.
Re:There's already proof that this can't work (Score:3, Insightful)
Has anybody every told you "'Perfect' is the enemy of 'good enough'."? Perhaps after listening to you explain why your project is behind schedule, then sighing and face-palming?
The halting problem says that there cannot be a GENERAL ALGORITHM that works in all cases, for any of the infinity of possible programs that can exist.
That proves ZERO about, say, whether I can write an algorithm that covers 99% of the common cases. The lack of a general solution doesn't imply that it can't be done often enough, in practice.
Re:THOUSANDS OF BUGS? (Score:5, Insightful)
How large of a programming team do you work with? And how big are the projects to which you contribute code? And what kind of development model do you use (waterfall, Agile, ad-hoc, etc.)?
Shipping a large project with 1,000 bugs might be a perfectly valid decision. Are any of those 1,000 bugs deal-breakers for your install base? If so, how many clients does it affect? Are these "real bugs", or just incomplete/unpolished functions, or documentation issues, or output typos, or what?
And what kind of software is this? Are you building a time & expense web application, or a filesystem driver? In the former case, most bugs will be interface glitches--ugly, annoying, and harmless. In the latter case, even one bug could easily cause silent data corruption.
Remeber what Linus Torvalds said: Release early, release often. Don't wait til all your bugs are fixed before shipping your software, or you'll lose your "market" window. If it's good enough, the early-adopters will understand, and might even contribute bug reports or patches that will speed you up.
Re:There's already proof that this can't work (Score:3, Insightful)
Re:Enough problems of their own (Score:5, Insightful)
So, why doesn't Microsoft produce these tools for Windows, so the mass populace can help identify, log steps to reproduce, and report the exploits? Why are they using their resources to create tools for testing open source software for exploits? It is so they can give windows fanbois tools to create yet more anti-Linux and anti-F/OSS FUD, pure and simple.
Are you retarded? This tool isn't a "find exploits in open source software tool." It's an open source "find exploits in software tool". So Microsoft has an internal tool that they've developed to search for exploits in their software like Windows and Office, but they decided to open source that tool and share it with everyone else. It has nothing to do with Windows versus Linux.
As far as your ridiculous rant regarding Windows and programs running as Administrator, if you actually looked at the most recent versions of Windows, the number of system services that run under NETWORK SERVICE and other less privileged accounts has been increased, and with UAC, running users as non-admin is actually feasible. I don't know if you'd ever tried running as non-admin under XP, but the idea of logging out and logging back in to make a change, or hoping to hell that runas will actually work, just makes no sense. In addition, their work on Protected Mode where IE runs in a sandbox is another example of MS working to implement the least privilege principle.
Microsoft has made *considerable* progress on the non-admin front, and continues to work on that.
Oh, and whoever modded you up for this nonsensical misinterpretation of the tool needs a meta-mod down.
Re:This is M$ double speak for "Finding Free Sofwa (Score:5, Insightful)
You know, I'm starting to take issue with comments that protest the use of the M$, Micro$oft etc. memes. I know how something can get on your tits - articles that identify companies by their stock symbols is a particular irritant of mine.
But being annoying to a given reader does not cause a comment to lose all credibility. I mean, you can judge a comment by any criteria you choose, even moderate that way if you like. But you and I can't have a conversation either, if at any time you might write off everything I've said because I violated some arbitrary boundary you have. It's like people who dismiss an otherwise intelligent comment because it was posted AC. Again, it's their prerogative, but it makes it hard for the rest of us to talk to them.
And I am not suggesting the comment you replied to was "otherwise intelligent." The comment you replied to was obviously a troll, and should be dismissed for that reason. I would agree that a user who says something like "Winblows" isn't making any kind of lucid point with that act, but he may just be really frustrated for a good reason. Let him vent - he "paid" for that right - then see if he has an actual point.
In defense of the use of M$ etc, I see it as sort of a short hand, like Garry Trudeau would do with politicians. A feather for Dan Qualye, a bomb for Newt Gingrich ... To a passionate free software advocate, M$ is a concise, efficient and - IMO - accurate moniker.
In two characters, the anonymous poster - who is probably Twitter - told us all we need to know about his opinion of Microsoft. I don't think an anti-Microsoft - or anti-Google/Linux/Apple bias for that matter - invalidates anyone's opinion. If it does, good grief we're all doomed.
BTW, I agree with you about the suicide remark.
Re:THOUSANDS OF BUGS? (Score:3, Insightful)
Not all software is a product for sale, and in the real world there are deadlines and budgets. Users can deal with bugs, business owners can't deal with late, over-budget projects.
Re:Direct link to explanation (Score:3, Insightful)
Naturally, that's an OOXML file that OpenOffice doesn't quite display properly. Outline view seems to be the best.
Re:Libre? (Score:4, Insightful)
You mean, "It's from Microsoft! It must not be labeled as open source, even if it is!"
If you aren't saying this, then maybe you can say in what aspect the license doesn't meet the Open Source Definition [opensource.org]
.
Re:This is M$ double speak for "Finding Free Sofwa (Score:4, Insightful)
To a passionate free software advocate, M$ is a concise, efficient and - IMO - accurate moniker.
It's also meaningless, since every business is out for dollars. You might as well say $un too, and same goes for any business with an "s" in its name.
Re:This is M$ double speak for "Finding Free Sofwa (Score:5, Insightful)
You know, I'm starting to take issue with comments that protest the use of the M$, Micro$oft etc. memes. I know how something can get on your tits - articles that identify companies by their stock symbols is a particular irritant of mine.
But being annoying to a given reader does not cause a comment to lose all credibility. I mean, you can judge a comment by any criteria you choose, even moderate that way if you like. But you and I can't have a conversation either, if at any time you might write off everything I've said because I violated some arbitrary boundary you have. It's like people who dismiss an otherwise intelligent comment because it was posted AC. Again, it's their prerogative, but it makes it hard for the rest of us to talk to them.
And I am not suggesting the comment you replied to was "otherwise intelligent." The comment you replied to was obviously a troll, and should be dismissed for that reason. I would agree that a user who says something like "Winblows" isn't making any kind of lucid point with that act, but he may just be really frustrated for a good reason. Let him vent - he "paid" for that right - then see if he has an actual point.
In defense of the use of M$ etc, I see it as sort of a short hand, like Garry Trudeau would do with politicians. A feather for Dan Qualye, a bomb for Newt Gingrich ... To a passionate free software advocate, M$ is a concise, efficient and - IMO - accurate moniker.
In two characters, the anonymous poster - who is probably Twitter - told us all we need to know about his opinion of Microsoft. I don't think an anti-Microsoft - or anti-Google/Linux/Apple bias for that matter - invalidates anyone's opinion. If it does, good grief we're all doomed.
BTW, I agree with you about the suicide remark.
I beg to differ. If you're so puerile to have the need to use "M$ Winbloze" or "open sores software" in a rational discussion, it seems as if you're trying to sidestep the issue with colorful language. Call things by their name and focus on arguments rather than taking trite potshots.
As for identifying corporations by their stock ticker symbols, it allows to easily differentiate between corporations who would have otherwise similar names(for example, an article talking about the Royal Bank could refer to both RY and RBS) and to look them up quickly and unambiguously.
Re:This is M$ double speak for "Finding Free Sofwa (Score:4, Insightful)
Every time I hear anyone using any system say, "I've never had a virus or trojan or malware," I always think, "there is a guy who doesn't know how to detect malware on his machine." And it's usually true.
I'm not saying you don't know how, but you said a genuinely stupid thing right there. It's possible that right now you're computer has been rooted, covered up, and you don't even know it. Because Microsoft sure wasn't protecting you for the last 20 years.
Re:There's already proof that this can't work (Score:2, Insightful)
Railroad crossing gates are intuitive for most people: train may pass by crushing and killing you, so such a crossing calls for extra attention automatically.
Smoke detectors do not cause most people to suddenly leave their burning candles unattended or to start playing with matches.
'Bridge out' warning signs call on the viewer to pay extra attention.
So, anti virus software makes ppl less attentive, railroad crossings and warning signs make ppl more attentive and smoke detectors do not alter behaviour. I am afraid I fail to see your point.
Re:Open Source?! Wait for it... (Score:5, Insightful)
If Microsoft really wanted to release source in a way that is useful for the community, then they would be compatible with the GPL or would simply use the unmodified GPL.
Oh bullshit. Something doesn't have to be GPL to be useful for the community - take FreeBSD for instance. Demons, GPL zealots are as bad as Apple zealots!
Re:Libre? (Score:3, Insightful)
The GPL license is just about protecting individuals who want to develop and use software in freedom. It's up to you to take advantage of this protection or not
The best protection is public domain. Retaining ownership to force an ideological end is silly. The GPL was born out of emacs getting "ripped off" by other people... but did that stop emacs at all? Nope, we're still stuck with it, even though everyone knows vi is better....
Re:This is M$ double speak for "Finding Free Sofwa (Score:3, Insightful)
While an argument shouldn't be cast aside just because someone uses M$, I don't agree that it is "a concise, efficient and - IMO - accurate moniker".
You don't agree that text in bold is HIS opinion? I don't agree with your disagreement :P
Re:Libre? (Score:2, Insightful)
Re:Libre? (Score:2, Insightful)
If you look for hypocrisy, you should probably have a look at other license before criticising the GPL. Also you must have a distorted view of the situation if you criticise GPL developers for incorporating BSD code, but at the same time you are completely oblivious of the fact that entire software companies are making money from selling modified BSD software without contributing back.
Re:Libre? (Score:3, Insightful)
The definition of Open Source compatible is not: a license which can be used interchangeably with any other Open Source license.Some licenses are compatible with each other and others aren't. It is called freedom of choice, which is what FOSS encourages and promotes.
Holy shit I'd like to hit some of you with a serious clue stick right about now
Re:Open Source?! Wait for it... (Score:3, Insightful)
If you believe that recognizing the strategic aspects of Microsoft's business decisions makes one a zealot, then you are fortunate. You are fortunate because you have never seen a real zealot.
The same thing that would happen if a Free Software developer were found using Microsoft's non-GPL code in their GPL software: a legal problem. The incompatibility of the licenses is mutual and I never suggested otherwise. Thus, I'm not sure what you believe you are explaining to me.
Microsoft can use GPL code if they want, they just have to honor the GNU Public License. They have chosen not to do that, which is their prerogative. Microsoft can't (legally) use GPL code in their closed-source software, and I am "totally cool with that," yes. Free Software developers who release software under the GPL can't (legally) use Microsoft's non-GPL code, and I am "totally cool with that" too. I never claimed it was a crime against humanity. I claimed that there are consequences which work together to make sure that this situation doesn't do very much to benefit the Free Software community and that Microsoft, since they are not stupid, knows this. You do know that the purpose of Open Source is so that other developers can actually use the code, right? Your reaction is out of proportion to what I was saying and I suspect that you know it.
But that's exactly my point. GPL'd software is indeed their competitor and shrewd businesses, such as Microsoft, don't assist their competitors. That's why it doesn't make much sense to celebrate Microsoft's "open source" when it's "open source" that most of the community cannot use. Open Source that you can't actually use might as well be closed source. That wasn't a complaint, by the way, it was an observation.
The observation is very simple. The point of the GPL is freedom. Most Free Software developers use the GPL for that reason. Microsoft cannot profit from this. Microsoft then releases non-GPL-compatible code. Free Software developers cannot use Microsoft's code without losing the full freedoms of the GPL. Thus, it would be a mistake for them to do anything but ignore Microsoft's code because the price for using it is too high. If there is any part of that which you do not understand or which looks like I am "complaining about a crime agianst humanity", you let me know and I'll clear it up for you.
I don't really "blame" them because I would have to blame them for being true to the nature of a corporation. Their position is easy to understand and the actions they are taking are predictable. What I question is the "greatness" of Microsoft "joining the open source game" when they are doing it in a way that ensures that the existing "players" of the "open source game" cannot utilize their contributions. It's a PR move, plain and simple. Good PR for Microsoft and a way to tempt developers away from the GPL might be a reason for Microsoft and its stockholders to celebrate but it's not a reason for anyone else to celebrate.
Microsoft has produced code that is "open" in name only and is actually all-but-useless for develo
Re:Open Source?! Wait for it... (Score:2, Insightful)
"... nor would it disallow anyone from modifying the original BSD code to mimic the closed-source project's new functionality "
How do you make that leap? As I mention above, neither BSD or public domain prevents the commercial vendor (or an individual for that matter) from copyrighting their deltas. Were you to do something similar, it is an open question whether they would have a court case against you. Worse, of course, if they got a software patent.
"It's simple and boring, and doesn't really make good cocktail party conversation. Maybe that's why it gets overlooked..."
Uh, yeah, I am SO sure that is why IBM, HP, Oracle, etc, etc choose to participate in GPL projects, even though BSD has been around so much longer. Couldn't have anything to do with the guarantee of a level playing field. I think you nailed it. It must be the cocktail party conversation value ......
Damn, I see bold, itallic, where is irony?
Re:Open Source?! Wait for it... (Score:3, Insightful)
So Microsoft can't use GPL code, and you're totally cool with that.
What an asinine assertion! Of course MS can use GPLed code, just like anyone else can. They just have to abide by the terms of the license... you know, just like anyone else.
Re:Open Source?! Wait for it... (Score:3, Insightful)
demonizing me and calling me "zealot" and other names because I dared to make observations and support them with reason
Sorry, your long winded response isn't going to convince me otherwise. The article and summary simply stated that Microsoft had released open-source software, which they did. You're an evangelist of a particular open source license that has all sorts of religion behind it, preaching down other licenses that don't align themselves with your principles. To say that nobody will find this useful is ridiculous. Sure, your "community" might not have any use for it. What is it with your community and their sense of entitlement?
Eh let's make one observation that should be fairly obvious: if not for the success of Open Source software under the GNU Public License, of which the most prevalent expression is the GNU/Linux operating system and its associated applications, then Microsoft would not now show any interest in publically releasing any code of theirs. As much as they talk of innovation, and as many new things as they have genuinely innovated, Microsoft is just following someone else's lead on this one.
So, Microsoft sees an existing community based on the ideals of Open Source software. This is an active, vibrant community that continues to grow. That community has largely standardized on the GPL. Thus, there is already an established and widely-used way to do this. Microsoft sees that and does it another way. That cannot be an accident. It is obvious that any incompatibility is deliberate. The reasons you gave are adequate to explain it; GPL is a competitor.
So I sign onto Slashdot and I see a story about this. Then what do I see? I see people coming from a largely Linux background discussing the merits of Microsoft's code as though it were of any use to them. My message was for them, that this is not the community contribution from Microsoft that they may have been expecting. This is, in fact, a PR move. Companies make PR moves expecting that people who see them will be impressed by them. I'm not. Knowing that any good feelings I may have had about this were carefully engineered by someone in Microsoft's marketing department really ruins them for me. I don't know how I could more simply explain this to you.
Now, I see the GPL and I find that it works. The Free Software community did not just arbitrarily choose the GPL because they rolled some dice. The GPL works and it works for a reason. It provides everything you need to have this sort of community based on the free exchange of ideas. Thus, I am not an evangelist, no more than I am an "evangelist" for aspirin if I tell you that it will make a headache go away. Further, you have a screwey definition of "entitlement". When I say "this is not useful for the community" that is not a statement of entitlement. Now, if I said "this is not useful for the community and this is some sort of crime" then THAT would be entitlement. Now that someone has illustrated the difference for you, you can avoid this sort of confusion in the future.
In reality, people like you are a dime a dozen. You think you know the first thing about me, including what I believe, how I am motivated and why I might say what I say. Like most of your kind, you don't realize that I am the world's foremost expert on what I think, so even when I tell you that your assumptions about me are wrong, you continue to argue. That you presume to know where I am coming from better than I would know this, and without claiming any sort of psychic powers, is quite amazing. This, by the way, is why the Open Source community often discourages its more religious advocates -- people like you can't tell the difference between a real fanatic and someone who merely appreciates freedom, and yet you feel entitled to paint with a very broad brush. I'd like to see what you as an individual look like when you jump off of this bandwagon.
Get a little d
Re:Open Source?! Wait for it... (Score:3, Insightful)
That's quite trivial, though "holy" is your word, not mine. You just can't get over the fact that someone can appreciate freedom, including software freedom, without being a zealot and so you feel the need to insert words that I clearly never used. Feel free to perform a text search on this thread if you don't believe me; you won't find me calling it "holy" anywhere, nor will you find me saying that anyone "must" adhere to it. That you feel a need to do this is a position of weakness that you'll abandon once you see the folly of it for yourself.
To answer your question: the majority (perhaps a plurality) of all Open Source software is licensed under a version of the GPL. When I say "community" below, I refer to every Linux distribution and almost every piece of Linux software as well as cross-platform Free Software such as FireFox and all of the associated programmers and users. All of those either directly use or derive some benefit from the GPL. The reasons for the GPL's prevalence are not difficult to discern; it provides everything you need for the free exchange of ideas and prevents others from removing those freedoms. That's why the growth of available Free Software skyrocketed when the GPL was adopted, in a way that it did not with the existing BSD-style licenses.
In other words, it works and it works well and among members of the community it is widely used. That's exactly why I make the self-evident observation that if someone wants to do something for that community, they would do so under the GPL or at the very least, a license that is compatible with it. From there it follows that it was not Microsoft's intention to allow this community to derive any benefit from its code. That is emphatically not a statement that they should have done otherwise; it is a simple observation. Thus, the community has no reason to celebrate Microsoft's published source code. To you or me, Microsoft's business position is obvious; unfortunately, some people are a bit naive and need to have this pointed out. Thus, the purpose of making this claim was to correct the growing misconception that Microsoft is ever going to be an ally of Free Software, which is a stricter term than "Open Source".
That was my sole claim. So far you've addressed 2-3 claims I never made. That you can do that without feeling silly should give you pause. It's somewhat rare but you are not the first to do this whom I have encountered. At any rate, your choice now is to either address that claim or to set up another straw man consisting of claims I never made and then proceed to attack that straw man. If you do, I'll see the weakness of the tactic and the desperation to feel "right" that drives it and I'll observe this knowing that it is beneath you. Now, I challenge you to either demonstrate why my reasoning is flawed or admit that zealots are not known for correct reasoning. You are unable to perform the former and you're prideful enough to have a difficult time with the latter, obvious though it should be.
I'm interested in how you resolve the dilemma. If you want to continue down the path you are already on, you could try a little harder to make this into a personal matter. If so, you will fail because that isn't tempting for me no matter how belligerent you get, but it's the only "third option" you have other than just deciding not to respond at all. I think you can do much better than the desperation you have shown so far, but that's not very important unless you also think so.
I think this whole argument between us occurred because you could already see Microsoft's business position and its implications on your own. To you that was obvious, and it should be, but there is a great deal of ignorance concerning basic business strategy and those who already understand it were not my target audience. Mayb