Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Education

Microsoft To Teach Undergrads About Secure Computing 444

Posted by timothy from the step-one-unplug-your-power-cord dept.
gcondon writes "The Register is reporting that Microsoft is teaming up with the University of Leeds to teach students how to write secure code. Given the sheer number of programming errors that can lead to security vulnerabilities, it probably makes sense to learn from the company that has tried them all." UndercoverBrotha points out that University of Leeds is one of several venues: "Microsoft is planning to offer 11-week courses at Universities around the world."

Update: 03/24 18:00 GMT by J : Another report worth reading is Writing Software Right, which requires a free but annoying registration at Technology Review. This regards automated methods of finding software errors (not security specifically). Sun's "Jackpot" is discussed, a lint that also "identifies general instances of good or bad programming."

And Microsoft's efforts in this field are explained as well -- the company "paid more than $60 million in 1999 to acquire Intrinsa, maker of a bug-finding tool called Prefix. The program, which sifts through huge swaths of code searching for patterns that match a defined list of common semantic errors, helped find thousands of mistakes in Windows and other Microsoft products." As a Microsoft QA person says, "Our challenge is to get our software to the point that people expect it to work instead of expecting it to fail."
This discussion has been archived. No new comments can be posted.

Microsoft To Teach Undergrads About Secure Computing More

Microsoft To Teach Undergrads About Secure Computing

Comments Filter:

  • This just in: (Score:5, Funny)

    by B3ryllium ( 571199 ) on Monday March 24, 2003 @01:51PM (#5584191) Homepage
    President George W. Bush will be teaching a course in diplomacy ...

    • Or Clinton teaching... (Score:2, Funny)

      by Anonymous Coward
      ...a course on honesty or fidelity.

    • Re:This just in: (Score:5, Insightful)

      by abhisarda ( 638576 ) on Monday March 24, 2003 @01:56PM (#5584241) Journal
      dare we suggest that microsoft start this initiative with its employees first?

      • Re:This just in: (Score:5, Insightful)

        by FeeDBaCK ( 42286 ) on Monday March 24, 2003 @02:39PM (#5584584) Homepage
        Actually, no. The main problem is that people need to learn to be better programmers from the start. It is much easier to have good code if it was fairly good when it was written, versus fixing it up later. This looks more like MS is working on making their next generation of employees better programmers to begin with rather than trying to change their already bad habits.

      • Re:This just in: (Score:4, Informative)

        by targo ( 409974 ) <targo_t.hotmail@com> on Monday March 24, 2003 @04:23PM (#5585415) Homepage
        dare we suggest that microsoft start this initiative with its employees first?
        This has already happened. Remember when Windows development was halted for a month to find and fix security issues last February? At the same time, all technical people at Microsoft had to go through a special security training. It was based on Writing Secure Code [barnesandnoble.com] by some MS insiders, a real good book in fact.
        I would think the particular course mentioned in the article would also feature this book.

        • Remember when Windows development was halted for a month to find and fix security issues last February?

          Yeah. A whole month to search and repair twenty years of accumulated bad hackery. And look at how well it worked!

    • and here is another : bill clinton takes a course on sexual faithfulness.
    • In addition to his regularly scheduled English courses...

    • Re:This just in: (Score:5, Funny)

      by TopShelf ( 92521 ) on Monday March 24, 2003 @02:13PM (#5584400) Homepage Journal
      don't forget the Arthur Andersen Advanced Seminar on Corporate Accounting!

    • Why not? (Score:5, Insightful)

      by iamacat ( 583406 ) on Monday March 24, 2003 @02:15PM (#5584415)
      How about that anti-smoking ad by a guy smoking through a hole in his neck? Or inmates coming to school to talk about abiding the law? I think Microsoft has quite a lot to talk about on the subject.

    • There's insight in the humor. (Score:5, Insightful)

      by melquiades ( 314628 ) on Monday March 24, 2003 @02:21PM (#5584467) Homepage
      Leaving personal politics aside -- whether you agree or disagree -- it's certainly the case that Bush's diplomacy and Microsoft's security have been called into question and are the center of heated debate. In situations like these, the actual facts play only a modest role in shaping public opinion, especially when the "facts" are nebulous, subjective, and largely unquantifiable. There are no established objective measures of computer security, and even less of diplomatic success, that do not rely heavily on retrospective data.

      In debates like these, perception and politics reign. And one surprisingly effective tactic is to assert the point under debate by calmly behaving as if there were no debate and moving on to the next step. If you simply act as if something is true, and act surprised when people question it, listener tend to build consensus around the confidence you project. Certainly the Bush administrations (and, of course, many previous administrations) have used this tactic extensively, and Microsoft seems to be using it now: If they're teaching a course on security, they must know security, right?

      This places those arguing the opposite side (pacifists in the one case, the Slashdot majority crowd in the other) in the awkward position of constantly having to re-establish that the debate is still open, without boring, tiring, or otherwise turning off the only semi-interested public.

      Note that none of all that maneuvering has anything to do with who's actually right.

      • Re:There's insight in the humor. (Score:5, Informative)

        by arkanes ( 521690 ) <<arkanes> <at> <gmail.com>> on Monday March 24, 2003 @02:37PM (#5584577) Homepage
        Microsoft Press publishes one of the best books I've ever seen on writing secure code (called, suprisingly, Writing Secure Code, ISBN 0-7356-1588-8). It's written by 2 MS engineers. I'd say there certainly are people at MS who're very qualified to talk about security, and, hopefully, those will be the ones teaching the seminars.

        The book talks a great deal about how having secure code is more than just the writing, especially in a corporate environment where you need to enforce standards on multiple programmers and have to deal with the pressures from marketing, etc. I think that, more than incompotent programmers, is what leads to the issues we see at MS.

        • Re:There's insight in the humor. (Score:4, Interesting)

          by alanwj ( 242317 ) on Monday March 24, 2003 @03:25PM (#5584978)
          Microsoft Press publishes one of the best books I've ever seen on writing secure code (called, suprisingly, Writing Secure Code, ISBN 0-7356-1588-8). It's written by 2 MS engineers. I'd say there certainly are people at MS who're very qualified to talk about security, and, hopefully, those will be the ones teaching the seminars.

          I'd say some of the gems of my book collection are from Microsoft Press. In particular, anything written by Jefferey Richter or Charles Petzold I'm willing to take on faith will be outstanding.

          Irrespective of feelings towards Microsoft (and I'm pretty far into the anti-MS camp), their Microsoft Press division has released some darn fine books.

          (Note: I only own 4 MS Press books, and all have been outstanding. This does not mean that there aren't hundreds of MS Press books that are crap, but that hasn't been my experience.)

          Alan

      • Re:There's insight in the humor. (Score:4, Informative)

        by jc42 ( 318812 ) on Monday March 24, 2003 @03:37PM (#5585063) Homepage Journal
        In situations like these, the actual facts play only a modest role in shaping public opinion,

        True, but public opinion has relatively little to do with whether your computers are secure or not. If it did, then nobody would bother with engineering approaches to security; they'd just set aside a large PR budget to create the public perception of security, and that would make their software secure.

        The main irony here is the old observation by many security people: If you want computer security, you never, ever allow any software to be run unless you have all the source and you've compiled it yourself. Otherwise, you have no idea what may have been hidden inside that binary by the people who sold it to you.

        It would be interesting to see whether Microsoft's teachers bring out this rule. Will they even mention the topic? If so, will they teach the course the second time?

        Granted, this isn't nearly the whole story. You must not just have the source. You must also have competent, trustworthy people on your staff who have the time to thoroughly take the software apart and understand it all. And even then, Ken Thompson's famous paper [acm.org] shows how subtle the problems can be.

        Still, as a baseline argument, any such course on computer security should start with the observation that if you allow binary software to be installed, you are utterly defenseless against the people who compiled and packaged it for you. This is really the main thing that needs to be said about security and Microsoft.

    • He's just seen Attack of the Clones a few too many times...

      "Aggressive negotiations?"
      "Negotiations... with a light saber."

    • Re:This just in: (Score:5, Funny)

      by jcsehak ( 559709 ) on Monday March 24, 2003 @02:41PM (#5584603) Homepage
      Oh come on, you could've done better than that. How about:

      -Bush to teach proper pronunciation rules

      -Saddam Hussein to teach pacifism

      -Hilary Rosen to teach kindergarten students how to share

      -Sesame Street's Elmo to lead seminar on economics of scale in prostitution rings in Las Vegas

      -Bob Dylan, Tom Petty, Emo Philips and Busta Rhymes to collaborate on an audio tape on public speaking

      -Britney Spears to offer songwriting workshop

      And finally, for all you non-PC folks,
      -Frenchman to teach course on how to fire a rifle

      Ba dum, crash!

    • Re:This just in: (Score:4, Funny)

      by infinite9 ( 319274 ) on Monday March 24, 2003 @04:35PM (#5585510)
      President George W. Bush will be teaching a course in diplomacy ...

      And Lybia will be chairing the commission on human rights... oh wait.

  • Experience... (Score:4, Funny)

    by Mike Rucker ( 639143 ) on Monday March 24, 2003 @01:53PM (#5584207)
    If someone is going to teach you about security holes I guess you might as well learn from a company that has a lot of experience with them...

  • Wrong topic (Score:2, Interesting)

    by haa...jesus christ ( 576980 )
    Shouldn't this be posted under 'Laugh'?

  • That'd be like... (Score:5, Funny)

    by Anonymous Coward on Monday March 24, 2003 @01:53PM (#5584213)
    CmdrTaco teaching kids about grammar.
  • Maybe they should teach their own programmers first.

    Probably their baselevel administrators too. I don't think it's the programmers that enable every service under the moon.

  • bashing in moderation (Score:5, Interesting)

    by Borealis ( 84417 ) on Monday March 24, 2003 @01:54PM (#5584221) Homepage
    I'm up for microsoft bashing as much as the next guy, but I think on this one it might be smart to look at the materials and teachers rather than the sponsor. There are a number of fine security conscious people at or indirectly employed by MS. Just because their suggestions are rarely implemented doesn't mean that they don't have good advice.

  • You know what they say: (Score:3, Funny)

    by cybermace5 ( 446439 ) <g.ryan@macetech.com> on Monday March 24, 2003 @01:55PM (#5584234) Homepage Journal
    Those who can, do. Those who can't, teach. Those who can't teach, write books.
  • The more interesting news article on Security Focus is:


    http://www.securityfocus.com/news/2028



    Last week the presidential-appointed commission responsible for setting federal sentencing rules formally asked the public's advice on the formula used to sentence hackers and virus writers to prison or probation, as part of a review ordered by lawmakers increasingly concerned that computer criminals are getting off easy.


    -m

  • Microsoft's university program is closely linked to its Trustworthy Computing initiative, its companywide focus on securing its products, which was launched early last year.

    Learn the kids to write spyware, yay.
  • As part of an 11-week module that will st art next January, third0year undergraduates at the University of Leeds will be asked to hack into software and fix any sucurity bugs they find [...]
    Wow, if they are "hacking" Microsoft's software, they have a ton of work ahead of them. Imagine all those security bugs ;)
    • You gotta be kidding me.

      90:1 odds they give them the new development Microsoft code and MS uses it as a cheap way to getting hole patches.

      I especially like the fact that that doesn't actually work that way. 99% of the crackers have no clue how OS's work. All it takes is one person of a couple million to find the whole, by the next day everybody knows about it....

      Security fixes come out in the real world because someone tells you that there's a hole in it. This is why programming companies hire testers. T
    • Imelda Marcos, "Financial Responsibility"
    • George W. Bush, "Diplomacy and Coalition Building"
    • Apple, "Marketing Your Invention" (co-sponsored by Xerox)

  • Is it April already? (Score:3, Funny)

    by cyber_rigger ( 527103 ) on Monday March 24, 2003 @01:57PM (#5584256) Homepage Journal
    Next thing you know Apple will be using Intel.
  • President Bush will be presenting a lecture series on international diplomacy and domestic economic policy.

  • Don't throw rocks (Score:4, Insightful)

    by allanweber ( 467416 ) on Monday March 24, 2003 @01:58PM (#5584263) Homepage
    This article is an obvious chance to bash M$, but take it easy.

    Yes, many security holes in Windows occur weekly, but so do they in Open Source software. The only diffrence is, that the OS movement releases bug-fix's usually within 24 hours unlike M$.
  • Microsoft has done an excellent [microsoft.com] job of appealing to undergraduates through the use of scholarships and internships. It only makes sense for them to start working directly [zdnet.co.uk] with computer science departments around the globe.

    GameTab [gametab.com] - Game Reviews Database

  • All humor aside... (Score:5, Insightful)

    by andyring ( 100627 ) on Monday March 24, 2003 @01:58PM (#5584268) Homepage
    If I were a student, or a college administrator, I would much prefer that a course in computer security be taught/aligned with a company that has a long, solid, proven track record in security, as opposed to a company whose track record is nothing but miserable. I know OpenBSD's security record is pretty strong, as is Apple's and I'm sure other vendors. But MS? It would be about like having a French general teach an ROTC class and makes about as much sense as Lybia charing the UN Commission on Human Rights and Iraq chairing the UN Commission on Disarmament (both of these are in effect right now, crazy as it sounds).

    • Maybe I'm just an old fuddy duddy, but. . . (Score:5, Insightful)

      by kfg ( 145172 ) on Monday March 24, 2003 @02:32PM (#5584543)
      I would much prefer that a course in computer security be aligned with a university and good general engineering practice and strictly eschew alignment with any company of any kind.

      Don't they have a *professor* qualified to teach such a course, and if not, why would anyone go there?

      Maybe I'm just being a *cynical* old fuddy duddy, but I smell payol. . . er, a donation. Ah yes, there it is at the end of the article. Go figure.

      I also strongly suspect that day one will *not* feature a lecture on the benefits of UNIX, how to uninstall Outlook Express or the security features built into Sun Java.

      Which is precisely the reason an institute of higher learning should shy away from such blatant association with a particular company who has a vested interest in the field.

      What's going to be next, the Christian Science Monitor Chair of Internal Medicine or Powerbar Chair of Exercise Physiology?

      KFG
  • MSDN has been churning out security-related articles [microsoft.com] for a few months now.

    Some of the stuff there is good (some of it is plain common sense), but I wonder if they're applying it to their own products. Supposedly IIS 6.0 was designed and coded that way *shrug*.

  • Against the grain (Score:5, Insightful)

    by FortKnox ( 169099 ) on Monday March 24, 2003 @01:59PM (#5584272) Homepage Journal
    So are you suggesting that no one in MS can teach secure and have secure code?
    Remember. Windows was made over several years and hundreds (if not thousands) of coders. We're talking older code, and thousands of different coders.

    But, hey, anything to insult MS, right?
    • I'm sure there are MS employees who could teach such a course. But wouldn't these employees be participating in MS' new focus on security? How many of their experts can they spare for several weeks?

      The real question is why are universities allowing a company notorious for insecure products -- with a corporate culture that focuses on shipping product regardless of security issues and with a obvious lack of ability to QA for such problems -- set up such courses? This is clearly for MS PR purposes, how much

  • It makes sense that they are doing this.

    Linux as a whole doesnt have so much money they have to give it away at an enormous rate, so MS will train the up and coming sys-admins into Windows and .net technologies, and the next generation will shun linux and MS will take over the world!
    This is the same diff as MS giving computers to libraries all over the world. Isnt it nice that they can copy a software CD for .02, and then donate it to charity for a $300 dollar write off??

  • My old uni already offered such a course.. (Score:5, Interesting)

    by weebler ( 661013 ) on Monday March 24, 2003 @02:04PM (#5584326)
    Apparantly, it is (well it was at the time when I still was at the University) one of the only places in the world to teach this course. It was also my favourite module.

    You can find a description here. [ukc.ac.uk]

    The only difference is that this module was intended to make undergrads see the failure and risk by means of software engineering, and we did this by looking at various procedures for writing secure code, and we looked at lots of examples from history (the challenger incident, for example, etc).

    This course seems to be aimed more at specific coding practices - avoiding buffer overruns for example. It doesnt look like they'll be told how to deal with failure once it happens (because it *will* happen). I also fear that since Microsoft will be involved, it'll be specific to Windows & x86 -- not a real life view of computing.

  • Writing Secure Code (Score:3, Informative)

    by xswl0931 ( 562013 ) on Monday March 24, 2003 @02:04PM (#5584334)
    MSPress actually has a really good book available called "Writing Secure Code". All it takes is a few bad devs to create a reputation for the whole company. [amazon.com]

  • Courses? (Score:5, Funny)

    by sevensharpnine ( 231974 ) on Monday March 24, 2003 @02:05PM (#5584347)
    Suggested course offerings follow:

    CSI1001: Introduction to the necessity of 3rd-party security modules in a Microsoft environment

    CSI1002: Trusted++ computing--how to manage your defenseless box on a multi-million node internet

    CSI2001: Rapid HotFix/Service Pack deployment

    CSI2002: (Continuation of 2001) Rapid HotFix/Service pack undeployment

    CSI3001: Microsoft and you--Introspectives on long-term site licensing and vendor lock-in
  • The students pay for the course with what they save on pirated MS sofware...

  • Just goes to show..... (Score:3, Funny)

    by s1r_m1xalot ( 218277 ) on Monday March 24, 2003 @02:06PM (#5584353)
    This just proves the old saying:
    "Those who can, do. Those who can't, teach"
    ;-)

  • Software Verification Is hard.. (Score:5, Insightful)

    by Bush_man10 ( 461952 ) on Monday March 24, 2003 @02:08PM (#5584364) Homepage
    I did a course in my computer engineering degree last term called Formal Methods where half the course we spent learning the "Cleanroom" method of coding. To put it simply this method makes you specify functions through math and the prove via math that your code does do what it is intended to do. Projects that have used the cleanroom method have reported roughly 2-3 errors per 1000 lines of code (on the first compile) and over 75% of the code compiles and runs correctly on the first try. They are very impressive number but they come at a cost of a learning curve and spending more time properly defining functions and classes. After doing that course I have a whole new respect for software verification. If anyone wanted to teach how to write secure code they should really invest their efforts in this proven method.

    • Re:Software Verification Is hard.. (Score:4, Interesting)

      by Lynn Benfield ( 649615 ) on Monday March 24, 2003 @02:28PM (#5584519)
      The technique you describe is part of a field known as "Formal Methods".

      The term "cleanroom" comes from reverse engineering, where you have team A of engineers write a spec for a competitors product and team B (who've never seen the product) write an implementation. This gives you some degree of legal protection, but does not prove anything about correctness.

      Of course, the flaw with formal methods is that they only prove the program is functioning as designed - which is definitely a worthwhile goal, but does not say anything about the correctness of the design itself. E.g., think of the problems with the incorrect mirror for the Hubble Space Telescope - the grinding machine worked perfectly, but the final mirror was still ground to the wrong shape.
    • I remember formal methods from University; one of my most hated subjects. Never touched it since.
    • Agreed. FYI, semiformal and formal design specifications come in at the higher assurance levels of the Common Criteria. Semiformal refers to something written in a restricted syntax language (could be natural language) and, as you said, formal uses notation based on mathematical concepts.

      EAL5 requires a semiformal functional specification and high-level design (along with other development evidence). A semiformal low-level design is required at EAL6 and formal specifications are required at EAL7.
    • I once headed a team to build a proof-of-correctness system for a dialect of Pascal. (The writeup is in POPL '83). It's quite possible to do this, but it is hard. Without mechanical assistance, it won't work at all; it's far too much work and you get false proofs from hand proving.

      This technology isn't used much in software any more. Why? Programming languages are worse. The semantics of Pascal are well-defined. C and C++, with casts, unions, void, and such, are hard to formalize. The strict languag

    • Formal methods in an informal world (Score:5, Interesting)

      by coyote-san ( 38515 ) on Monday March 24, 2003 @03:11PM (#5584883)
      I've used formal methods in a few places... much to the indifference of colleagues. I remember one time finding a subtle bug via Z-notation and fixing it, then moving on to another project while several of my former coworkers criticized my code as "unnecessarily complex," etc. A couple years later I happened to overhear a conversation that strongly suggested somebody had "cleaned up" my code, then actually encountered that rare, subtle bug years later and had great difficulty (and pride) in fixing it.

      So formal methods are extremely powerful... but I rarely use them now. The problem is that few problems are so well defined that you can use them in a meaningful manner. If you're writing low-level code - something on the level of string libraries or date routines, use them. But as you get closer to real world problems, the formal methods seem more effective at driving home how little you understand about your problem space, not writing solid code.

      (As a specific example, I remember getting nailed by the concept of "triangle." We were writing meteorological code, and sometimes "triangles" were planar and sometimes they were triangles on a sphere -- and the problems are *very* different as you move away from small triangles. Some of our code did - many navigation problems can be reduced to triangles with the two endpoints and the North Pole.)

  • What's the course textbook? (Score:4, Funny)

    by MarkGriz ( 520778 ) on Monday March 24, 2003 @02:11PM (#5584393)
    Secure Computing for Dummies... by Dummies.

  • Fascinating (Score:5, Interesting)

    by MadFarmAnimalz ( 460972 ) on Monday March 24, 2003 @02:18PM (#5584438) Homepage
    I was wondering how OS-agnostic these courses are going to be, when I came across this quote:

    Okin agreed: "We need to get input from others as well. Clearly, there is no point in these undergraduates learning only about Microsoft technology. We need a broad approach."

    The reason I wondered was because so much of secure programming involves access control in many ways, direct and indirect. Obviously, Microsoft's access control mechanisms vary wildly from Unix paraadigms. I'm not a hardcore programmer, but I can only assume that priviledge escalation exploits under a Redmond OS would be very different from something similar with linux.

    That sentence states unambiguously that the course will cover non-MS architecture.

    I, for one, am impressed. Doing the right thing for once, the boys in Redmond.
    • Hopefully this will consist of more than "Consider operating system X. Note how insecure this feature is compared to the Windows equivalent."

  • This must be a joke! (Score:2, Informative)

    by Eudial ( 590661 )
    Geez! They'd be the last persons i'd put in that position!

    I mean, stuff like;
    The IIS hole,
    Outlook express,
    The recent SQL worm,
    Windows 9x's login etc.


    There are friggin fishingnets who are more waterproof then microsofts code!
  • George W. Bush to teach a class about articulation and pronunciation of the word "Nuclear."
  • Teach By negative example:

    "okay kids, Here's what NOT to do!"

  • Progressive Microsoft (Score:5, Funny)

    by mabu ( 178417 ) on Monday March 24, 2003 @02:22PM (#5584473)
    Microsoft's university program is closely linked to its Trustworthy Computing initiative, its companywide focus on securing its products, which was launched early last year.

    Hey, check it out. Early last year Microsoft decided it might me worthwhile to secure some of its products.

    I hear some time in Summer 2014 Microsoft is going to launch its Memory Leak Awareness Program.

  • Odd... (Score:2, Funny)

    by PedroP35 ( 37119 )
    Maybe I'm strange, but I couldn't help but read this article's title as "Using Microsoft To Teach Undergrads About Secure Computing." Is there something wrong with that?

  • It really does make sense... (Score:5, Interesting)

    by fzammett ( 255288 ) on Monday March 24, 2003 @02:22PM (#5584480) Homepage
    I forget where I heard it, but someone once pointed out that if your going to go to Spain to participate in the running of the bulls, you don't really want to talk with the people that managed to survive it... you want to talk to the guy that got his ass gored off because he can tell you exactly what to avoid doing!

    Same thing here! Who better to tell us what security bugs to avoid than Microsoft.
  • ... U.S. President G. W. Bush has announced that he is stepping down from US leadership, and has accepted a position in the United Nations as head of a new organization dedicaced to the development of democracy through diplomacy through the world.
  • Are they gonna use linux?
  • Instructor Fox will be invited into the HenHouse to teach about security.

    (sorry, couldn't resist)

    When asked if Lunch would be served, Mr Fox responded; "yes, all who show up will be..."served", he chucled".
  • Isn't letting Microsoft teach secure programming kinda like letting the town drunk host AA meetings at Moe's Tavern???

  • What is M$'s real motive? (Score:5, Interesting)

    by frovingslosh ( 582462 ) on Monday March 24, 2003 @02:36PM (#5584568)
    While there certainly needs to be educational focus on this subject, Microsoft is absolutely not the organization to do it. Aside from their demonstrated inability to address these issues, and a history of code that is neither secure nor stable, there is a serious concern that no one can be that bad by accident, and that their repeated flaws my be part of the largest software company's plan to take over the Internet [pbs.org] (and eventually everything) rather than the less creditable story that a company so rich and successful could make such bad products by bungling.

    I believe their real motive in offering such a course would be to teach programmers to code for security the Microsoft way, so that things continue to get worse. Their definition of security of your machine is much like their definition of digital rights of your machine; they are not looking after your digital rights, and they are not looking after your security.

  • Not Just Security (Score:4, Informative)

    by spring ( 116537 ) <eric@bitREDHATpuddle.com minus distro> on Monday March 24, 2003 @02:42PM (#5584612) Homepage
    Microsoft has a huge push going on in education. Campus reps, steep tool discounts, and curriculum suggestions to get Microsoft technology into undergrad and grad school course materials. Ask any CS professor what kind of contact they've had with Microsoft reps.

    Java and Linux have become very large forces in education. Java has very nearly become the de facto teaching language, and Linux has become a popular instruction platform. Microsoft is trying very hard to counter this motion with C# and the .Net runtime.
  • Does the expression letting the fox run the hen house mean anything to MS?

  • depressing (Score:5, Insightful)

    by g4dget ( 579145 ) on Monday March 24, 2003 @02:44PM (#5584624)
    Out of this will come lots of students thinking about security the Microsoft way. They'll believe that more security features (ACLs, etc.) in a system make it more secure. They'll think that if they just throw more tools and wizards at software, they can handle anything. And, sadly, even if those programmers don't become Microsoft programmers, a lot of that bad thinking will spill over into Linux and other systems; too much of that is already happening, with people busily porting some of the worst misfeatures of Windows to Linux.
  • Clinton teaches an ethics course..
  • They could show bad examples on security (they have plenty of them). They can teach by showing the opposite ("see? that kind of things I'm doing is insecure"). And they can scare them showing what kind of things happens when they don't give a damn about security.

    Security is more an art than a science, so Microsoft only need to push the students to NOT go in the wrong direction (er... MS direction) and they will find the right path. If they don't do anything that Microsoft did, they can only do secure thin

  • I think a course taught by the guy who's the lead programmer for OpenBSD would kick ass.

    The class would be taught on OpenBSD and your class project would be to implement some kind of server. Be it a finger daemon or some p2p protocol or something.

    I'd sign up for it in an instant...

    As for the whole microsoft teaching security...

    (now for the obligatory slashot MS dig!)
    "Microsoft teaching security is like driving to save gas..."

  • Simmer down now (Score:4, Insightful)

    by Drakonian ( 518722 ) on Monday March 24, 2003 @03:46PM (#5585129) Homepage
    The perfect Slashdot story - just throw the masses a MS bone and watch the predictable +5 Funnys show up.

    I think it's a good idea. Honestly. There are security flaws in Windows, yes. There are also security flaws in Linux. (ptrace recently). A lot more people are using Windows, there has got to be a decent chance that more security flaws will be exploited.

    I didn't learn anything about secure coding in school. I'm sure there are many experts at MS on writing secure code. And at least the organization as a whole is *trying*. I'm sure they can write more secure code than me, and definitely have some advice that will help programmers down the road. Mod me down if you like, but I say give the MS bashing a rest and consider the merit behind the idea. How much do YOU know about writing secure code?

  • Another Marketing Ploy? (Score:3, Informative)

    by Yuan-Lung ( 582630 ) on Monday March 24, 2003 @04:11PM (#5585341)
    From my personal experience, these MS sponsored/related workshops/courses, are more like perverted advertisements trying to pressure students into using MS products rathar then then actual informative educational sessions.

    I had to take a couple MS Windows network administration courses back in colledge because they were requirement for the program. We had to memorize stupid phrases like "MS Windows network is the best choice because it's userfriendly, easy to set up, and secure" for the exams.... It just makes me sick to stomache.

  • Secure Programming for Linux and Unix HOWTO (Score:3, Informative)

    by dwheeler ( 321049 ) on Monday March 24, 2003 @04:31PM (#5585484) Homepage Journal
    There's a free book (and slides) already available if you want to learn how to write secure programs for Linux and Unix, it's the Secure Programming for Linux and Unix HOWTO [dwheeler.com]. Take it, read it, use it. It's already included in many Linux distribution's documentation.

    It is a good idea to get colleges to teach about writing secure programs. Currently, almost all programmers get out to the real world without knowing how to write secure programs, and they're writing the programs exposed to the entire Internet. That needs to change.

  • Want to avoid exploits? Use better tools! (Score:3, Insightful)

    by Eric Smith ( 4379 ) on Monday March 24, 2003 @04:36PM (#5585517) Homepage Journal
    C (and C++) are terrible tools for software engineering. Yes, it's possible to write robust code in C or C++, but the language doesn't do much to make it easy. And since programmers are basically lazy[*]...

    Using a better language doesn't completely prevent software defects, but it can eliminate a large class of exploitable security problems.

    Some more suitable languages include Ada, Java, Modula-3, Sather, Scheme, and Smalltalk. There are, of course, many others as well. Some of these impose a non-trivial performance penalty compared to C and C++, but some of them don't.

    Some time back I was involved in a thread about programming language support for reliable software [brouhaha.com], in which I compared C to a table saw with no finger guard.

    C.A.R. Hoare, in his 1980 ACM Turing Award Lecture, made the insightful observation:

    ...there are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies and the other way is to make it so complicated that there are no obvious deficiencies.

    The first method is far more difficult. It demands the same skill, devotion, insight, and even inspiration as the discovery of the simple physical laws which underlie the complex phenomena of nature. It also requires a willingness to accept objectives which are limited by physical, logical, and technological constraints, and to accept a compromise when conflicting objectives cannot be met. No committee will ever do this until it is too late.

    Given how difficult it is to write robust software, it astonishes me that it is still common practice to use languages that offer essentially no help in avoiding common mistakes.

    Microsoft is correct, however, that better education would improve things. Marc Donner posted an insightful comparison between how programming and writing are taught [brouhaha.com].

    Eric

    [*] Laziness in programmers is a virtue! Most new software tools are developed because a programmer somewhere was too lazy to keep doing things the same old way.

  • "Those who can't do, teach."

  • Course Syllabus (Score:5, Funny)

    by inkswamp ( 233692 ) on Monday March 24, 2003 @05:46PM (#5586178)

    Week One: The dangers of open source software

    Week Two: More dangers of open source software

    Week Three: How frequent licensing payments improve security

    Week Four: Shhhh... better security means not discussing exploits and security holes

    Week Five: How the media exaggerates security issues

    Week Six: Did we mention the dangers of open source? Let's review

    Week Seven: How to uninstall Linux

    Week Eight: Macintosh--the gay-communist connection

    Week Nine: (No classes during this week so students can reinstall Windows or do any necessary security patches.)

    Week Ten: Trusted computing, i.e., how hypnosis is your friend

    Week Eleven: The dangers of open source software revisitted

  • MS Acquired Intrinsa (Score:3, Interesting)

    by jafuser ( 112236 ) on Monday March 24, 2003 @05:49PM (#5586224)
    And Microsoft's efforts in this field are explained as well -- the company "paid more than $60 million in 1999 to acquire Intrinsa, maker of a bug-finding tool called Prefix. The program, which sifts through huge swaths of code searching for patterns that match a defined list of common semantic errors, helped find thousands of mistakes in Windows and other Microsoft products."


    Couldn't they have just bought a few licenses? Why did they have to BUYOUT the whole company? I'm sure if they worked up a good deal, they could have purchased a few thousand licenses for much less than $60M...

Slashdot Top Deals

What is research but a blind date with knowledge? -- Will Harvey

Close