Rather like Jim Jones showing world+dog how to make soft drink.

Type your comment here — plain text only, no HTML

Rather Like...

... The Myra Hindley guide to managing a nursery

Hello

"Hello..."

?

"HELLO..

...

"Is this pot speaking?"

"...err yes"

...

"I believe we have kettle on the other line for you"

Now we've all had a good laugh

Microsoft are, by any measure, one of the largest software development operations in the world. Their development effort, for its size, produces significantly fewer new vulnerabilities than most of their competitors (whether open or closed source).

If all developers could achieve the level of secure development currently demonstrated by Microsoft, we'd have a lot fewer web sites with gaping XSS and SQL injection vulnerabilities. It's not as though sanitization of input strings is a particularly new or difficult technique, but it's obvious that it's still not widely practised.

Secure development is not that difficult:

IF you write all your own code yourself;

AND you know what you're doing;

AND you have access to some fairly sophisticated testing tools;

AND you know how to use them.

But once you're looking at a team of 100 developers, the security of the systems produced is likely to be only as strong as that of the weakest (from a security standpoint) member of your team. Production of secure code is only possible with a strong, secure development process and very good QA. If Microsoft can assist in making this combination more common, good for them.

MS invents Do what?? loop

A new generation of Microsoft coding monkeys who think they're good coders will now think they're writing safe code as well!

While (not up to the job){

Push out new coding initiatives;

}

Do something useful for a change;//this code never reached

Could have chosen a better acronym

I bet www.libsdl.org gets a lot more hits today....

SDL Pro Network

Say, do i read that right? It should basically become a security shopping mall where companies that do not have the capacity or will to care about security on their own can go and buy their secure hat for their otherwise as-always-before application? - In the words of AC: "Hahaha". (i don't claim to write particularly secure code)

A few more

"Bush will show world+dog how to speak in public"

"Oil companies will show world+dog how to take care of the environment"

"UK.gov will show world+dog how to keep citizens private data safe"

Sorry, it's just taken me 10 mins just to type those in between hysterical bouts of laughter, my lungs hurt now and I'm going to have a lie down...

Yes but...

People will believe them, worse still, people will think that writing with Microsoft tools intrinsically makes your software secure.

Talking about dogs, I'll bet it'll run like one though.

Erm...

Would be nice if they wouldn't rip off stuff... SDL stands for Simple Direct Layer and is meant for easily coding in OpenGL and other things...

But then they wouldn't be microshaft if they didn't rip off something or other

I thought the dog was writing their code

there is not much you can say - it is staggering the chutzpah of this approach.

But of course that is MS thru and thru, they make a toy operating system for little kids.

@sure

Surely it would be:

You seem to be writing insecure code.

Would you like some assistance with that?

MS and the IBM PC put back computing by at least 25 years, what's another few.

@Chris Miller

I think you misunderstand how comments about MS articles work.

1) Call them M$, Microsloth, Microshaft. etc.

2) Slag off anything at all that they do, it's all evil and money grabbing

3) Slag them off a bit more

4) Suggest that they have never innovated in anything

5) Suggest that any problem with any system which runs MS software is the fault of the company

6) Linux rulez etc. etc.

@D.M

They were pretty much the only software company to take Apple seriously when they first started.

They partnered with IBM for OS/2

They pretty much single handedly broke the mainframe/big iron stranglehold on the datacentre

Development of office tools (yes there were others, I know)

They have pumped billions into UI development

@Fraser

... They were pretty much the only software company to take Apple seriously when they first started.

And your point is?

... They partnered with IBM for OS/2

Then renagaded on the partnership, launched office and windows leaving OS/2 (a very good OS IMHO) dead in the water

... They pretty much single handedly broke the mainframe/big iron stranglehold on the datacentre

We were talking inovation not shoddy business practices

... Development of office tools (yes there were others, I know)

Huh? Are you serious????

... They have pumped billions into UI development

And the result is Vista! Wheeeeeee, I'll have 2!

Security, Oh Yeah!

I think all programmers should be forced to spend at least 6 months programming 6502 code, in assembler, with only a cassette tape for storage.

It doesn't take long to learn the importance input validation, buffer/stack length checks, memory management etc.

Actually, it's true

"Microsoft will show world+dog how to write secure code "

They just demonstrate by bad example, that's all!

I wonder..

If you are driving down the street in your motorboat, and your wings fall off, how many secure lines of code does it take to fill a dog-house?

Rats, wish we had a dog icon.....

@Steve B

"MS and the IBM PC put back computing by at least 25 years, what's another few."

No, that's completely wrong. Blame Intel and Sun and IBM and MIPS if you like, but not MS. We used to have hardware that helped makewriting secure code easy (think of the Burroughs stuff, the ICL stuff, coming out in the early 70s, the research at Manchester and at Oxford and at Cambridge. Then we got RISC and Z80 and 8085 and all the rest of the stuff produced by companies who decided that having any protection in hardware made the hardware more expensive and gave you less bang per buck, and it became much more difficult to write secure code. The guys who sold you more bang for your buck were very careful not to tell the poor naive customers that they would get a lot less security for their buck. Blame Bell Labs (Dennis Ritchie and Bjarne Stroustrup) if you like: we once had high level languages that helped us write secure code, and language gurus who promoted secure techniques. Then these guys popularised very low level languages (C, C with Classes, C++) and a programming approach that glorified unsafe pointer arithmetic. These languages had no imaginable way for a compiler to rack references (so no useful type safety). The later versions perverted the concepts of abstract data types and object orientation that we had used for years. The almost universal uptake of first C and later C++ ensured that it was almost impossible to write secure code for any large scale development. These heroes (the founders of the most popular modern development techniques) told us C (and later C++) would reduce development costs (which was actually far from true compared with using a decent lisp variant, or Algol 68, or Coral, or almost anything but an assembly language) - and didn't bother to tell us that they would increase support costs enormously.

Yes, Windows is horrible, and MSDOS was pretty horrible too. But nothing Microsoft did was as damaging to secure computing as what those others did.