Chief Instigator

The "instigator" of a report that criticized Microsoft's operating-system dominance has left his day job at a computer security firm that does work for MS. From press reports, it's not clear whether @Stake's chief technology officer Dan Geer was fired or resigned.

The document Geer was involved in writing holds that reliance on a single operating system increases security risks (which makes a certain amount of intuitive sense). "It doesn't matter how hard Microsoft works on security. So long as they continue to be human beings, there will continue to be flaws -- and you don't want every machine on Earth to have the same flaw revealed at the same time," one of the co-authors, Perry Metzger, told InfoWorld. "It's as though every person in the U.S. had the exact same genes."

The authors want to weaken Microsoft's market advantage via government action. For any number of reasons, that's a bad idea. For some background on why, check out Reason's excellent November 2001 story, "Antitrust's Greatest Hits: The Foolish Precedents Behind the Microsoft Case."

Comments

[Douglas Fletcher]

We demand to know!

[Julian Sanchez]

So now the original report gets 500x the media attention it would've originally had. I'm sure MS is delighted.

[PLC]

I can assure you that MS doesn't care. This paper won't make any tangible difference to any decision every made by anyone.

There are lots of thinks for MS to worry about over the next ten years. A lunatic fringe ain't one of 'em.

[Grummun]

From a systems administration/support standpoint, installing multiple platforms simply for the sake of diversity is nonsensical. What they (the anti-MS crowd) should be demanding is an accounting of why the Gov continues to use MS systems when MS has repeatedly demonstrated that they are incapable of plugging their security holes. How long did it take hackers to find weaknesses in 'the most secure Windows ever?' And the people that have the source code can't find them? Rather then 'government action,' it should be 'market action,' taken by the Gov: demand a better product, and drop MS if they fail to deliver.

G

[R C Dean]

MS is the target of choice for hackers because of its market dominance. If Linus were installed in 90% of computers, the hackers would be finding security holes in it with the same alacrity they do in MS now, because they would be looking for security holes in Linux (which they aren't, really, now).

[Russell Hanneken]

Grummun wrote, "MS has repeatedly demonstrated that they are incapable of plugging their security holes." That's not true. Go to Microsoft's Windows Update site, and you'll regularly see security patches.

"Ah," I hear some people saying, "but that's the point. If Microsoft were a good software company, they'd reach a point where there would be no holes to patch."

This, I submit, is an unrealistic standard. Any complex, constantly evolving system created by human beings is going to have mistakes, not to mention unintended consequences. There will never be a useful PC operating system that doesn't have security holes. The best we can hope for is a good system for catching bugs and correcting them.

In this respect, I don't know of any reason to believe that Microsoft is consistently much worse than other software makers. In addition to using Windows 2000, I use FreeBSD, and I subscribe to their security announcement mailing list. I routinely receive warnings about security problems and patch releases. I think there have been 8 patch releases since FreeBSD 5.1--and they're not as easy to apply as Microsoft's.