Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.advocacy > #33481 > unrolled thread
| Started by | Kari Laine <karitlaine@yahoo.com> |
|---|---|
| First post | 2011-06-17 15:34 +0300 |
| Last post | 2011-06-18 17:16 +0000 |
| Articles | 13 — 10 participants |
Back to article view | Back to comp.os.linux.advocacy
Gates year 2003 Kari Laine <karitlaine@yahoo.com> - 2011-06-17 15:34 +0300
Re: Gates year 2003 Hadron<hadronquark@gmail.com> - 2011-06-17 14:57 +0200
Re: Gates year 2003 Kari Laine <karitlaine@yahoo.com> - 2011-06-17 21:29 +0300
Re: Gates year 2003 voodoo <voodoo@tootycar.net> - 2011-06-18 07:11 +0000
Re: Gates year 2003 William Poaster <wp@induh-vidual.net> - 2011-06-18 10:24 +0100
Re: Gates year 2003 Chris Ahlstrom <ahlstromc@xzoozy.com> - 2011-06-18 07:05 -0400
Re: Gates year 2003 Homer <usenet@slated.org> - 2011-06-18 21:05 +0100
Re: Gates year 2003 Homer <usenet@slated.org> - 2011-06-17 18:49 +0100
Re: Gates year 2003 Snit <usenet@gallopinginsanity.com> - 2011-06-17 11:02 -0700
Re: Gates year 2003 flatfish+++ <flatfish@marianatrench.com> - 2011-06-17 14:30 -0400
Re: Gates year 2003 Goblin <bytes4free@googlemail.com> - 2011-06-17 19:33 +0100
Re: Gates year 2003 JeffM <jeffm_@email.com> - 2011-06-17 12:32 -0700
Re: Gates year 2003 voodoo <voodoo@tootycar.net> - 2011-06-18 17:16 +0000
| From | Kari Laine <karitlaine@yahoo.com> |
|---|---|
| Date | 2011-06-17 15:34 +0300 |
| Subject | Gates year 2003 |
| Message-ID | <69CdnadT8P9T1GbQnZ2dnUVZ8i2dnZ2d@giganews.com> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, attached is a piece from Gates. I don't buy it that there were no exploits before MS patched it. I am also sure that Open Source way of working with code is more secure than closed source. Also patches seems to come faster in Open Source world than MS world. But I must be wrong because Gates said so... *********************** Gates: 'You don't need perfect code' for Security CmdrTaco Oct 31 2003 from the no-such-thing-as-perfect-code-anyway dept. securitas writes "ITBusiness has an interview from the Microsoft Professional Developers Conference where Bill Gates says 'You don't need perfect code to avoid security problems.' Instead he suggests that users acquire and properly configure firewalls and make sure that they keep their software patches up-to-date. Considering that Microsoft says it is focused on security, the comments from the Chief Software Architect aren't inspiring, especially beacuse the underlying attitude seems to contradict the idea of well-written, secure code. What kind of message does that send to the developers who work for Gates?" . http://snurl.com/2stg http://developers.slashdot.org/developers/03/10/31/1610250.shtml?tid=126&tid=172 Gates: 'You don't need perfect code' for good security exclusive The chief software architect's advice for safeguarding your apps Lynn Greiner Oct 29 2003 . . For example, today you either end up with tons of different passwords, or you have to do things in a very insecure way. So this (Web services) is really the next level of Internet integration, and the thing that didn't exist is the programming model to unify those things. . . You don't need perfect code to avoid security problems. There are things we're doing that are making code closer to perfect, in terms of tools and security audits and things like that. But there are two other techniques: one is called firewalling and the other is called keeping the software up to date . . Anybody who kept their software up to date didn't run into any of those problems, because the fixes preceded the exploit .. in every case at this stage we've had the fix out before the exploit .. .. it's people not understanding the design of APIs where you get vulnerabilities. Certainly there are whole classes of vulnerabilities like buffer overruns that are very well understood at this point, and the scanning tools are very good and the compiler switches are very good .. .. actually all the forms of Unix as well as Linux have had more vulnerabilities per line of code. They don?t propagate as much because they're not as dense as our system is, so the things that prevent the propagation are particularly important for our world ... . http://www.itbusiness.ca/index.asp?theaction=61&sid=53897 **************************** Kari - -- PICs, Displays,Relays - USB-SPI-I2C http://www.byvac.com USB and FPGA boards http://www.ztex.de I am just a happy customer -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJN+0nNAAoJEPjW/Kjfref2SZ4IAKPh3c/F54bTSKjTHcOT/bql owgokaHYjmBDCp/Q66k+S3m9NR6zhda5pjbc8ekrK1itLrDmPlUmkazm9zBe5Uvf yPVRExhKxBpxalyRkGtmr5K7R4ZCLO6CJPb4t7PZQBXBa4d9z92WuOvMIPc+JLcc LAbGNCPcWAWXFFXn7OZ3tEthdw1jLG/0TbjxPlUhr7LZQ4cSAfl8Rzgua1I5AmHh 5HWp+YHUG7wVVaukp2flURq3CHR6AyfG+sKLrgDEzzCACblNeD8idua1h9dRzUce 2Su3MzvQ0gfBtVKepEW8a5PbntY104CBg2ozhOWHERgU6wEi20w3qCynd4hWyNU= =cj/f -----END PGP SIGNATURE-----
[toc] | [next] | [standalone]
| From | Hadron<hadronquark@gmail.com> |
|---|---|
| Date | 2011-06-17 14:57 +0200 |
| Message-ID | <wjaadgk42x.fsf@news.eternal-september.org> |
| In reply to | #33481 |
Kari Laine <karitlaine@yahoo.com> writes: > Hi, > > attached is a piece from Gates. I don't buy it that there were no > exploits before MS patched it. I am also sure that Open Source way of > working with code is more secure than closed source. Also patches seems > to come faster in Open Source world than MS world. But I must be wrong > because Gates said so... No you're wrong because you're full of shit. Fixes come when people fix them. In closed source that can be immediate give or take too - depends on the SW and the severity. Closed source/proprietary obviously QA it more and do official releases to save support costs and hosing their paying customers so there is an advantage in that way. The OSS/Linux way is often "chuck it out there and see" - that said wonderful development like Git (thank you Linus) make reverting to previous versions/tags trivial. re security, You are aware that Debian has daily security updates too right?
[toc] | [prev] | [next] | [standalone]
| From | Kari Laine <karitlaine@yahoo.com> |
|---|---|
| Date | 2011-06-17 21:29 +0300 |
| Message-ID | <3d-dnRNG7JSZAGbQnZ2dnUVZ8kWdnZ2d@giganews.com> |
| In reply to | #33488 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/17/2011 03:57 PM, Hadron wrote: > Kari Laine <karitlaine@yahoo.com> writes: > >> Hi, >> >> attached is a piece from Gates. I don't buy it that there were no >> exploits before MS patched it. I am also sure that Open Source way of >> working with code is more secure than closed source. Also patches seems >> to come faster in Open Source world than MS world. But I must be wrong >> because Gates said so... > > No you're wrong because you're full of shit. Ok Sir... > > Fixes come when people fix them. In closed source that can be immediate > give or take too - depends on the SW and the severity. Closed > source/proprietary obviously QA it more and do official releases to save > support costs and hosing their paying customers so there is an advantage > in that way. The OSS/Linux way is often "chuck it out there and see" - > that said wonderful development like Git (thank you Linus) make > reverting to previous versions/tags trivial. I remember reading things that MS patch destroyed the Windows machines - maybe I was hallucinating... Also several reputable sources have reported that number of bugs/1000 lines of cone were lot less in Linux than ...ehm was it Windows.. but I must have been hallucinating also... > > re security, You are aware that Debian has daily security updates too > right? Of course they have - they take user's security seriously instead just playing the lip service Microsoft does. Was Microsoft deploying patches once a month? I am not sure - I don't update them very often. One machine updated itself yesterday and took two reboots to install them. Kari - -- PICs, Displays,Relays - USB-SPI-I2C http://www.byvac.com USB and FPGA boards http://www.ztex.de I am just a happy customer -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJN+50DAAoJEPjW/Kjfref2LJ0H/iM1ff2ga+0P3vvReoTBTUW9 MLMhbFyDL43NnFs3Zx9L0hVoVUl6igeqKiCpo2/vrOpeA7aUDE+bCbRoQtGskSPA DSN4OeVGa+ccl5OMJZp0ctnQL8PdnuFGyyd1EbFsKB6sZW2/Z1eKKz3fAfUTGO1M 9RoM36Hh/CWVjpPMonCujV593DcPS1pzck1WuKVCLjWx9UZZmAMIuZRQR6yTUfKZ E3jWijKn0KdU/dkOOrQcD/u8+hm34bMfGxJXZBPxnGAdFYb1IBmXF05Qz15s4uom J9HJpMSYm+7M+37LDCvRhuqUvDnWVTjuDKHgX0r1DulDoygNhKAYRX9rC3990xk= =Zqlv -----END PGP SIGNATURE-----
[toc] | [prev] | [next] | [standalone]
| From | voodoo <voodoo@tootycar.net> |
|---|---|
| Date | 2011-06-18 07:11 +0000 |
| Message-ID | <4dfc4f86$0$21308$c3e8da3$a9097924@news.astraweb.com> |
| In reply to | #33488 |
On Fri, 17 Jun 2011 14:57:58 +0200, Hadron wrote: > Kari Laine <karitlaine@yahoo.com> writes: > >> Hi, >> >> attached is a piece from Gates. I don't buy it that there were no >> exploits before MS patched it. I am also sure that Open Source way of >> working with code is more secure than closed source. Also patches seems >> to come faster in Open Source world than MS world. But I must be wrong >> because Gates said so... > > No you're wrong because you're full of shit. > > Fixes come when people fix them. yes. > In closed source that can be immediate > give or take too - yes. > depends on the SW and the severity. and also the interest of the owning company. > Closed source/proprietary obviously QA it more why is it obvious to you? > and do official > releases to save support costs and hosing their paying customers > so there is an advantage in that way. please explain the economic imperative for a monopoly to follow this theory. include examples of microsoft in particular displaying this behavior. how does paid support eat away support costs? > The OSS/Linux way is often "chuck it out there and see" - explain why you think this is different from the proprietary model. give examples of microsoft in particular displaying an aversion to releasing shoddy feature deficient products. > that said wonderful development like Git (thank you Linus) make > reverting to previous versions/tags trivial. > re security, You are aware that Debian has daily security updates too > right? yes.
[toc] | [prev] | [next] | [standalone]
| From | William Poaster <wp@induh-vidual.net> |
|---|---|
| Date | 2011-06-18 10:24 +0100 |
| Message-ID | <ge7uc8-t7b.ln1@linuxnetwork.alpha.org> |
| In reply to | #33790 |
In reply to voodoo who posted: > On Fri, 17 Jun 2011 14:57:58 +0200, Hadron wrote: > >> Kari Laine <karitlaine@yahoo.com> writes: >> >>> Hi, >>> >>> attached is a piece from Gates. I don't buy it that there were no >>> exploits before MS patched it. I am also sure that Open Source way of >>> working with code is more secure than closed source. Also patches seems >>> to come faster in Open Source world than MS world. But I must be wrong >>> because Gates said so... >> >> No you're wrong because you're full of shit. >> >> Fixes come when people fix them. > > yes. > >> In closed source that can be immediate >> give or take too - > > yes. > >> depends on the SW and the severity. > > and also the interest of the owning company. > >> Closed source/proprietary obviously QA it more > > why is it obvious to you? > >> and do official >> releases to save support costs and hosing their paying customers >> so there is an advantage in that way. > > please explain the economic imperative for a monopoly to follow this > theory. include examples of microsoft in particular displaying this > behavior. > > how does paid support eat away support costs? > >> The OSS/Linux way is often "chuck it out there and see" - > > explain why you think this is different from the proprietary model. give > examples of microsoft in particular displaying an aversion to releasing > shoddy feature deficient products. Here are a couple of examples of M$ shoddy "chuck it out there and see" crapware: WindowsME & Vista. :-) >> that said wonderful development like Git (thank you Linus) make >> reverting to previous versions/tags trivial. > >> re security, You are aware that Debian has daily security updates too >> right? > > yes. -- XPN :: http://xpn.altervista.org "Microsoft has vast resources, literally billions of dollars in cash, or liquid assets reserves. Microsoft is an incredibly successful empire built on the premise of market dominance with low-quality goods." -- Former White House adviser Richard A. Clarke --
[toc] | [prev] | [next] | [standalone]
| From | Chris Ahlstrom <ahlstromc@xzoozy.com> |
|---|---|
| Date | 2011-06-18 07:05 -0400 |
| Message-ID | <iti0uj$q1o$7@dont-email.me> |
| In reply to | #33790 |
voodoo wrote this copyrighted missive and expects royalties: > On Fri, 17 Jun 2011 14:57:58 +0200, Hadron wrote: > >> Closed source/proprietary obviously QA it more > > why is it obvious to you? Indeed. Then how come much of the OSS software you get (in source code form) comes with test suites so that you can verify the integrity of the build? I've yet to see a commercial package that comes with test vectors. >> The OSS/Linux way is often "chuck it out there and see" - Oh. My. God. "chuck it out there and see" is *exactly* Microsoft's business model. Look at their venture into IPTV for a good example. >> re security, You are aware that Debian has daily security updates too >> right? > > yes. -- BOFH excuse #187: Reformatting Page. Wait...
[toc] | [prev] | [next] | [standalone]
| From | Homer <usenet@slated.org> |
|---|---|
| Date | 2011-06-18 21:05 +0100 |
| Message-ID | <o0dvc8-37n.ln1@sky.matrix> |
| In reply to | #33820 |
Verily I say unto thee, that Chris Ahlstrom spake thusly:
>> On Fri, 17 Jun 2011 14:57:58 +0200, Hadron wrote:
>>> The OSS/Linux way is often "chuck it out there and see" -
>
> Oh. My. God.
>
> "chuck it out there and see" is *exactly* Microsoft's business model.
"The new version - it's not there to fix bugs. That's not the reason
we come up with a new version." ~ Billy Buttcrust
http://www.cantrip.org/nobugs.html
--
K. | "The poor have flat-screen TVs."
http://slated.org | ~ Libertarian propagandist Keith
Fedora 8 (Werewolf) on šky | Curtis, explaining why he thinks
kernel 2.6.31.5, up 26 days | we shouldn't tax the rich.
[toc] | [prev] | [next] | [standalone]
| From | Homer <usenet@slated.org> |
|---|---|
| Date | 2011-06-17 18:49 +0100 |
| Message-ID | <0mgsc8-bvb.ln1@sky.matrix> |
| In reply to | #33481 |
Verily I say unto thee, that Kari Laine spake thusly:
> ***********************
> Gates: 'You don't need perfect code' for Security
> CmdrTaco Oct 31 2003
>
> from the no-such-thing-as-perfect-code-anyway dept.
> securitas writes "ITBusiness has an interview from the Microsoft
> Professional Developers Conference where Bill Gates says
>
> 'You don't need perfect code to avoid security problems.' Instead he
> suggests that users acquire and properly configure firewalls and make
> sure that they keep their software patches up-to-date.
It's the same backwards mentality as Windows "developers" who think they
shouldn't be concerned with compiler warnings. Sloppiness and a lack of
professionalism is a away of life for them. It's all about the money:
screw integrity and the customers.
[quote]
Gates:
It turns out Luddites don't know how to use software properly, so
you should look into that. -- The reason we come up with new versions is
not to fix bugs. It's absolutely not. It's the stupidest reason to buy a
new version I ever heard. When we do a new version we put in lots of new
things that people are asking for. And so, in no sense, is stability a
reason to move to a new version. It's never a reason.
FOCUS:
How come I keep being told by computer vendors "Well, we know about
this bug, wait till the next version is there, it'll be fixed"? I hear
this all the time. How come? If you're telling me there are no
significant bugs in software and there is no reason to do a new version?
Gates:
No. I'm saying: We don't do a new version to fix bugs. We don't. Not
enough people would buy it. You can take a hundred people using
Microsoft Word. Call them up and say "Would you buy a new version
because of bugs?" You won't get a single person to say they'd buy a new
version because of bugs. We'd never be able to sell a release on that
basis.
[/quote]
http://www.cantrip.org/nobugs.html
--
K. | "The poor have flat-screen TVs."
http://slated.org | ~ Libertarian propagandist Keith
Fedora 8 (Werewolf) on šky | Curtis, explaining why he thinks
kernel 2.6.31.5, up 25 days | we shouldn't tax the rich.
[toc] | [prev] | [next] | [standalone]
| From | Snit <usenet@gallopinginsanity.com> |
|---|---|
| Date | 2011-06-17 11:02 -0700 |
| Message-ID | <CA20E4AE.9C0CF%usenet@gallopinginsanity.com> |
| In reply to | #33601 |
Homer stated in post 0mgsc8-bvb.ln1@sky.matrix on 6/17/11 10:49 AM: > Verily I say unto thee, that Kari Laine spake thusly: > >> *********************** >> Gates: 'You don't need perfect code' for Security >> CmdrTaco Oct 31 2003 >> >> from the no-such-thing-as-perfect-code-anyway dept. >> securitas writes "ITBusiness has an interview from the Microsoft >> Professional Developers Conference where Bill Gates says >> >> 'You don't need perfect code to avoid security problems.' Instead he >> suggests that users acquire and properly configure firewalls and make >> sure that they keep their software patches up-to-date. > > It's the same backwards mentality as Windows "developers" who think they > shouldn't be concerned with compiler warnings. Sloppiness and a lack of > professionalism is a away of life for them. It's all about the money: > screw integrity and the customers. > > [quote] > Gates: > It turns out Luddites don't know how to use software properly, so > you should look into that. -- The reason we come up with new versions is > not to fix bugs. It's absolutely not. It's the stupidest reason to buy a > new version I ever heard. When we do a new version we put in lots of new > things that people are asking for. And so, in no sense, is stability a > reason to move to a new version. It's never a reason. > > FOCUS: > How come I keep being told by computer vendors "Well, we know about > this bug, wait till the next version is there, it'll be fixed"? I hear > this all the time. How come? If you're telling me there are no > significant bugs in software and there is no reason to do a new version? > > Gates: > No. I'm saying: We don't do a new version to fix bugs. We don't. Not > enough people would buy it. You can take a hundred people using > Microsoft Word. Call them up and say "Would you buy a new version > because of bugs?" You won't get a single person to say they'd buy a new > version because of bugs. We'd never be able to sell a release on that > basis. > [/quote] > > http://www.cantrip.org/nobugs.html Ah, and new versions of FireFox always advertise the fact they just fixed bugs. LOL! Actually, one of the few times I have seen a company sell a big update based on fixing the back end and *not* on features was Apple with OS X Snow Leopard. Sure, they refined some things, but the focus was *not* features. It was refreshing to see. -- [INSERT .SIG HERE]
[toc] | [prev] | [next] | [standalone]
| From | flatfish+++ <flatfish@marianatrench.com> |
|---|---|
| Date | 2011-06-17 14:30 -0400 |
| Message-ID | <1lr2hdpkx7382.1ccdc2mwo82id.dlg@40tude.net> |
| In reply to | #33604 |
On Fri, 17 Jun 2011 11:02:06 -0700, Snit wrote: > Homer stated in post 0mgsc8-bvb.ln1@sky.matrix on 6/17/11 10:49 AM: > >> Verily I say unto thee, that Kari Laine spake thusly: >> >>> *********************** >>> Gates: 'You don't need perfect code' for Security >>> CmdrTaco Oct 31 2003 >>> >>> from the no-such-thing-as-perfect-code-anyway dept. >>> securitas writes "ITBusiness has an interview from the Microsoft >>> Professional Developers Conference where Bill Gates says >>> >>> 'You don't need perfect code to avoid security problems.' Instead he >>> suggests that users acquire and properly configure firewalls and make >>> sure that they keep their software patches up-to-date. >> >> It's the same backwards mentality as Windows "developers" who think they >> shouldn't be concerned with compiler warnings. Sloppiness and a lack of >> professionalism is a away of life for them. It's all about the money: >> screw integrity and the customers. >> >> [quote] >> Gates: >> It turns out Luddites don't know how to use software properly, so >> you should look into that. -- The reason we come up with new versions is >> not to fix bugs. It's absolutely not. It's the stupidest reason to buy a >> new version I ever heard. When we do a new version we put in lots of new >> things that people are asking for. And so, in no sense, is stability a >> reason to move to a new version. It's never a reason. >> >> FOCUS: >> How come I keep being told by computer vendors "Well, we know about >> this bug, wait till the next version is there, it'll be fixed"? I hear >> this all the time. How come? If you're telling me there are no >> significant bugs in software and there is no reason to do a new version? >> >> Gates: >> No. I'm saying: We don't do a new version to fix bugs. We don't. Not >> enough people would buy it. You can take a hundred people using >> Microsoft Word. Call them up and say "Would you buy a new version >> because of bugs?" You won't get a single person to say they'd buy a new >> version because of bugs. We'd never be able to sell a release on that >> basis. >> [/quote] >> >> http://www.cantrip.org/nobugs.html > > Ah, and new versions of FireFox always advertise the fact they just fixed > bugs. > > LOL! > > Actually, one of the few times I have seen a company sell a big update based > on fixing the back end and *not* on features was Apple with OS X Snow > Leopard. Sure, they refined some things, but the focus was *not* features. > It was refreshing to see. These Linux loons are even more twisted than I thought. Ever notice how Linturds seem to like living in the past? Funny how that is. -- flatfish+++ Please visit our hall of Linux idiots. http://linuxidiots.blogspot.com/ Watching Linux Fail: http://limuxwatch.blogspot.com/ Linux's dismal desktop market share: http://royal.pingdom.com/2011/05/12/the-top-20-strongholds-for-desktop-linux/ Desktop Linux: The Dream Is Dead "By the time Microsoft released the Windows 7 beta in January 2009, Linux had clearly lost its chance at desktop glory." http://www.pcworld.com/businesscenter/article/207999/desktop_linux_the_dream_is_dead.html Desktop Linux on Life Support: http://www.techradar.com/news/software/operating-systems/is-linux-on-the-desktop-dead--961508
[toc] | [prev] | [next] | [standalone]
| From | Goblin <bytes4free@googlemail.com> |
|---|---|
| Date | 2011-06-17 19:33 +0100 |
| Message-ID | <a6NKp.7680$z96.5465@newsfe20.ams2> |
| In reply to | #33619 |
On 17/06/11 19:30, flatfish+++ wrote: > These Linux loons are even more twisted than I thought. Says the person who has been posting abuse, dishonesty and vulgarity here for 16 years (by his own admittion.) I wonder who the vast majority of people would think twisted? Best of British, -- Openbytes the Linux/FOSS Blogazine! - http://www.openbytes.tk "Cave quid dicis, quando, et cui." Catch me in #techrights on freenode.net BytesMedia: www.bytesmedia.co.uk Email: bytes4free@googlemail.com Skype: tim.openbytes Twitter: twitter.com/_goblin Identi.ca: identi.ca/openbytes
[toc] | [prev] | [next] | [standalone]
| From | JeffM <jeffm_@email.com> |
|---|---|
| Date | 2011-06-17 12:32 -0700 |
| Message-ID | <7dcd4288-62da-466b-b37a-f9aa2dcbf22e@16g2000yqy.googlegroups.com> |
| In reply to | #33481 |
Kari Laine wrote: >:Considering that Microsoft says it is focused on security > BWAHAHAHAHAHAHAHA! ...and quoting Homer in this thread (quoting Gates): |The reason we come up with new versions is not to fix bugs. | He convinced me. I haven't given $$$ to M$ or its partners since 1991.
[toc] | [prev] | [next] | [standalone]
| From | voodoo <voodoo@tootycar.net> |
|---|---|
| Date | 2011-06-18 17:16 +0000 |
| Message-ID | <4dfcdd70$0$21308$c3e8da3$a9097924@news.astraweb.com> |
| In reply to | #33481 |
On Fri, 17 Jun 2011 15:34:21 +0300, Kari Laine wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi, > > attached is a piece from Gates. I don't buy it that there were no > exploits before MS patched it. I am also sure that Open Source way of > working with code is more secure than closed source. Also patches seems > to come faster in Open Source world than MS world. But I must be wrong > because Gates said so... > > *********************** > Gates: 'You don't need perfect code' for Security CmdrTaco Oct 31 2003 > > from the no-such-thing-as-perfect-code-anyway dept. securitas writes > "ITBusiness has an interview from the Microsoft Professional Developers > Conference where Bill Gates says > > 'You don't need perfect code to avoid security problems.' Instead he > suggests that users acquire and properly configure firewalls and make > sure that they keep their software patches up-to-date. > > Considering that Microsoft says it is focused on security, the comments > from the Chief Software Architect aren't inspiring, especially beacuse > the underlying attitude seems to contradict the idea of well-written, > secure code. What kind of message does that send to the developers who > work for Gates?" > . > http://snurl.com/2stg > http://developers.slashdot.org/developers/03/10/31/1610250.shtml? tid=126&tid=172 > > > Gates: 'You don't need perfect code' for good security exclusive The > chief software architect's advice for safeguarding your apps Lynn > Greiner Oct 29 2003 > . > . > For example, today you either end up with tons of different passwords, > or you have to do things in a very insecure way. So this (Web services) > is really the next level of Internet integration, and the thing that > didn't exist is the programming model to unify those things. . > . > You don't need perfect code to avoid security problems. There are things > we're doing that are making code closer to perfect, in terms of tools > and security audits and things like that. But there are two other > techniques: one is called firewalling and the other is called keeping > the software up to date firewalling: here is gates saying "security is not our job, not our responsibility, not our problem." > . > . > Anybody who kept their software up to date didn't run into any of those > problems, because the fixes preceded the exploit .. in every case at > this stage we've had the fix out before the exploit .. can gates prove this? looks like a marketing lie. lying for windows. > .. it's people not understanding the design of APIs where you get > vulnerabilities. Certainly there are whole classes of vulnerabilities > like buffer overruns that are very well understood at this point, and > the scanning tools are very good and the compiler switches are very good > .. what blind stupidity. with active-x and mail preview ready to run any random code that floats your way, bad guys dont need to "understand the design of apis". they only need to find out how to abuse them. another example of gates saying "security is not our job" > .. actually all the forms of Unix as well as Linux have had more > vulnerabilities per line of code. can gates prove this? looks like a marketing lie. lying for windows. he does this a lot doesnt he? > They don?t propagate as much because > they're not as dense as our system is, what is that supposed to mean? meaningless marketing babble to hide "security is not our job". > so the things that prevent the > propagation are particularly important for our world ... . yea, too bad gates and microsoft just dont care about security. > http://www.itbusiness.ca/index.asp?theaction=61&sid=53897
[toc] | [prev] | [standalone]
Back to top | Article view | comp.os.linux.advocacy
csiph-web