Advertising
seattlepi.com
Subscribe | Contact Us | Seattle Post-Intelligencer
Jump to:  Weather | Traffic | Webtowns | Mariners | Seahawks | Sonics | Calendar
BUSINESS ?

OUR AFFILIATES
NWsource
KOMO
MSNBC
digitalcity
seattlepi.com Microsoft Blog

February 17, 2005

Clarke on Microsoft

Wednesday at the RSA Conference, I was able to grab a few moments with Richard Clarke, the former White House cybersecurity and counterterrorism adviser, as he left the Moscone Center after appearing on a panel. See this story from today's paper for his rather pointed comment on the notion of Microsoft offering its own anti-virus and anti-spyware software.

Here's what Clarke said on another topic -- his desire for Microsoft and other software companies to be held accountable to standards for secure software development:

"I think every software company should say what it does, specifically, to have quality assurance in software code writing and development. Ideally that would be generally accepted best practices derived from what Oracle does, what Apple does, what Microsoft does, so they can learn from each other's best practices and there will be a generally accepted set of best practices, and then we would know if people were living up to them or not. We could get a third-party auditor to come in and check whether or not they were living up to them. Until that happens, we really don't know whether it's all rhetoric or not."

During the earlier panel discussion, Clarke had explained that the concept would then let the marketplace judge the companies based on whether or not they adhered to those practices. For today's story, I asked Microsoft to respond to Clarke's comments on the subject. Here's the full statement from Amy Roberts, director of product management in the company's Security Business and Technology Unit:

"Many software companies including Microsoft are serious and committed to security and are making substantial investments in improving software on multiple fronts to protect customers from malicious attacks. At Microsoft, we feel that writing secure code is so important that we have formalized our security efforts by adopting a 'Security Development Lifecycle,' published our methodologies, including books on writing secure code and threat modeling, made our tools available to independent developers and offer formal training on security. Microsoft is active in organizations such as the Secure Software Forum, working with other industry leaders, to focus on application security as a life-cycle and industry-wide issue. The market is demanding security now and that hard work is going forward already."
Posted by Todd Bishop at February 17, 2005 08:57 AM
Comments

Bottom line? This is what I told them they would have to do way back in 1997-1998. Gates and I and many other executives read my weblog. So I posted last year about using their embedded system. I knew I won the argument when I was on a bus going past Microsoft and they were flying a flag no one had ever seen before - one for Microsoft embedded systems. On their own website I found case studies by some of their OEMs which were using the embedded product to make alternative system.

I've been viscously attacked by some of them over these design issues. In the computer industry our standard for security is to build various security shells. Nothing from the outside should be able to get to the core. So I've got Microsoft now referring to Longhorn as Microsoft new client system. It's all on my weblog. I have one of the oldest weblogs or blogs on the Internet. I've been doing this since we were only in text. I was taught design from the old master at IBM. I knew some of the people at NeXT and that they were working with the CIA. Apple bought NeXT. Now Apple and IBM are working together. Believe me, the people who have harassed me have really screwed up big time.

When I managed to finally get Microsoft to put up the security page on their web, I would ask some of the older retired engineers how come they could fix these problems so fast. The reason was because they knew about them all the time. Microsoft is literally going under due to attrition. Gates needs to find 7,000 people this year and he can't find them. He especially can't find the people with Ph.D. in security to work for him. Microsoft has been black balled due to my web. I have an underground like you couldn't believe.

Now interview Peter Neumann from SRI. Everyone loves P. LOL I acted as a go between for Gates for years, then in 1999 we got caught. It's all in court document. All of it.

Posted by: Joan L. Brewer at February 17, 2005 10:05 PM

Bruce Schneier wrote in Crypto-Gram
"SP2 is an important security upgrade to Windows XP, and I hope it is widely installed among licensed XP users. I also hope it is quickly pirated, so unlicensed XP users can also install it. In order for me to remain secure on the Internet, I need everyone to become more secure. And the more people who install SP2, the more we all benefit."
http://www.schneier.com/crypto-gram-0406.html#4
"Microsoft is harming its licensed users by denying security to its unlicensed users."

We have a situation here that Microsoft will need to deal with. The pirates have won along with Microsoft. The average PC user is less secure. Microsoft is working hard on it. So are the pirates and maybe smarter too. Windows appears very easy to crack. There may be more tools for cracking Windows, than tools for fixing it. It might not be worth fixing, if that is even possible. I would think that Microsoft Passport has been cracked more than once. I don't know and I really don't care much. It's a big problem.

Posted by: Jim Dermitt at February 17, 2005 10:22 PM
Post a comment









Remember personal info?







  ARCHIVES
November 2005
S M T W T F S
    1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30      

Monthly archive
· September 2005
· August 2005
· July 2005
· June 2005
· May 2005
· April 2005
· March 2005
· February 2005
· January 2005
· December 2004
· November 2004
· October 2004
· September 2004
· August 2004
· July 2004
· June 2004
· May 2004
· April 2004
· March 2004
· February 2004
· January 2004
· December 2003
· November 2003
· October 2003
· September 2003

Recent Entries
· Microsoft executive pay
· Windows in a Palm
· Audio Extra: Gates, Ballmer on Microsoft's future
· Gates, Ballmer Q&A
· Xbox exec on Revolution
· PDC behind the scenes
· Mac BU in Microsoft reorg
· Ballmer Q&A: Online Extra
· Allchin on 'hard lessons'
· Major Microsoft reorg

What is this?

  FROM THE P-I
· Report of Icahn deal boosts Yahoo shares
· Another bid for Yahoo, with help?
· Microsoft plans sales of Office, OneCare to subscribers
· Microsoft offers big-client deals
· Technology Briefing
· Microsoft releases files on software
  LINKS

News and information:
· WinInfo
· Microsoft Watch
· Directions on Microsoft
· WinInsider
· ActiveWin
· KOMO News: Microsoft
· NetworkWorld: Microsoft
· Google News: Microsoft
· Yahoo News: Microsoft
· Microsoft Research News
· Microsoft PressPass
· Channel 9
· Anti-Microsoft News
· NewsForge: Linux News
· Linux Today
· Mac News Network
· Mac Daily News
· Washington Post Filter
· G.M. Silicon Valley
· OS News
· Gillmor Gang

Blogs about Microsoft:
· Microsoft Monitor
· Unofficial MSFT Blog
· IW Windows Weblog
· Xbox 2 Blog
· Inside Microsoft
· CNet Microsoft Blog

Computer Security:
· Microsoft Security
· Wash. Post Security Fix
· Microsoft Security Response Center Blog
· Be Careful Out There
· Security Awareness Blog
· Bruce Schneier's Blog
· eWeek Security News
· Larry Seltzer
· Symantec Security Resp.
· McAfee Virus Information
· CNet Security Blog
· Security Focus
· Kaspersky Lab Analyst's Weblog
· Michael Howard (MSFT)
· Stephen Toulouse (MSFT)
· Network World Security
· Planet Security

Microsoft employees:
· Employee Blog Portal
· MS Watch List
· S. Somasegar
· Raymond Chen
· Dare Obasanjo
· Brad Abrams
· Heather Leigh
· Korby Parnell
· Matt Goyer
· Robert Scoble
· Don Box
· Chris Anderson
· Joshua Allen
· Chris Sells
· John Porcaro
· John Montgomery
· Kevin Schofield
· Rick Schaut
· Marc Miller
· Sean Alexander
· Larry Hryb
· Gretchen and Zoë
· Harry Pierson
· Mini-Microsoft

Search-related sites:
· John Battelle
· Greg Linden
· Unofficial Google Blog
· Yahoo! Search Blog
· MSN Sandbox
· MSN Search Weblog
· Google Blog
· Search Engine Lowdown
· Search Engine Watch
· Google Like a Hawk

Browser-related sites:
· Internet Explorer team
· mozillaZine
· Surfin' Safari
· Opera news
· Browser News

Technology Weblogs:
· Dwight Silverman
· Charlene Li
· Joel Spolsky
· Engadget
· Gizmodo
· Corante Apple Blog
· Amy Wohl
· Dan Gillmor
· Simon Phipps
· Buzz Andersen
· Chris Seper
· Hiawatha Bray
· Paul Andrews
· Doc Searls
· Chris Pirillo
· Campbell & Swigart
· Longhorn Blogs
· PDC Bloggers

Antitrust info:
· FindLaw: Microsoft
· DOJ Microsoft site
· Microsoft legal site
· Findings of Fact
· ComputerWorld Report
· Sun legal page
· Dan Kegel's antitrust site

Additional sites:
· Google Microsoft Search
· About Microsoft
· Microsoft User Network
· Tablet PC Buzz
· Living Without Microsoft
· Lockergnome
· WSA
· WashTech
· CyberLodge
· Microsoft Permatemps
· Apache Foundation
· Librenex
· Electronic Frontier Foundation

 
Home | Site Map | About the P-I | Contact Us | P-I Jobs | Home Delivery
 
Seattle Post-Intelligencer
101 Elliott Ave. W.
Seattle, WA 98119
(206) 448-8000

Home Delivery: (206) 464-2121 or (800) 542-0820

Send comments to newmedia@seattlepi.com
©1996-2005 Seattle Post-Intelligencer
Terms of Service/Privacy Policy