FSF responds to Microsoft's privacy and encryption announcement

Post by [deleted] » Thu, Dec 05, 2013, 9:27 PM UTC

obituary_latte wrote: post #3

jevinskie wrote: post #2

It seems like the response glosses over what Microsoft is actually doing and instead just attacks them for something unrelated (Widows is closed source). In the FSF eyes, Microsoft can do nothing to improve security until Windows is open sourced.

No, I think in the FSF's eyes -- rightfully -- it can't be proven that security has improved. I also can't agree that it isn't related. If I tell you I'm wearing a green shirt, how can you know for sure if you or someone you trust hasn't verified it? You can't. It's the same with MSFT. But in the case of MSFT, it has been proven that they wear a lot of Hypercolor[1] stuff. Is it good that MSFT is doing stuff to make…

Post by obituary_latte » Thu, Dec 05, 2013, 9:33 PM UTC

criley2 wrote: post #11

obituary_latte wrote: post #3

Earlier quoted context omitted.

No, I think in the FSF's eyes -- rightfully -- it can't be proven that security has improved. I also can't agree that it isn't related. If I tell you I'm wearing a green shirt, how can you know for sure if you or someone you trust hasn't verified it? You can't. It's the same with MSFT. But in the case of MSFT, it has been proven that they wear a lot of Hypercolor[1] stuff. Is it good that MSFT is doing stuff to make…

So, Microsoft and its Windows product adheres to no industry standards, has no external audit process, has never been verified by a private or Government contract agency through audit or other verification process? I work in a small programming company and we do internal and external audits while maintaining compliancy with federal and state regulators as well as groups like ISO. Sure, our work is closed source, but…

Post by npsimons » Thu, Dec 05, 2013, 9:36 PM UTC

Sanddancer wrote: post #9

I just love how the FSF ignores, and has ignored for a considerable amount of time that governments, and organizations can and have gotten the Windows source code, and that their actions today restate that they do provide the windows source code for governments to audit. Given that such programs have been available for a considerable amount of time, one has to wonder when the FSF is going to change their tactic away…

Post by andrewfong » Thu, Dec 05, 2013, 9:43 PM UTC

obituary_latte wrote: post #14

criley2 wrote: post #11

Earlier quoted context omitted.

So, Microsoft and its Windows product adheres to no industry standards, has no external audit process, has never been verified by a private or Government contract agency through audit or other verification process? I work in a small programming company and we do internal and external audits while maintaining compliancy with federal and state regulators as well as groups like ISO. Sure, our work is closed source, but…

No, I did not say those things. That aside, if you wanted to, after an audit/review concluded, could you put a backdoor in your software? Since it's closed source, would anyone know about it?

Post by DanBC » Thu, Dec 05, 2013, 9:50 PM UTC

electic wrote: post #19

codezero wrote: post #10

Earlier quoted context omitted.

Because they employ intelligent, skilled people who care and know more about privacy than I do. How many open source projects have most people audited for their own sense of satisfaction about its security promises?

Unfortunately, those skilled people at MS have let the NSA in on so many 0-day exploits. God knows how many have not been reported to the public yet. At least with open source, I know there is a community behind it for me or others to verify. Sure it is not 100% fool proof, but it makes it far harder to sneak bad things through.