Lessons from last week’s cyberattack

There are very few free/open-source operating systems that get security patches for as long as Windows does.

Major versions of OpenBSD are only supported for 5-6 years. Most Linux distributions only get 3-5 years. Red Hat promises 10 years of support, the same as Windows 7/8/10. None comes close to the 13 years that Windows XP was supported for.

So you're gonna have to update anyway, at roughly the same interval if not more often, as if you had used an enterprise edition of Windows.

The real question should be: Can Microsoft write an OS that does not have to be constantly patched, month after month?

We know they have written such things as part of research. But still they continue to release software that is unfinished.

They have trained their users that failure to update is fatal. No doubt, if they are using Windows.

They also like to conflate "update" with "upgrade". They use these security problems in Windows to scare people into upgrading.

Windows 10, whether they like it or not. As others have noted, by design the new versions are not safer than the old ones.

Retroactively fixing reported issues does not make a new version more secure by design. They could just as easily fix the issues in the older version.

Can this company get anything right the first time? Will they ever design a system that is secure?

Do they have any interest in doing so?

Are they incapable?

There is nothing wrong with releasing something simple, secure and finished.

Does MS believe Windows users are not worthy of a secure OS?

I think Microsoft Research have contributed to development of L4 systems that run on baseband.

Do these systems have the same vulnerabilities as Windows?

Fixing problems after they occur (past problems) is admirable but other free opens source OS written by volunteers accomplish the same thing. The question is whether the design of the system is such that future problems are avoided.

Does Microsoft believe Windows users deserve more security? Can Microsoft deliver it?

All indications suggest the answer to both questions is no.

With no viable alternatives, no one can blame Windows users for sticking with it despite red flag after red flag, but it makes no sense to defend the Microsoft approach to security for Windows users. The company has no respect for Windows users.

Being responsive to a constant stream of reported vulnerabilities is an improvement from 1995 but as we can see it is not enough. Their software is still full of mistakes. They need to prove they can make something that is secure by design and that they are willing to do so for users.

(Truthfully, they probably do not need to do anything.

Quotes of 80% of Windows installations being tied to purchases of hardware are probably not far off the mark.

There is no selection of OS by most computer users.

A majority of users still get Windows pre-installed on the computers they purchase.

Microsoft could completely ignore users and it would not hurt their business, as long as they continue to maintain relationships with hardware manufacturers.)

Nearly all complex software will have problems and weaknesses not known at creation, much like nearly every car will have some kind of weakness that will wear out. While there are differences between the physical world and the digital one, I think my critique of the concept of demanding infinite warranties is still valid.

And yes, I do think software can "wear out", not in the same sense as belts get worn and spark plugs physically wear away, but in the sense of threat landscapes changing over time and our understanding of how these systems are used in the world. This is why we do maintenance on our software and systems, much like we perform maintenance on things in our physical world. When you fail to perform this maintenance, bad things happen. Computers get hacked, cars have brakes fail.

Software can indeed age. Go run Windows 95 on the public internet or an early version of Android.

> Was this exploit used to spy on allies?

Don't know, and unlikely to ever find out. If so, it was likely very targeted to avoid detection on modern systems. Was it ever used to spy on Iran's nuclear enrichment program?

> I do think we need to argue about priority of responsibilities.

Ok. What responsibilities does a US government agency have to disclose vulnerabilities? Should they be required to disclose all vulnerabilities found in software and equipment from US companies? Since a lot of that technology is used around the world, are you on with the corollary of it being harder for the US to spy on anyone using modern equipment?

How about disclosing problems found in tech products used by US companies? Should the NSA do that as well to keep those companies safe?

The US provides a fair amount of funding to organizations focused on finding and responsibly disclosing security problems, notably CERT[1] and US-CERT [2]. The NSA is a completely separate thing.

1: http://cert.org/about/ 2: https://www.us-cert.gov/

Edit: removed snark

I think the car analogy isn't that bad. New classes of security issues get discovered over time. Development processes which are considered "state of the art" at one point can become unacceptable 10 years down the road.

A decade in software engineering is a significant amount of time!