Microsoft’s Many Eyeballs and the Security Development Lifecycle

From the article:

"In product after product, Microsoft continues to ship fewer vulnerabilities than our competitors." ... and

"But conduct your own research, use your own methodology and I think you’ll see: in product after product, the Microsoft offering is usually more secure than the competitors."

And the same old argument, "True, there are potentially more eyeballs in the open source community than the proprietary community, but the proprietary community has an advantage: the salary participation program."

So, a Microsoft security manager claims that Microsoft ships fewer vulnerabilities than its competitors, and Microsoft has the advantage of paid developers.

This is new?

dj ... ah may I call you that? Well whatever, being the resident shill for MS and others* on LXer, let me tell you that MS is right. It has fewer bugs, it's faults unlike Linux gross errors are intentional. It's called Flawed by Design. So there.

YBT

* As always open for new work, preferably with low rubber content payments.

You can call me dj or deejay. Just don't call me late for supper!

Flawed by Design. Is that anything like Ford Motor Company's planned obsolescense?

YBT: No wonder those checks never arrive.

Here's the right answer: Microsoft's offerings don't have flaws. The users just don't use our products the way they're supposed to. We believe in freedom, so we give users enough rope to shoot themselves in the foot, but it's hardly fair to blame us when they use our products in an insecure manner.

You do believe in freedom, don't you? Maybe those long-haired, commie, live in Mom's basement open sourcers don't like freedom, but we believe freedom is a much better fit for your corporate needs.

Quoting:it's faults unlike Linux gross errors are intentional.

Once the flaws are in there long enough, they can't be removed, or too many programs will break.

So, intentional or otherwise, after a while, the only difference is academic.

Shawn Hernan has a point but it's a matter of tactics versus strategy. Better engineers, better designs, code review, static and dynamic analysis are all important for producing more secure code but none of that matters when an idiot CEO decides to integrate a web browser into the OS, ship incomplete products to meet a deadline, or maintain flawed security models in order to support legacy applications.

> Microsoft continues to ship fewer vulnerabilities

Luckily I wasn't drinking anything, or I'd need a new keyboard. Really. First time I can say that, usually I just chuckle quietly.

They're not flaws, they're undocumented features.

(not to be confused with the epic fan-fic _Undocumented Features_, http://www.eyrie.net/UF/ )

> [HYPERLINK@www.eyrie.net]

Looks like you have an extra ) at the end of your URL, Bob.

Yep, I had put the ")" right at the end, but it looks like it's been fixed by someone else before I got here this morning.

I added a couple more spaces, just to make sure.