[Am-info] Anti-Trust Remedy Threatens Security, says Allchin

[Felmon Davis]

On Thursday 16 May 2002 07:08 pm, Sujal Shah spake and saith:
> On Thu, 2002-05-16 at 17:29, Felmon Davis wrote:
> [SNIP]
>
> > Can someone explain this one to me? It seems to me that (a) what
> > Allchin says is right, to a degree, and that (b) the implication
> > that Schultz drolly draws isn't valid.
> >
> > (a) If MS 'exposes' API's then software producers can even
> > _inadvertently_ produce untoward effects esp. if they don't
> > follow a

>[...]
> Allchin is implying that security will irreparably be damaged by a
> disclosure of the IE source.  It's important to recognize the key
> point in my statement.  He's playing the FUD factor by merely
> implying the "irreparable" part.
>
> Another way of looking at this, which I believe is more accurate
> might be that releasing the source code may expose insecurities
> that haven't been vetted by their
> testing/debugging/security/Trusted Computing staff. This will
> temporarily hurt security, but will eventually result in better
> security as outside developers and bug hunters can also release not
> just bug reports, but also suggested fixes directly to Microsoft.
>
>[...]
> It depends on your perspective.  Temporarily, they might run into
> issues, but in the end it will result in stronger security, because
> those professional bug hunters will have an easier time vetting the
> code for Microsoft (the maximum bugtesting your alluded to).
>
> The real objection Microsoft should be making is that even for a
> short term "flood" of bugs/exploits, the cost for the computing
> community would be enormous.  I believe that there will be a period
> of frequent patches, but nothing that the Microsoft user community
> isn't already dealing with on a regular basis.  Therefore, I don't
> really buy the cost argument.  I could be convinced (I don't,
> obviously, have any numbers on this).
>
> The problem with this claim is that they would be implying or
> admitting that it is likely that security flaws exist in their
> code.  I'm not sure that they would ever want to say that.
>

Thank you for a very illuminating discussion. I've taken the liberty 
of cutting out a couple of pieces which I wanted to focus on, very 
briefly.

What they tell me is that exposing Windows code would be:
(a) costly to consumers, 
(b) likely to generate instabilities as bugs get discovered and 
abused by undisciplined software writers, 
(c) likely to generate insecure code (as a result of (b)), and 
(d) costly to MS as it struggles to fix bugs, fend off liability and 
protect its 'value' and standing.

Of course, in the long run (but somewhere short of its death) it 
might strengthen Windows code, improve its security, stability and 
coherence, etc.

(I suppose there may also be 'trade secrets' that could be exposed 
with 'intellectual property' issues.)

I take the point then is not that Open Source _as such_ is insecure 
(etc. etc.) but that the novel (?) experiment of transitioning a 
large proprietary bundle to Open Source would be precarious and 
fraught with risk. And moreover, MS might be right that the risk is 
not worth it to _them_.

Am I getting a bit closer?

F.