FSF responds to Microsoft's privacy and encryption announcement

https://www.fsf.org/news/fsf-responds-to-microsofts-privacy-and-encryption-announcement

by eltondegeneres • 13 years ago

54 64 13 years ago

jevinskie• 13 years ago

It seems like the response glosses over what Microsoft is actually doing and instead just attacks them for something unrelated (Widows is closed source). In the FSF eyes, Microsoft can do nothing to improve security until Windows is open sourced.

obituary_latte2• 13 years ago

No, I think in the FSF's eyes -- rightfully -- it can't be proven that security has improved.

I also can't agree that it isn't related. If I tell you I'm wearing a green shirt, how can you know for sure if you or someone you trust hasn't verified it? You can't. It's the same with MSFT. But in the case of MSFT, it has been proven that they wear a lot of Hypercolor[1] stuff.

Is it good that MSFT is doing stuff to make things more secure? Sure. Do we still have to take it on faith that they are doing everything they can to protect their users? Yup.

[1]http://en.wikipedia.org/wiki/Hypercolor

criley2• 13 years ago

So, Microsoft and its Windows product adheres to no industry standards, has no external audit process, has never been verified by a private or Government contract agency through audit or other verification process?

I work in a small programming company and we do internal and external audits while maintaining compliancy with federal and state regulators as well as groups like ISO.

Sure, our work is closed source, but that doesn't automatically mean it hasn't been externally verified for a number of different things by a number of different organizations...

hansjorg• 13 years ago

Why would you place any amount of trust in a closed source privacy solution from a company with a history such as Microsoft's?

codezero• 13 years ago

Because they employ intelligent, skilled people who care and know more about privacy than I do.

How many open source projects have most people audited for their own sense of satisfaction about its security promises?

the_af3• 13 years ago

I think the article glosses over Microsoft's security measures by design. It is consistent with the FSF's position that closed/proprietary source is inherently more insecure than open source because you cannot freely review (even if you have the technical knowledge to do so) whatever measures the authors say they implemented.

strlen• 13 years ago

It is very much related: closed source software isn't audited in the open. Core principle of building secure software is one must assume that their adversary has the source code and is actively building newer and newer attacks based on it (corporate leaks happen all the time). It's not impossible to follow through with this principle when building closed source software, but it is a lot easier to handwave it.

I am not a fan of FSF's tone here, they could be more diplomatic -- but saying "we appreciate your effort, but you fail" would have been more insulting. I think there are many places for closed source software, but core privacy software is not one of those places.

The encryption core (the critical pieces that either input or output plain text -- the places where the attack is more likely to succeed as opposed to the core of the algorithms), as well and the general platform should have the source code available (even if at a fee). That's not quite the FSF vision, but perhaps the powerful vision is needed (one can think of FSF's goals as a captivating utopian story that leads to more incremental improvements).

zvrba2• 13 years ago

A lock on your own house to which you do not have the master key is not a security system, it is a jail.

This is completely bogus. The owner of the master key may have the access (understandably undesirable), but that does not keep you from getting out. If anything, it's like having no lock at all.

sb057• 13 years ago

True, but their point that "these promises are meaningless" remains valid.

zvrba2• 13 years ago

Replace "Microsoft" with manufacturers of food, cars, medicines, personal hygiene products, etc. They are regulated, inspected, but all under the same / similar conditions:

or access granted to outsiders covering very limited portions of source code under strict agreements that limit sharing that information

You are trusting the manufacturer's promises. Are they essentially meaningless just because the general public doesn't have insight into manufacturing details?

nivla• 13 years ago

huh? I know this isn't going to be the popular opinion but I have to get this off. As much as I respect FSF, this mentality is one of the things I dislike about them. Statements that imply either you are with us or you are evil, trying to crash at opening events of MS/Apple "saving" people from closed source etc.

Not everything has to be open source and not everyone has to choose open source. Microsoft/Apple/Google may never make their core products open but it doesn't mean they can't try to make it secure or privacy conscious. The beauty of freedom is that YOU get to choose and trust what you want, good or bad, open or closed.

As a developer, I find GPL to be against the "spirit of open source", but it would be extremely wrong for me to demand you license your code differently or to even suggest to your clients to choose a liberal license. Its yours and their choice not mine.

davexunit2• 13 years ago

As a developer, I find GPL to be against the "spirit of open source".

It's not about open source. It's about free software.

https://www.gnu.org/philosophy/open-source-misses-the-point....

TylerE• 13 years ago

Which is, urm, rather the point.

Some of us care more about open source than free software.

kubiiii• 13 years ago

I think you are right. If microsoft comes out with some sort of license that ensure that they will protect our privacy (or allow us tu sue the hell out of them if they fail to do so) that would be a way to achieve this.

pessimizer5• 13 years ago

I find GPL to be against the "spirit of open source"

More like Open Source is against the GPL, which is really the only reason the OSI came into existence.

either you are with us or you are evil

Free software is about morality, not about getting or giving away free stuff. When you take a moral stand, you're necessarily making a moral judgement about people who don't.

Open source sells itself as a better way of doing business. Free software supports people's full ownership of their own devices even if it is worse for business.

Sanddancer5• 13 years ago

I just love how the FSF ignores, and has ignored for a considerable amount of time that governments, and organizations can and have gotten the Windows source code, and that their actions today restate that they do provide the windows source code for governments to audit. Given that such programs have been available for a considerable amount of time, one has to wonder when the FSF is going to change their tactic away from their current one of outright lying about the situation.

davexunit2• 13 years ago

"Freedom and security necessitate not just being allowed a peek at the code."

"Transparency in the Windows world normally means self-reports commissioned by Microsoft, or access granted to outsiders covering very limited portions of source code under strict agreements that limit sharing that information."

Yup, John Sullivan really ignored that.

You can disagree with the FSF's mission, but they are certainly not spreading lies on purpose.

Sanddancer5• 13 years ago

The source agreements are far more than just a "peek" at the code. I would still argue that Mr Sullivan is at the very least distorting the truth, if not outright lying. The FSF has its agenda, and has proven it will try to distort the motives of any entity that doesn't completely agree with it.

npsimons• 13 years ago

I just love how you like to equate governments and organizations (not individuals) getting to peek at source code (that they're not allowed to modify, share or comment publicly upon) under an NDA as "open source". Who's outright lying?

Sanddancer5• 13 years ago

I never said it was open source. However, the source is available, and researched, by third parties. The announcement today also states that they are making the source available to more eyes than before. Not everything needs to be completely open source.

drcube4• 13 years ago

So the NSA can see Windows source code, but Windows users can't? And users are supposed to feel secure about this? Why?

Sanddancer5• 13 years ago

More than just the NSA. This shrill hyperbole that permeates the free software world is counterproductive to getting things fixed.

perlgeek• 13 years ago

Can those organizations also build the code from source, and then exclusively use the binaries they produced? And possibly even compare to the binaries that Microsoft ships?

Just being able to see the code is no advantage, you still have to trust Microsoft to actually ship the same code they've shown you.

danbruc6• 13 years ago

Open/closed source software and secure/unsecure software are orthogonal concepts. Yes, it may be easier to assess open source software with regard to security and privacy issues, but it is absolutely not necessary. And even with open source software the overwhelming majority of users still has to trust some third party because it is absolutely unrealistic that every user or organization audits their complete software (and hardware) stack. The only thing you really gain is that you are free to choose which third party or parties you have to trust.

drcube4• 13 years ago

At least with FOSS, I get to choose the third party I trust to verify my software's security. And I don't have to take it on faith, I can get a second opinion, or audit the parts I care most about myself.

danbruc6• 13 years ago

Added exactly this while you wrote you comment. I don't deny that open source software has advantages in this regard.

rbanffy5• 13 years ago

Open/closed source software and secure/unsecure software are orthogonal concepts

No, they are not. It's fundamentally impossible to secure proprietary software because you have to trust its provider the software does what it says it does whereas with open-source you can always check for yourself. Any backdoor in open-source software is there to be exposed and corrected.

With proprietary software only one party can disclose vulnerabilities and in open-source anyone with the knowledge can do it. You can choose to trust a single party or choose to trust a myriad of different parties any one of which can blow the whistle if they find something fishy.

I find it highly unlikely a backdoor to a popular open-source application could remain there for long. I don't think it's unlikely at all with proprietary software where there is no incentive to fix a problem until someone outside the company learns about it.

danbruc6• 13 years ago

It is not impossible. There is no reason why closed source software can not be secure. Yes, you can not convince yourself in the same way you can with open source software but again secure software and the ability to convince yourself that a software is secure are different things.

dmfdmf• 13 years ago

I think FSF has an open-source axe to grind here and this happens to be an issue they can use to bash MS. I do think MS should be praised for improving security. However, don't forget Snowden's warning -- encryption does not help you if you don't have secure endpoints. Moreover, encryption does not help you if you have rogue agencies with secret courts, secret rulings, no due process and no legal rights in a police or dragnet surveillance state.

I hope the big tech companies are serious about protecting their users, even foreign users, since their business model depends on it.

salient• 13 years ago

As long as Microsoft tells NSA about the bugs they have in Windows before they start fixing them [1], that just constitutes the same thing as "backdoors", since with many of those bugs NSA can take full control of a machine.

So Microsoft doesn't need to "give NSA a backdoor". They just need to tell them about certain bugs before they fix them - and that's just as bad as giving them backdoors, since NSA can and will use them as such.

[1] http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t...

astrange• 13 years ago

You're describing a security disclosure program. Since anyone else could have (and often has) already found the attack, the point of this is to put the defenses up as early as possible.

Surely real valuable attacks would be ones there's no planned security update for.

pessimizer5• 13 years ago

You're describing a security disclosure program.

No, a security non-disclosure program. Disclosure is when you tell people. Telling a spy agency in no more "disclosure" than telling a Russian trojan dev.

logn• 13 years ago

I don't think people should be so dismissive of the FSF's argument here. It's central to the issues with security these days. P2P Affero GPL licensed software is about the only way to be secure anymore. Even then, we have issues with unknown code and hardware at the lowest levels of the stacks.

tigerweeds• 13 years ago

Microsoft's effort to protect customer data from government snooping? sounds legit. I'll just leave this here https://www.schneier.com/blog/archives/2007/12/dual_ec_drbg_...

pippy• 13 years ago

You've got to read between the lines with a corporate statement. There are two major issues this one:

1) They're giving no indication that they can't decrypt their customers data. This won't protect customers from the thousands of information requests that they're not allowed to publicly acknowledge, and will only hamper vectors such as MITM fibre splitting. This is concerning given the fact the US intelligence agencies share their data with private companies, and that Microsoft didn't even attempt resist previous requests. They have no incentive to inform customers and fight expensive legal battles, so as soon as the whole privacy thing blows over it will be back to old habits.

2) Allowing companies to review their source code is only useful for their desktop products. Most data is going into the cloud now, plus it's possible to use cross library exploits and obfuscated code. I don't actually think that they'll do this now, hover they've done it in the past with their famous NSAKEY in the 4.0 kernel.

Office 2008 with a firewall will keep your data safe. Office365 is a company risk. I wouldn't put anything more confidential than a CV or short story on it.

FSF responds to Microsoft's privacy and encryption announcement

Related Stories