:
: : Companies like Microsoft practise "security through obscurity"; that is, they keep quiet about security flaws and hope people don't notice; they also make reverse-engineering Windows a civil offense (that is, de-compiling the binaries and looking through the source code).: SDF: Hey! Who said that "reverse-engineering Windows" was a "civil offense"? How does that all have the status of "law" wherever you live? I'm sure the legal experts here would want to know... is there a link out there that says anything about all this?
Sorry; wrong term. I'm no legal expert; what I meant to say was that reverse-engineering Windows would land you with the civil suit from Hell; since Microsoft's lawyers are just about the nastiest bunch of thugs in the corporate world; you do not want to muck around with them.
The Windows 95 End User License Agreement states;
2. RESTRICTIONS.
- You must maintain all copyright notices on all copies of the SOFTWARE PRODUCT
- You may not distribute copies of the SOFTWARE PRODUCT, except as expressly provided in Section 1.
- You may not reverse engineer, decompile, or disassemble the SOFTWARE PRODUCT, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation.
(yadda yadda yadda)
7. NO WARRANTY. ANY USE OF THE SOFTWARE PRODUCT IS AT YOUR OWN RISK ...(three more lines saying exactly the same thing)...MICROSOFT AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES AND CONDITIONS...(more of the same).
8. NO LIABILITY FOR CONSEQUENTIAL DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL MICROSOFT OR ITS SUPPLIERS BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMAGES WHATSOEVER (...blaa...blaa...blaa) EVEN IF MICROSOFT HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
9. LIMITATION OF LIABILITY. MICROSOFT'S ENTIRE LIABILITY AND YOUR EXCLUSIVE REMEDY UNDER THIS EULA SHALL NOT EXCEED FIVE DOLLARS (U.S. $5.00).
(sorry about the caps; I was quoting directly from an EULA I'd just taken out of an unused copy of '95 I had floating around.)
Basically, if MS suspects you of impinging on their intellectual property, they will grind you into a fine paste. And given that MS is in fact larger than most national governments, if it isn't a civil offense, it might as well be in real terms.
The above terms apply from the moment you first turn your Windows PC on; so if you do what most first-time PC buyers do (toss the manuals and EULA to one side, plug the PC in and turn it on), you are subject to a contract you may well never have read.
And if a known weakness in Windows PCs results in your business losing massive amounts of money, that's entirely your problem and not Microsoft's. So when the Melissa virus took out 60,000 PCs (thus disrupting the businesses they were running in), Microsoft was legally watertight and liable for no more than 5 dollars compensation, despite the fact that it was Microsoft products that made the virus so dangerous.
(Fittingly, though, Microsoft was one of the worst-hit companies, along with Intel and Lucent.)
It would be entirely possible to mount the Java weakness I mentioned above as a payload inside a Melissa-like virus (or a similar virus like Sharefun.a); at this point you would end up with a phage that would actually behave like a true phage; it would propagate itself without any user intervention; you wouldn't have to launch a mail attachment to make it work (as you did with Melissa). Since Microsoft's version of Java can access the kernel of Windows, you could use a Java applet to invoke a Melissa-like contamination to users in Outlook's address book before then running C:\DELTREE and formatting the hard drive; wiping any user-created data. All antivirus software currently on general release only examines suspect attachments when you try to launch them; thus an MS-Java virus would get past, since it doesn't need the attachment to be launched; it merely needs the mail to be opened.
Projected rate of infection; let's say it takes the average mail about 3 minutes to get through; and each user has 5 people in his address book. The virus would spread by simple geometric progression; within 10 iterations (i.e. 30 minutes) from the infection of one PC, over 9.5 million PCs would be hit. Of course, this should be estimated downwards by about 5-10 times, since everyone knows everyone else and not everyone reads their mail at the same time; but it would knock out most of the Windows PCs in the world within a day; that includes government PCs, hospital PCs, defence PCs, school PCs; any PC connected to the 'net would be at risk. In all probability, thousands of lives and trillions of dollars would be lost.
Microsoft's total liability for this would be five dollars, despite the fact that it was their security weakness that would have enabled the plague to spread.
Of course, as far as I know, no such virus exists yet; the Java weakness was only discovered in September and MS has issued a patch. However, the MS implementation of Java has been around for 3 years or more; there are a large number of vulnerable PCs out there, especially considering that the vast majority of Windows users do not know how to patch their operating system. It's also not helped that Microsoft has kept quiet about the whole thing to protect their revenues.
And, as I said, a bored teenager could knock up such a virus in a couple of days; it just requires a working knowledge of the MS JVM (Java Virtual Machine) and experience in virus writing.
Part of the reason this happens is that Microsoft has only 5-6,000 people working on the source code; and a similar number hunting for bugs who are allowed to look at the source code. As the license says, anyone else who looks at the source code will be crapped on from a very great height by Microsoft and their lawyers.
The key feature of Linux is that the source code is open; the general public are actually encouraged to play with it and hunt out bugs and try to break it.
Of the estimated 7 million Linux users, a good million of those are skilled computer professionals who know what a bug looks like; and a good 200,000 of the world's Linux users are actively involved in debugging and coding Linux; which means that Linux source code gets submitted to academic peer review before being allowed out into the world. Monolithic software companies like Microsoft simply cannot afford to hire 200,000 programmers; and any attempt to enforce uniformity on those 200,000 would cause most of them to rebel out of sheer bloody-mindedness; which is why Linux software is extremely reliable and fast-evolving, extremely varied and comparatively bug-free. It's also why Steve Ballmer (CEO of MS) rates Linux as "one of the five things that keeps him awake at night".
(Funny link of the day; Microsoft is lobbying the US Government to cut the budget of the Department of Justice's antitrust division by $9 million. Senator Slade Gorton (Rep., Washington) is apparently confident that he can persuade Congress to go with a figure some $11 million lower than the department are asking for. Microsoft apparently feel that weakening the DoJ's antitrust group will give them more chance in the appeals process in the DoJ vs. Microsoft case. And they've increased their donations to the Republican Party by some 300% this year as well.)
Farinata.
