This is the result of nearly a decade of work from MSFT, across the board. They built better tools, drilled security into every new hire all the way to the execs, made it a part of every engineering and product process imaginable. Happy that is finally being acknowledged on the outside.
I still remember how painful it was to ship anything, waiting in queue for security team signoff. Good to see it payoff though. Good on Microsoft - making secure products and smarter engineers in the process.
"Happy that is finally being acknowledged on the outside."
Not to mention by a reputable security company in the business (we all know there's some sources whom are... biased... to put it nicely). Congrats to Microsoft, glad to see they've put security so highly on their priority list. Not to mention the involvement they try to get with hackers, and worldwide trying to stop spam botnets, etc... Very nice to see a corporation working like that.
Jan 15, 2002 email from Bill Gates to all MSFT staff [1]. Includes some real gems, like;
>So now, when we face a choice between adding features and resolving security issues, we need to choose security. Our products should emphasize security right out of the box, and we must constantly refine and improve that security as threats evolve.
I was hugely impressed by Bill when I read that memo, I checked with my friends who worked there to see if it was 'real' or a PR stunt, and they universally agreed it was very very real.
I suspect Google is about to be tested in this way given the adoption of Android on mobile devices. It is fortunate that they have a strong security culture to begin with but nothing proves that like being battle tested.
Google isn't the first company that would come to my mind. I'd rather go for Apple. Their mobile ecosystem might be a lot more secure than Android's, but the way they acknowledge OSX vulnerabilities and how soon they fix them is a weak spot.
Apple regularly loses security shootouts, and is widely derided by security people. Their only advantages are their niche status (which they are losing) and their lack of consideration towards old apps (they can dump old APIs which are hard to secure, and make other backwards-incompatible fixes, because they just don't care that much about backwards compatibility).
> Rather than developing standalone applications and Web sites, today we're moving towards smart clients with rich user interfaces interacting with Web services.
Good for him. This doesn't seem to be the attitude of many in the startup scene. It isn't the attitude of all too many app developers. It also doesn't seem to be the highest priority at Apple.
it was a response to the very real threat of Linux. MS was getting publicly beaten on an almost monthly basis by malware authors. It was a whack-a-mole contest to keep our boxes patched. I still scratch my head and wonder why our bosses have kept demanding Windows Windows Windows...
The "Summer of Worms", after Slammer, Blaster, and Welchia owned up some huge fraction of every Windows machine connected to the Internet, including large portions of the DoD. Microsoft's software security was repeatedly on the front page of CNN and the subject of Congressional hearings.
If you wanted to put Microsoft under a microscope from 2003-2010, during the time where they were actually putting in the work to transition from a 1990's software security practice to a 201x security practice, you'd find plenty of "smoking guns" to win arguments with on message boards.
TL;DR: you probably won't notice unless you are looking for bugs in their products, and trying to write exploits.
You will certainly not notice any improvement in their "creative" apps.
But these do not really form a part of most people's "internet attack surface". The priorities are Reader and Flash. Perhaps AIR.
Adobe Reader X is a lot more secure than Reader 9 was. The bugs are still there - many Reader 9 bugs affect X. However, exploitation is much harder, and I haven't seen anyone get reliable code execution in X yet.
They are supposed to be working hard on Flash too, although I haven't looked at that recently. I remain unconvinced that Flash is actually fixable, but perhaps they could win with strong enough sandboxing and exploit mitigation...
