...trying to hide in plain sight, implemented by a major corporation so nation states cold exploit customers.
> This idea that Microsoft is deliberately introducing bugs into its software so nation states can exploit them is so absurd, it really is tinfoil hat conspiracy theory ludicrousness
Replace Microsoft with AT&T and suddenly it makes sense?
> Are these good faith bugs or willful backdoors? Most likely they're bugs, but it is hard to know.
My suspicion on Microsoft has more to do with the latter facts I mentioned.
Then, you need to understand this happens within the framework of espionage, which is by nature concealed and discrete, and not necessarily with consent (e.g: infiltration).
It's enough if the NSA has people working at MS on their payroll.
But true, it's not right to assume any particular vuln is from spies.
Oh, and a new account, too. I should hope that few people here would be so naive as to not see through you.
One thing is a bug, another one is a backdoor. Are these good faith bugs or willful backdoors? Most likely they're bugs, but it is hard to know.
If I was Microsoft and I wanted to willfully plant a backdoor, I would take precautions to be able to get away with it if caught. Because security researchers can analyze them, and foreign governments have Windows source code, leaving intentional bugs as the only choice.
Now, the reasons I am suspicious of Microsoft:
- PRISM. Which is unequivocally mass surveillance.
- The Flame malware was able to install itself via Windows Update: http://www.computerworld.com/article/2503916/malware-vulnera... . The means by which the Flame authors achieved this are easier to explain if they received help from Microsoft.
- When Windows NT SP5 was released, the build accidentally came with debugging symbols (i.e: variable names were visible in binaries). A researcher found a variable called "_NSAKEY" containing a key which could be used to forge signatures. https://en.wikipedia.org/wiki/NSAKEY. Microsoft's explanation was that it wasn't related to the NSA, and that NSA in that context meant something else.