The principles for developing secure software were identified in the 1970s by Saltzer and Schroeder, and they're still true today. One of those principles is "open design", that is, don't depend on design secrecy for security of the system. Instead, depend on secrecy of things that are trivially changed (like private keys and passwords). Then, when the secret is exposed (or you think it might be), you quickly change all the secrets and there's no problem. One source of this paper: https://www.cs.virginia.edu/~evans/cs551/saltzer/
In the case of Windows, the source code is not really secret anyway. Most governments have continuous access to the source code, typically through the Microsoft Government Support Program (GSP) https://www.microsoft.com/en-us/securityengineering/gsp Many businesses and universities also have access to Windows source code. You can see various programs to provide such access in different cases via https://www.microsoft.com/en-us/sharedsource/ In addition, Microsoft employs a huge number of employees who have access to its source code, and you can't really keep a secret long when a large number of people know the secret. Efforts like bribes, appeals to patriotism, etc. will eventually successfully get someone to reveal a secret if there's a large enough group, especially since it's relatively easy to identify who works for Microsoft or otherwise might have such access.
If that's not enough, Microsoft distributes executables, and disassembers & decompilers can provide enough information for static analysis anyway. So you could re-derive what you need to attack Windows if you needed the source code for some reason.
Anyone who depends on secrecy of code to provide security is in trouble. Typically the real reason to keep (some) code secret is to support certain proprietary business models and to meet certain legal obligations, and are not really about security.
Note that Microsoft understands this; they're quite clear in stating that the security of Windows does not depend on keeping its source code a secret.
(The point is correct, but SSDs are probably a bad example: it is very standardised whether it is in consumer or enterprise space. Maybe nVidia and AMD with regards to graphics card would be a better example?)
Kerckhoffs's principle is usually stated as "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." Note that Kerckhoffs's principle only refers to cryptosystems. The open design principle is a generalization that applies to all systems, whether or not they are cryptosystems.
Yes. But with not enough eyes carefully reviewing the code security vulnerabilities will remain also in open source code. And once a bad actor finds it it will be easier to implement an exploit.
It's not opening the source that makes the software more secure. It's enough reviewers or white hats looking at the code. Security vulnerabilities in Linux (both kernel and user space) show that regularly.
Of course with closed source your external reviewers are zero, so that's not the solution.
Thank you for that additional point, it's worth being said and helps us model the closed source alternative.
Cool memory, thanks for sharing.
That's a lot of code. Scary.
It's estimated to be around 40 million lines of code
And 40 million lines for an OS is a crazy amount of code.
ALL source code for ALL active AND inactive projects? I highly doubt it.
You simply have no idea if the attackers had access to unshared, proprietary code or not. Like Azure server-side components.
I'm personally not a huge fan of Windows, and it definitely has flaws but the amount of considerations taken into account, and the speed with which issues are identified and repaired in a code base of that size, especially while maintaining a disgusting amount of backwards compatibility is crazy impressive.
That aside, having access to the source code does make finding issues easier. It sounds like that knowledge is assumed in their risk assessments which would make that a fair statement.
Do we know if they had access to their issue tracker? That would make it far easier to make zero-day exploits faster.
In any case, it's silly to think otherwise. It's always safer to assume everyone that we wouldn't want to know something already knows that, whatever it is.
While Microsoft does not assume that attackers haven't seen the source code, we cannot say how many people who are capable of spotting security issues have reviewed the code.
That being said, it's worth also saying it's a hard comparison to make overall; it's possible there are important parts of the Linux code base that have in fact had less eyes on them than Microsoft has had on theirs; without numbers it's hard to be certain.
This has been on the front page all day: https://madaidans-insecurities.github.io/guides/linux-harden...
It is safe to assume it is more PRIVATE than a Microsoft OS, but not more secure.
Please don't react emotionally to this... It was a bit jarring of a shift in thought to me as well, at first.
only windows applications that do not run in full trust mode, like store apps won't do that. and even without store apps you can use something like msix or app-v to package your apps in a "small" sandbox, but you can breakout from the sandbox via runFullTrust
With the Windows model, you don't check your guests at the door. You can't search all guests so you assume all guests are hostile and with it you're always taxed with playing security theater which can not only be expensive in terms of hardware resources but mental resources as well as losing more control over your own environment. Because you let unaudited people in your home, before long you have to lock down most parts of it, even from yourself. In gaining control you've lost control because you don't control for openness in the first place. For the few binaries I run on Linux I sandbox them in a VM anyway. But different models, different hosts, each has their weaknesses.
They might sincerely thing so, not knowing they were targeted and now all the binaries they ship are also containing a payload added by the attacker.
With open source software and especially the Linux distro model where one set of people writes the software and another buikds it from source and integrates it is much harder if not impossible to pull off such an attack affecting all users of a piece of software.
Is that why Microsoft, and all you people who poke at its binaries, have fixed all the bugs in MS binaries? /s
The true value in source code at this level are the comments and symbols. Microsoft provides most ofthe symbols, the comments you can’t recover from a binary.
Now that an adversary has MS’s source code, it is indeed easier for them to do vulnerability research. So this is a net loss for MSs overall security posture, not a win.
I don't know how much of this is true. Wouldn't it be helpful for bad actors to understand how Windows defenses work looking at the code thereby increasing the risk?