This is pretty silly. Source code for Cisco and Microsoft products has been circulating since the dawn of the Internet. Meanwhile, Microsoft has some of the most meticulously reverse engineered code on the planet. People who want to illicitly mint zero days out of Microsoft products already have the tools to do so.

And therefore, the "rash of exploits" has already happened and is still ongoing. I think it's just so inconvenient/scary to most people to understand how much is hacked/hackable that they refuse to believe it.

In my opinion the smooth operation of our infrastructure relies less on its security as it does on the discretion of the hackers that have already compromised it.

Another bad thing would be if they got access to the build machines and to the certificates management systems...

I don't think it's silly. Having access to high-level source code beats combing through disassembler output.

Disclaimer: am Microsoft employee.

tplacek's point isn't that source is worse than disassembler output, it's that governments already have and have had access to source for a while (by design as Microsoft does provide source access to many customers, partners, etc). The tooling to dissemble built versions and craft exploits has also existed for a long while.

If source access enabled a rash of zero days, that point in time would have come long in the past.

How long has Microsoft been giving source code to China officially? I know they made that a public stipulation.

Not that alternative means were likely employed for a number of years before that.

Since 2003: https://www.cnet.com/news/china-to-view-windows-code/

This is basically ending this whole thread then.

Nation state hackers with Microsoft source code 'on my'.

Even commercial-wise I doubt it's much concern for making products. Source code doesn't equal a software business, every business knows that. Unless there's some unreleased AI source code sort of thing.

This is a genuine question (and a very tangential one that will hopefully not generate discontent): Has Microsoft ever explored the idea of open sourcing Windows? I don't know much about the propritary side of software but it seems like Microsoft has been pivoting toward SaaS, Azure, etc and with the inclusion of WSL it seems like Microsoft is less concerned about competition from other OS's in the traditional sense, or am I grossly underestimating how much licensing Windows earns Microsoft. Not advocating, I am just curious.

> Has Microsoft ever explored the idea of open sourcing Windows?

Good question. I have zero insight to the matter.

However, I have worked at a vendor when they decided to open source their code. It was a much smaller code base than what Windows probably is. It is quite a big effort. There can be all kind of dirty stuff in the code that you need to clean up. Either for legal reasons because you have purchased the code many years ago, but you are not allowed to publish it. So you need to dig out old contracts and have legal to check what was written when nobody even remotely thought that you could ever open source. And there might be engineering reasons that some code is so bad that you can just not show it.

Wasn't there this story some years ago that Microsoft had some odd DLL in Windows(?) that they couldn't even rebuild themselves anymore, because it required a compiler that has gone out of support years ago. I don't remember the details, but I am sure a code base with the history and size of Windows has some dark spots. Unless someone can tell me convincingly that Microsoft nowadays has a CI this that builds really everything from source in a fully reproducibly manner. I guess if they do they would have proudly reported at a software conference about it. I am not aware that they would have done that, but I am not actively following that field.

Yup this is all ringing a bell. Equation Editor.

https://news.ycombinator.com/item?id=15720923

I think at this point in time it's either breaking backwards compatibility (definitely not desired by Microsoft's enginners) or breaking license agreements on the parts of code not owned by Microsoft (definitely not desired by Microsoft's lawyers).

You're only reading half of my comment. The other half points out that people who don't care about the law have had access to high-level Microsoft source code for as long as there has been an Internet. Microsoft's trees circulate just like everyone else's.

Companies like Microsoft and Cisco have made their source code available to governments for years, for whatever that is worth. The US government has full access to all the MS source code.

Does this include access to thinks like the Azure Control Plane components? In my mind, that code has a different exposure.

Why would this actually be true? If it’s easier to find in source, Microsoft probably would have found it. Ever single feature there goes through multiple security reviews and there is tons of code linting. All the penetration testers I have met don’t even bother looking at source. They just start trying things they think will flummox the software.

>They just start trying things they think will flummox the software.

This works...until you go against a target that's heard of fuzzing before and has the time and money to do it to their own code.

The really interesting Windows exploits require a combination of "throwing stuff that will flummox the software" and a deep level understanding of structures hidden to the average developer. Look at Yardin Shafir's really wonderful blog post about developing a kernel bug to a PoC - there's a lot of moving parts and security checks in modern windows, and having the source is a HUGE help.

Yardin Shafir's excellent blog post started with a bug found purely through fuzzing by an MS employee security researcher.

I tried Googling to find this blog post. Did you mean to write Yarden Shafir? If yes, maybe it was this blog post? https://windows-internals.com/printdemon-cve-2020-1048/

I also found another hint about their findings in this PDF written by Yarden's co-researcher Alex Ionescu: https://www.usenix.org/system/files/woot20_slides_ionescu.pd.... One of the slides specifically mentions the use of fuzzing tools to find these issues.

If there are other, better links I don't know about, please kindly share. :)

Forgot to check for replies. In particular, I was thinking of this blog post: https://windows-internals.com/exploiting-a-simple-vulnerabil... Thanks for the correction, sorry I typoed her name.

Here's a tweet from the original finder: https://twitter.com/gabe_k/status/1330966182543777792?s=20

Yarden & Ionescu's work are both really top notch. Also anything by Google Project Zero if you want to do a deep dive on the subject.

> If it’s easier to find in source, Microsoft probably would have found it.

Umm sir, have you somehow missed seeing the quality of Microsoft products in the last few decades.