Hackers exploited Word flaw for months while Microsoft investigated

* Microsoft warned in March of active attacks

* Microsoft schedules patch for April 11th

* McAfee sees attacks on April 6th

* McAfee publicly explains how to use the exploit on April 7th

* April 9th attack-kits are publicly for sale

* April 11th Microsoft releases public patch as scheduled

McAfee fucked up here.

What the users are free to do, however, is use an operating system/stack that they CAN evaluate the source of.

If linux or any other open source alternative was a better actual product, it would find its way to the top of the market. In fact, it already has, on the server... by far. But linux wasn't made to be easy to use, to be quick and easy to install, to install other software onto, etc... and that has kept it back, and it kept it back long enough for microsoft to establish a de-facto standard on the home desktop market...

The closed or open source status of a product has no bearing over its superiority at all. Again, in the world of geeks, it may, but in the world at large, it doesn't, and really, it shouldn't.

It's kind of like when a very lazy person turns into a marathon runner. They made huge changes.

Most people feel Microsoft is managing security better than the main Linux-based operating systems do, in terms of auditing, coding standards, code reviews, and developer security education. (That doesn't mean that they're doing this better than each and every individual open source project.)

Some of the people agitating for giving Microsoft more credit about this have personally seen the results, as in-house or contracted developers or auditors.

It can be hard to make an apples-to-apples comparison about what this means for the security of deployed systems because people are potentially using the systems in different ways with kind of different attack surfaces. (For example, quite a few Windows desktop users may still be downloading unsigned binaries from HTTP sites, which Linux users would be less likely to do because of the prevalence of package managers -- though maybe some of those Linux users will do the curl | sh thing from an HTTP site too.)

I don't think that a typical open source project has improved to the extent that Microsoft has during this timeframe, though, again, it's hard to know exactly what to compare or how to compare it.

https://en.wikipedia.org/wiki/Microsoft_Windows#Third-party_...

I'm not defending MS here, but I imagine that Word's codebase is a helluva pile of cards to work on. Especially given that it can still open document formats such as WordPerfect 5 which date back to 1988. Add in all the legacy OLE automation stuff, a VBA environment and all those shims and backwards compatibility things that MS are known for (see Old New Thing blog) that translates as "One Does Not Simply Patch Word".

That's why we have automatic release after a set time. Because it's a problem for the public even if the vendor has zero resources. The ability of the vendor to fix the problem is not related at all to the potential damage the problem can cause.

Worst-case scenario? The software is shutdown and/or withdrawn from the market because the vendor can't fix it. Not that the vulnerability isn't announced.

What we need is a public and open way to do this that doesn't involved walled gardens.

Unless it comes from Google of course, because they know Google take the 90 day deadline seriously (or 7 days for active attacks such as this).

That alone speaks volumes, and pretty much validates the necessity of Google's forced disclosure policy.

> Despite being Microsoft’s newest and ‘most secure’ operating system, Windows 10 was found to have the highest proportion of vulnerabilities of any OS (395), 46% more than Windows 8 and Windows 8.1 (265 each).

https://www.avecto.com/news-and-events/news/94-of-critical-m...

And if you've used Windows 10, you'd already know that. Windows 10 has added a ton of new features/crap. The Q&A has suffered, too, and Windows 10 has been quite buggy so far, ruining some people's computers, etc.

And since we were talking about Word, here's another tidbit from the same source:

> Microsoft Office products were the subject of 79 vulnerabilities, up from 62 last year. This represents a 295% increase in Office vulnerabilities since 2014.

The amount of bugs likely increases in general, too, because more code = more complexity = more bugs and bigger attack surface, especially if we're talking about "improving" or adding on top of an old codebase, as is the case with Windows and Office, as opposed to writing something from scratch (which may benefit from safer languages sometimes, newer safer architectures, etc).

IMHO, a better solution is to create legislation that forces software to be sold and distributed under a set of public, common terms.

If the rest of the market worked the way software does, everytime you went into a restaurant, bought a book, or used a photocopier you first would sign a long contract freeing that business of any liability whatsoever.

If I go to a restaurant and the Food poisoning kills my family, I can sue them. If I buy a book at the store, the store cannot mandate that I not read the book on Sunday. If you buy the book on Amazon Kindle, they are free to stipulate pretty much anything.

If software and digital products were sold with universal, reasonable terms, companies and individuals that were damaged by grossly negligent behavior could sue and have those damages repaid to them. This incentivizes companies to behave better. It is also more general purpose. We don't have to add one new regulation for every way a company can possibly be grossly negligent.

> "We performed an investigation to identify other potentially similar methods and ensure that our fix addresses [sic] more than just the issue reported," Microsoft said through a spokesman, who answered emailed

If MS had immediately patched CVE-2017-0199, only for someone to reverse the patch, discover an identical exploit somewhere else in the code and commence immediate abuse, people would crucify Microsoft.

From the article, it seems clear that Microsoft scheduled a public release of the patch as soon as it became clear it was being publicly exploited.