Frank & Michelle's Blog » All My Software Is 100% Secure

All My Software Is 100% Secure

Microsoft recently conducted a study which found that Microsoft’s Internet Explorer is more secure than Mozilla’s Firefox. security.pngThis is not surprising because I wouldn’t expect Microsoft to (a) be objective or (b) conduct the study in a meaningful way. Conducting a meaningful survey or evaluation of anything is deceptively difficult and depends greatly on choosing meaningful metrics – evaluating application security is no exception.

The metric that Microsoft chose was counting how many bugs were fixed by each company. This is awesome for three reasons. First, it assumes that all software bugs relate to security flaws. Second, it assumes bug tracking at one organization is done in the same way as bug tracking at another. Third, it assumes that both companies are equally committed to fixing bugs. Based on the fact that there are still bugs in Windows XP that existed in Windows 2000, I’m going to guess that Microsoft doesn’t bother too much with fixing bugs. They just call them “features” and move on (and the users should, too).

I didn’t read the whole report, but it appears Microsoft concluded that since Mozilla fixed more bugs than Microsoft in 2004, Microsoft’s browser must be more secure. As Mozilla’s Mike Shaver said, “Just because dentists fix more teeth in America doesn’t mean we have worse teeth than Africa.”

This is inspiring me to adopt the following software development philosophy: I will never fix another bug, thus making all my software 100% secure.

frank said,

@room34:

Yes, indeed. I would expand on it to say that if there are no better alternatives, then whether it’s worth using depends on how poor the metric is (I think survey writers would have a word or two to say on that). If there are documented better metrics, then justification becomes more difficult and starts smelling like “spinning”.

Posted at 10:50 am on December 11, 2007 · Permalink

frank said,

@kosh:

That’s precisely the point; in a classic display of their mentality around software development, they spent time and resources conducting a study based on a poor metric in order to have their product look better, rather than spend those same time and resources on actually making their product better.

It is a process that they have followed historically and show few signs of deviating from. In the end, marketing is marketing, but Microsoft’s user-base is dwindling, and unless they start taking a vested interest in how good their products are rather than how good their products appear, they will continue to loose users to other options.

While you’re right to say I prefer Mozilla and Apple products to Microsoft’s, it is that way because I have lost countless hours of my life to fighting with their software. I grew tired of it, and when better alternatives appeared, I switched.

That’s not to say that Microsoft hasn’t produced some fantastic products. The Microsoft .NET Framework is the best software development platform available, Microsoft C# .NET is the best programming language for business purposes, and the Microsoft Visual Studio is by far the best Integrated Software Development Environment (IDE) around. Although, if it supported the .NET Framework, Apple’s X Code could give it a run for it’s money.

Posted at 10:15 am on December 11, 2007 · Permalink

kosh said,

It depends if you want to call someones product better or worse than yours. It depends on how you can spin it. The justification is irrelevant, it is the outcome that matters.

Posted at 7:04 am on December 11, 2007 · Permalink

room34 said,

Depends on HOW poor it is.

Posted at 5:28 pm on December 10, 2007 · Permalink

frank said,

@kosh:

OK, so what’s the justification for using a poor metric, particularly when better ones exist? Or, to put it another way, is a poor metric better than no metric at all?

Posted at 2:53 pm on December 10, 2007 · Permalink

kosh said,

A poor metric but it is a metric.

Posted at 1:14 pm on December 10, 2007 · Permalink

frank said,

@kosh:

You definitely have a point, and to say that Apple or Firefox are flawless is a bald-faced lie (see the Firefox memory leaks and the various issues with OS X 10.5). That said, it is indisputable that IE is less compliant with the W3C Standards than Firefox (and so is Safari, although 3.x is showing improvement), and that Microsoft software in general is less secure than that issued by Apple or the various open-source communities such as the Mozilla Foundation.

This post was less a commentary on which browser is better or more secure, and more on the fact that bug counting is a very poor metric for measuring security.

Posted at 9:46 am on December 10, 2007 · Permalink

frank said,

@room34:

Ha! That is perfect.

Posted at 9:39 am on December 10, 2007 · Permalink

kosh said,

I hate to say this but you guys need to pull your heads out of your Apple/Linux/Firefox’s a$$. I agree that it is a strange metric, but marketing people will find whatever they can to make their product look better. That is just the way it is. Take it for what it is.

Posted at 6:59 am on December 10, 2007 · Permalink

room34 said,

Another factor you didn’t mention: it also assumes that both programs had the same number of bugs to start with.

It’s also funny to consider this in conjunction with my favorite-ever Dilbert strip, in which the PHB announces that the developer who finds and fixes the most bugs in the company’s software will get a bonus. Wally and Dilbert look at each other for a minute and Wally declares, “I’m going to go engineer myself a new minivan.”

In other words: finding and fixing problems in a product is good, but it’s not as good as building a product that didn’t have the problems in the first place!

Way to go, Ballmer.

Posted at 4:28 pm on December 9, 2007 · Permalink

RSS feed for comments on this post · TrackBack URI

Leave a Comment

bicümle güzel yazılar program indir free wordpress theme süper oyunlar güzel sözler türk log dizi izle sinema izle