Linked by Thom Holwerda on Sat 7th Nov 2009 00:24 UTC
Thread beginning with comment 393327
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
They may be well removed from the rest of the company, but they can only bring forward, pardon my expression, crap. To many security holes. They need to get rid of registry, they need to make it an OS without holes (security vulnerabilities). They also need to make it more modular so that if a virus gets into a third party software it will stay in that software. When you have people actually endorsing wiping the hard drive and reinstalling every 3 months to maintain functionality, there is something wrong.
You don't seem to be very familiar with what MS Research does. They actually do a ton of research across a wide spectrum of technologies (voice/handwriting/gesture recognition, database technology and data mining, data federation, cloud computing, alternate operating system designs, security improvements, etc, etc). Some of it is total blue-sky stuff that never seems to make it past academic papers, but a lot of it does get into product development. The problem of malware has less to do with what Microsoft COULD DO and more to do with fundamental application compatibility constraints that limit what it CAN DO without breaking every application on the planet. Researchers know how to eliminate malware: Remove interop points or sandbox applications in a VM. Virtualize every resource. Don't allow malware to affect the system.
But that's easier said than done. There are a lot of legacy applications which many thousands of people depend upon which leverage interoperability points in the system. If MS changes the behavior, it not only causes the application to break, but it creates an outcry from customers and potentially introduces legal troubles, as third party software developers scream about big, bad Microsoft trying to kill them; even if it's inadvertent or well-intentioned, it's a problem. For example, installing global mouse or keyboard hooks, injecting DLLs into other processes, etc. Most malware gets installed through social engineering. Click on this cute game sent to you in email. Aw, what damage could that possibly do? Click Yes. UAC. Click Yes. Boom!
How do you prevent users from shooting themselves in the foot when you allow those same users to install applications? It's a thorny problem. And no platform completely eliminates this problem unless you prevent users from elevating privileges and installing software.
Microsoft Research has funded research into alternative operating system technology -- such as Singularity -- that is built almost entirely in managed code and which has an excellent security model. Microsoft has shared a lot of information about Singularity (http://research.microsoft.com/en-us/projects/singularity/), and you might find it interesting.
Edited 2009-11-07 03:00 UTC







Member since:
2005-09-21
The great thing about microsoft research is that they are well removed from the rest of the company. Researchers seem to have more or less free reign to do their thing, so a lot of what comes out of there is wildly impractical, pure research, blue sky stuff that certainly won't end up making microsoft any money anytime soon. That's great to see from a company research division.