Simply following RFCs (and nix those proprietory extensions, i.e. Kerebos) in the software code would help for one. Microsoft could always try to pull expertise from the Linux community... ;-)

Perhaps "modulizing" more of the software code. Microsoft's security problems often relate to software that function DEPENDently. The plague of script viruses are a threat because of overly integrating components. Outlook is [IMO] the best product Microsoft develops, however it is also [IMO] the most dangerous because Outlook offers TOO much web browser functionality. Rendering a web page is a great feature of an email client; do it without the JAVA, VB, and/or ActiveX processing.

Another simple idea, follow the OpenBSD model of software release. That is default everything OFF. As an individual finds the need for X (i.e. IIS), let them enable the services. It is absolutely moronic Microsoft released W2K with SMTP as a default installed service that automatically starts. Secure or _not_, it is silly if not "resource intensive" to have SMTP on all the servers in an organization. OK that is my 2 cents.

As an aside Tim, this was a wonderfully objective critique of Microsoft future direction, perhaps your best articles yet. Stay objective!

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/54/10019#10019