To: John F. Dowd who wrote (44710 ) 5/11/2000 5:43:00 PM From: mozek Read Replies (1) | Respond to of 74651
John, While TigerPaw did use the phrase "woefully inadequate", I believe that his suggestion was one of a reasonable person trying to craft a reasonable clarification. I didn't really focus on the bounty part of his post, but even so, I don't look at it the way you do. First, I assume the such a proposal would only apply to APIs that were used by Microsoft applications, since any others that were undocumented and used only by the OS would not qualify under his proposal for public disclosure. Regardless of the fact that such a mechanism would probably be unreasonable as a matter of regulation, I wouldn't see its voluntary implementation as a threat. It's been proven time and again that difficulty of discovery is not a surrogate for true security. this principle applies to old methods of encryption based on obfuscation as compared to current public key methods. While current public key technology has not actually been proven to be secure, it is widely accepted as having a foundation for security based on mathematical principles that have not yet been proven inadequate. One of the things that can increase confidence in the security of any complex system is large numbers of people looking for holes. While the bounty TigerPaw described would not be aimed at the discovery of security holes, I do not see the potential for such discovery as threatening, rather, I believe that it would simply be a fringe benefit. Better that any holes which could be found are reported for a bounty than exploited with harmful intent. In spite of what the Sunny's propaganda would have people believe, Windows 2000 is every bit as secure as other industrial strength operating systems. The same goes for Microsoft's Java relative to Sun's Java, and IE relative to Navigator. In many cases, I believe the data would show that Microsoft's products have fewer security problems than other competitive offerings, especially if you consider the number of people trying to attack Microsoft systems due to their wide distribution. As you say, all this discussion is probably moot in the long run. I agree that it would be quite reasonable for the case to be dismissed on appeal or settled as soon as the DOJ realizes that any other judge will remain awake during the trial and consider the facts presented in an unbiased manner. That said, even if the case were dismissed, as a shareholder myself, I wouldn't be personally opposed to a policy like the one TigerPaw suggested. I think that it would benefit Microsoft to debunk, once and for all, the myth that undocumented APIs are leveraged for the company's benefit. As before, these are only my unofficial, personal opinions based on speculation, conjecture, and no legal expertise. Thanks, Mike