I joined the Windows Update team at Microsoft around two months ago. While I can't give exact figures, a standard non-SSIRP update costs Microsoft around 6 figures to code, test, and ship. October was our biggest release in history with something like 44 updates released (you can do the math).
Security incidents that are SSIRPs (effectively vulnerabilities that start actively being exploited, in particular with potential global impact) cost a lot more. Conficker.b was costing Microsoft over a million dollars a day for weeks in support calls alone.
Security flaws cost Microsoft a ton of money directly and through things like damaging their brand. They invested insane amounts of money improving security for Win 7, we'll see how it works out (as best as I can tell, it should be pretty effective).
Sure, I appreciate it costs a lot to put things right.
"damaging their brand."
How can you damage Microsofts brand any more than it already is? I don't think most people buying Microsoft buy it because of the brand. Which is why I don't think OS vulnerabilities particularly cost them in lost revenue.
The people that buy into other platforms for "security" are misinformed, and I say this as an inveterate Mac user who ships software on Debian VMs.
A good acid test for whether someone is talking out their ass about security: they make smart-ass comments about Microsoft. It's getting harder and harder to find reputable security researchers who haven't done work for Microsoft.
Security is a more complex terrain than that Microsoft vs. Free Software space people keep insisting to drag the discussion into. Dragging it into this place is a straw man.
A straw man compounded to your ad hominem is not up to the usual standards here.
It is possible for you to hire people to secure an open platform from the ground up. It is up to Microsoft to secure Windows from top to wherever they think the cost exceeds the benefit for them. That's a key difference - it doesn't matter how much effort you spend securing Windows, if you are not Microsoft, you can never be sure of the results until you find them out the hard way.
Yes. I do like Free Software and I use it extensively. I also use Sun, Oracle, IBM, SAP, PeopleSoft and, from time to time, even recommend MS SQL Server when it makes sense. It would, however, be insane to simply disregard Microsoft's software appalling security record or to oversimplify it as a Free vs Evil dichotomy. It's not.
It's just that Microsoft seems to spend more money promoting their wares than properly checking and securing them. Security seems to be grafted on instead of built into.
And, for the other argument, of security issues arising only from adversarial conditions and not bugs, that's simply incorrect. Software that's correct should not have holes like unchecked buffers that allow code injections. And it's not only Microsoft who's guilty here - just about every product I use seems to have fallen for this one in a given point in its history. Still, the fact others face it does not make Microsoft's products more secure. Like I said, it's a more complex issue than this false dichotomy.
As for more sophisticated attacks that rely on memory access patterns, memory protection mishandling, improper erasure and so on, well... If the processor is not, itself, correct, you can't really expect the software to cover all the holes - only the possible ones.
I read this comment 3 times, up and down, and I can't find an assertion about security in it that is (a) based in any kind of fact or (b) falsifiable in any way with any facts I can bring to the discussion.
Suffice it to say that I'm not a Microsoft "astro-turfer", and you're just flat out wrong --- and not only wrong, but actually making things up out of whole cloth. "More money promoting their wares than properly securing them". I'm surprised you feel comfortable making claims like that. In any case, I'm sure you'll never be convinced either way, so, enjoy the last word.
I can't remember accusing anyone specifically of being an astro-turfer. I only noticed a tendency of any comment critical of Microsoft having a more than average likelihood of being downvoted, something I already noticed years ago, when Digg was intersting. This topic seems to bring out a certain amount of passion in the audience, myself included.
There are two statements you can try to falsify: "It is possible for you to hire people to secure an open platform from the ground up" and "It is up to Microsoft to secure Windows from top to wherever they think the cost exceeds the benefit for them". As for the third, "Microsoft seems to spend more money promoting their wares than properly checking and securing them", it's an impression and, as such, subjective. The "seems" is there because they do spend a whole lot of money in promoting their software and the "properly" is there because it doesn't matter how much they spend, the results are still pitiful, as the mountain of spam in my inbox and the constant onslaught of botnets on my clients (no - my trade is software, but my code has passed more security audits than I can remember) demonstrate so eloquently. Their programs seem to be improving with every release, true, but there is still a long way until I would entrust my data to them.
>The people that buy into other platforms for "security" are misinformed
While I don't doubt what you say, isn't there something to be said about the fact that more attacks are targeted at Microsoft's platform than, say, OS X?
While Vista may be more secure, isn't there still a higher chance of getting nailed by a security flaw in Vista than OS X purely because more people are attacking the former?
"Conficker.b was costing Microsoft over a million dollars a day for weeks in support calls alone"
It was not Conficker that cost Microsoft a million a day - it was the support to their customers that bought software that had uncorrected bugs that should have been detected earlier and that made Conficker possible. Shipping bugs costs a lot of money. Unless they cost more than getting rid of them, they are never corrected.
And if it did cost Microsoft a million a day, it cost a lot more to their customers.
What? You make a buggy software product someone finds a way to exploit automatically and when your customers come calling asking for help to repair their systems, suddenly, you are not to be blamed? Not even a little? How so?
Let's move the example from software to aerospace.
Someone builds planes that, when an engine inhales a bird, explode, killing all passengers and crew. They do not know the problem exists and did as little testing as required by regulations. Knowing the problem, a kid decides to release pigeons in the path of the plane, creating a quite spectacular accident. Who will you blame? Just the kid, just the manufacturer or both?
Until executive bonuses get cut, you will see no improvement over there. Unfortunately, lots of bonuses get calculated on limited scopes and don't reflect the complete lifetime of a product. This way, it's easy to close sales, pocket huge bonuses right now, get promoted, and to let the support cost bomb explode in the hands of your successor while you capitalize on your success and head up the corporate ladder.
If you look them closely, big corporations are rarely more intelligent than a sponge or a coral reef.
I joined the Windows Update team at Microsoft around two months ago. While I can't give exact figures, a standard non-SSIRP update costs Microsoft around 6 figures to code, test, and ship. October was our biggest release in history with something like 44 updates released (you can do the math).
Security incidents that are SSIRPs (effectively vulnerabilities that start actively being exploited, in particular with potential global impact) cost a lot more. Conficker.b was costing Microsoft over a million dollars a day for weeks in support calls alone.
Security flaws cost Microsoft a ton of money directly and through things like damaging their brand. They invested insane amounts of money improving security for Win 7, we'll see how it works out (as best as I can tell, it should be pretty effective).
disclaimer: this is my opinion, not my employer's