Bag the gag rule

Yesterday marked day 30 since the Nimda.e worm showed up on the internet. Microsoft and a few of its security cronies would have us believe that 30 days is about the right amount of time for everyone to shut up about any particular security vulnerability.

          Yesterday marked day 30 since the Nimda.e worm showed up on the internet. Microsoft and a few of its security cronies would have us believe that 30 days is about the right amount of time for everyone to shut up about any particular security vulnerability.

          The idea, floated by the group after Microsoft's Trusted Computing Forum this month, is that the IT industry should agree on a "grace period," during which the affected software vendor can fix the problem and issue patches without worrying about information on the vulnerability leaking out. After all, what could happen in 30 days?

          Well, at the US District Court for the Southern District of Florida, 30 days is long enough to turn the clock back 30 years.

          Two days after it was discovered in the wild, Nimda.E hit the court's offices in Miami. By the following Monday - day eight - PCs were crashing left and right.

          On day 10, the court reverted to doing everything the old-fashioned, noncomputerised way. It might have been 1971 instead of 2001. Forms were filled out by hand, and clerks used phones instead of networks to get information on defendants and cases in other cities.

          By day 15 - halfway through the 30-day "grace period" - the court's website still was not back up, and IT staffers were still cleaning Nimda.E off PCs one at a time.

          Oh yeah, keeping a lid on a security problem for 30 days that'll sure protect us.

          But it's not intended to protect us, is it?

          Microsoft has a problem, and nobody in Redmond doubts it. Hardly a week goes by without some Microsoft product web browser, web server, office application, email client, operating system hitting the news because it has a security vulnerability.

          But the 30-day gag rule that Microsoft and its tame security partners are proposing won't reduce the risk for the users of those products. It will just reduce the risk to Microsoft's reputation from the weekly public relations problems.

          That 30 days isn't just for coming up with a patch. It's an entire month to spin the bad news.

          No wonder Microsoft wants the whole industry to take the 30-day pledge. The company with the security problem gets to tell its version of the story publicly when it issues its patch. Competitors promise to keep their mouths shut for a month after it's discovered.

          Meanwhile, nobody is suggesting that crackers will observe any 30-day moratorium after they discover a security hole. Of course they won't no matter how nicely Microsoft asks them. They'll write their worms, their viruses, their tools and their sample code to exploit whatever vulnerabilities they find.

          And in a matter of hours, word of the exploit will reach every creep who wants to break into, corrupt or shut down our systems.

          We, of course, won't hear about it from official industry sources for another 29 days after that.

          But somehow, we can be pretty sure the crackers will make us aware of it.

          And when they do, instead of having the best, most accurate and most complete information on our security exposure, we'll get some kind of vague, limited bafflegab from security experts. It won't keep the bad guys from knowing anything they'll already have the information.

          All it will do is keep us from making informed decisions for ourselves about exactly how severe the risk is, what our security options are and which actions are most appropriate for each situation.

          As I write this, they're still cleaning up the mess and reliving the '70s down at the federal court offices in Miami. One user told a reporter, "It's kind of nice not having computers."

          Maybe it is for him. The rest of us would rather have what we need to keep our systems running and not have to wait 30 days for it.

          Hayes, Computerworld US' senior news columnist, has covered IT for more than 20 years. Send email to Frank Hayes.

Join the newsletter!

Error: Please check your email address.

Tags Trusted Computing Forum

More about HayesMicrosoft

Show Comments
[]