Foundation exec slams Microsoft for 'meaningless' security pledge

The Free Software Foundation on Thursday attacked Microsoft for "meaningless" public statements on  privacy and security, claiming that Windows is "fundamentally insecure."

Earlier in the week, Microsoft publicly pledged to encrypt customer information being sent between its data centers by the end of 2014, and committed itself to keeping users fully informed about governmental attempts to access their data. Microsoft general counsel Brad Smith  also said the company would make its source code more transparent, "making it easier for customers to reassure themselves that our products do not contain back doors."

[MORE PRIVACY:Study finds most mobile apps put your security and privacy at risk]

But FSF executive director John Sullivan attacked those promises, saying they were not sufficient guarantees of any reasonable degree of privacy.

"In the end, these promises are meaningless. Proprietary software like Windows is fundamentally insecure not because of Microsoft's privacy policies but because its code is hidden from the very users whose interests it is supposed to secure," Sullivan said in a public response. "A lock on your own house to which you do not have the master key is not a security system, it is a jail."

Sullivan also said that Microsoft's promises of transparency are "no solution," either, asserting that the company's definition of transparency has been historically very limited and proscribed.

"Freedom and security necessitate not just being allowed a peek at the code," he says. "Noticing that the back door is wide open will do you no good if you are forbidden from shutting it."

Microsoft's statement was widely seen as a response to the NSA scandal that gained new life after former contractor Edward Snowden leaked extensive and damning information that implicates the U.S. government in a huge range of secret data collection, both domestically and internationally.

Sullivan, however, states that the way to protect one's self from governmental snooping is to avoid proprietary software entirely.

"Even on proprietary operating systems like Windows, it is advisable to use free software encryption program such as GNU Privacy Guard. But when no one except Microsoft can see the operating system code underneath, or fix it when problems are discovered, it is impossible to have a true chain of trust," he says.

Email Jon Gold at and follow him on Twitter at @NWWJonGold.

Read more about software in Network World's Software section.

Join the CSO newsletter!

Error: Please check your email address.

Tags MicrosoftsecurityWindowsFree Software Foundationsoftwareoperating systems

More about Free Software FoundationMicrosoftNSA

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jon Gold

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts