It's open season for bug hunting – on Microsoft's Azure cloud

Microsoft's conviction that "fuzzing in the cloud will revolutionize security testing," voiced in a research paper six years ago, has taken form with the debut of Project Springfield: an Azure-based service for identifying software flaws by automatically subjecting the code to bad input. Introduced at the Ignite conference in …

[Anonymous Coward]

So MS are admitting their software is not fit for computer consumption and they want the public to debug their latest offering.

[Simbu]

Nope

Actually it's more MSFT are suggesting your software might not be fit for computer consumption, and want to debug it for you. Whether you'd want that or not, is another question!

[SL1979]

You totally beat me to the punch.

"Here, run your virtual server on our Azure platform. Find the bugs. Tell us about it, so that we can patch our proprietary, buggy code, and refuse to release the source code, which would probably make debugging our security-nightmare-of-a-platform much easier. But we don't want to do that, because in the grand scheme of things, security is still an after-thought in all of our products, and has been ever since we abandoned Xenix, which was a real OS that actually had redeeming qualities such as file permissions, file ownership, and presumably would have been a much better code-base on which to base the rest of our products."

Yeah, let me get right on that, and install a vastly superior OS like BSD or Linux on your cloud platform that you've developed over the years on modified, spaghetti-fied code that still (more or less) has its roots in DOS, which was a single-user, neutered, watered-down imitation of UNIX (perhaps Windows actually would have been more aptly-named "Microsoft Eunuchs") that had nary a trace of built-in security, permissions, or file ownership, not to mention stability, so that when you do get around to fixing the bugs, you can release a binary patch whenever you feel like getting around to it. And because you won't release the source code for us to audit, when the next zero-day exploit comes around, you can say something like, "We had no way of knowing THAT would happen!". Uhhhh... Yeah, no thanks.