<story><title>SolarWinds hackers were able to access Microsoft source code</title><url>https://msrc-blog.microsoft.com/2020/12/31/microsoft-internal-solorigate-investigation-update/</url></story><parent_chain><item><author>vthallam</author><text>&amp;gt; This means we do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk&lt;p&gt;I don&amp;#x27;t know how much of this is true. Wouldn&amp;#x27;t it be helpful for bad actors to understand how Windows defenses work looking at the code thereby increasing the risk?</text></item></parent_chain><comment><author>dwheeler</author><text>It is generally accepted in the security community that hiding source code does &lt;i&gt;not&lt;/i&gt; provide security.&lt;p&gt;The principles for developing secure software were identified in the 1970s by Saltzer and Schroeder, and they&amp;#x27;re still true today. One of those principles is &amp;quot;open design&amp;quot;, that is, don&amp;#x27;t depend on design secrecy for security of the system. Instead, depend on secrecy of things that are trivially changed (like private keys and passwords). Then, when the secret is exposed (or you think it might be), you quickly change all the secrets and there&amp;#x27;s no problem. One source of this paper: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.cs.virginia.edu&amp;#x2F;~evans&amp;#x2F;cs551&amp;#x2F;saltzer&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.cs.virginia.edu&amp;#x2F;~evans&amp;#x2F;cs551&amp;#x2F;saltzer&amp;#x2F;&lt;/a&gt;&lt;p&gt;In the case of Windows, the source code is not really secret anyway. Most governments have continuous access to the source code, typically through the Microsoft Government Support Program (GSP) &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;securityengineering&amp;#x2F;gsp&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;securityengineering&amp;#x2F;gsp&lt;/a&gt;
Many businesses and universities also have access to Windows source code. You can see various programs to provide such access in different cases via &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;sharedsource&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;sharedsource&amp;#x2F;&lt;/a&gt; In addition, Microsoft employs a huge number of employees who have access to its source code, and you can&amp;#x27;t really keep a secret long when a large number of people know the secret. Efforts like bribes, appeals to patriotism, etc. will eventually successfully get someone to reveal a secret if there&amp;#x27;s a large enough group, especially since it&amp;#x27;s relatively easy to identify who works for Microsoft or otherwise might have such access.&lt;p&gt;If that&amp;#x27;s not enough, Microsoft distributes executables, and disassembers &amp;amp; decompilers can provide enough information for static analysis anyway. So you could re-derive what you need to attack Windows if you needed the source code for some reason.&lt;p&gt;Anyone who depends on secrecy of code to provide security is  in trouble. Typically the real reason to keep (some) code secret is to support certain proprietary business models and to meet certain legal obligations, and are not really about security.&lt;p&gt;Note that Microsoft understands this; they&amp;#x27;re quite clear in stating that the security of Windows does not depend on keeping its source code a secret.</text></comment>
<story><title>SolarWinds hackers were able to access Microsoft source code</title><url>https://msrc-blog.microsoft.com/2020/12/31/microsoft-internal-solorigate-investigation-update/</url></story><parent_chain><item><author>vthallam</author><text>&amp;gt; This means we do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk&lt;p&gt;I don&amp;#x27;t know how much of this is true. Wouldn&amp;#x27;t it be helpful for bad actors to understand how Windows defenses work looking at the code thereby increasing the risk?</text></item></parent_chain><comment><author>thisiszilff</author><text>I&amp;#x27;d imagine the answer is yes, viewing the source code would increase the risk relative to an attacker that did not have access to the source code, but the statement is saying that whatever risk assessment Microsoft does already assumes attackers have knowledge of source code. EG, they are conservative and do not rely on source code secrecy when making any security evaluations.</text></comment>