Microsoft vs. Computer Security
Why the software giant still can't get it right. — Four years ago, Bill Gates dispatched a companywide e-mail promising that security and privacy would be Microsoft's top priorities. Gates urged that new design approaches must "dramatically reduce" …
Context & Ripple Effects
This piece lands almost exactly four years after Bill Gates's companywide e-mail committing Microsoft to make security and privacy its top design priority — a memo that set a public, measurable standard for everything the company has shipped since. The timing is pointed: it runs the day after Microsoft rushed out a patch for a critical flaw in how Windows renders certain graphics files, with researchers already reporting two additional WMF vulnerabilities they consider less serious than the one just fixed.
That sequence — flagship pledge followed by emergency patching — is the article's core tension, and it arrives during a bruising stretch for the company: federal examiners have just upheld two Microsoft patents covering the Windows file-storage system, ending a two-year dispute, while Apple's move to Intel chips puts rival hardware on nominally similar footing.
First-order effects
- Windows users and IT departments face another reactive patch cycle, with two newly reported WMF flaws keeping pressure on Microsoft's fix pipeline immediately after last week's critical graphics-rendering patch.
- Gates's four-year-old memo functions as a standing public benchmark: every subsequent flaw is scored against the company's own declared priority, raising the reputational cost of each miss for Microsoft specifically.
Second-order effects
- Apple's new Intel-based MacBook and iMac ship with EFI firmware that blocks Windows XP outright, sharpening the platform-security comparison at the hardware level just as Microsoft's patch cadence draws criticism.
- Repeated out-of-band fixes push corporate buyers toward layered third-party defenses and slower, test-heavy deployment practices, shifting security spending away from the platform vendor's built-in tools.
Third-order effects
- If the pattern holds, platform security becomes a continuous accountability exercise rather than a one-time design pledge — vendors are judged on their fix record against leadership commitments, and pressure grows to tie security outcomes to internal incentives and governance.
- Sustained client-side exploitation of ubiquitous file formats points toward an industry structure where the default operating environment, not just the vendor, becomes the regulated and defended surface.
The trend: Platform security is shifting from a single executive pledge toward ongoing, externally judged accountability, with each unpatched flaw measured against the vendor's own stated priorities.