Full Disclosure Regarding Microsoft and Matasano

It’s hard to write about computer security in any sense while avoiding talking about Microsoft. So we don’t try to. We routinely write about what we think of Microsoft’s efforts. If Microsoft is successful securing some of the most popular and complex code shipping today, that’s a hugely important success story for software security. If they aren’t successful, that opens up a lot of important questions.

Why are we telling you all of this?

Because we’ve done work for Microsoft, particular on the security of Windows Vista. So there’s some potential for bias here. We don’t think it impacts our opinions about Microsoft (… much; we like the people we’ve worked with a lot). But we’ll let that be your call to make. Now you know.

Why are we telling you this now?

Because we couldn’t before. Security work is virtually always done under NDA, and we’re not pushy about asking for public references. But Microsoft was gracious enough to thank everyone who helped assess Vista, and there we are.