Linux security guru joins Microsoft

Linux security guru joins Microsoft

Summary: Crispin Cowan, the Linux security expert behind StackGard, the Immunix Linux distro and AppArmor, has joined the Windows security team.In a blog post last week, Microsoft's Michael Howard, author of Writing Secure Code, wrote:For those of you who don’t know Crispin, Crispin is responsible for a number of very well respected Linux-based security technologies such as StackGuard, the Immunix Linux distro, SubDomain and AppArmor.


Crispin Cowan, the Linux security expert behind StackGard, the Immunix Linux distro and AppArmor, has joined the Windows security team.

In a blog post last week, Microsoft's Michael Howard, author of Writing Secure Code, wrote:

For those of you who don’t know Crispin, Crispin is responsible for a number of very well respected Linux-based security technologies such as StackGuard, the Immunix Linux distro, SubDomain and AppArmor. I’ve known Crispin for many years, and have nothing but the utmost respect for the guy. He’s well published, wicked smart, a non-zealot and brutally pragmatic. In my opinion, AppArmor is shining example of his pragmatism, it’s simple and it works. What excites me the most is he’ll bring a different perspective to the Windows team, and I’m a big believer in stirring the pot!

Cowan, CTO and co-founder of Immunix, will certainly be able to stir the pot--his home page still sports the Linux penguin in the URL.

Howard adds that Crispin will join the team that worked on User Account Control. Given the criticism that UAC (most popular UAC posts on ZDNet) has received hopefully Crispin can inject a little more pragmatism into the effort.

On his home page, Cowan outlines his stellar resume. He describes his research interest as the following:

My research interests are in pragmatic systems research:  giving systems new capabilities and performance, and doing it well enough that you can read mail on it.  My personal workstation runs my research systems.

For the last four years, my primary interest has been survivability :  how to make existing systems better able to survive security attacks.  With the invaluable help of my team, we have produced the Immunix OS version of Linux, featuring the StackGuard C compiler which emits programs resistant to buffer overflow attacks.

Prior to that, I did work in system specialization for performance, distributed programming languages, and computer architecture. I am interested in enhancing performance in all of these areas by using concurrency and parallelism.

Simply put, Microsoft notched a big security win by landing Cowan. Let's see where things go from here.

Topics: CXO, Linux, Microsoft, Open Source, Operating Systems, Security, Software

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Paycheck

    Well, I am sure his paycheck will increase in size that is what it is all about correct...
    • Probably end up like other OSS programmers who've joined MS

      ... 6 months later we'll be reading his resignation.

      Right now, seems to be a revolving door.
      • That's because

        They don't have the required chair throwing strength.
        • That, and...

          their conscience gets the best of them. It's hard for some to work for good and then move to evil.
          • Who say s Linux is "good"

            Working for free is a good thing? Once you finish the program to the point where you can make some real money in support, some offshore firm in India gets paid to support it instead.

            Wow, that [i]is[/i[ a good thing.
          • Bologna isn't just a city

            It's a myth that all Linux development is done for free. This guy looks like he was employed by Novell, from googling the products referenced (AppArmor) that he created.
          • I know....

            but Windows Snyder seems to have been able to do it. <br>
    • RE: Linux security guru joins Microsoft

      Awesome post! <a href="">rolex watches</a>
  • RE: Linux security guru joins Microsoft

    Isn't this a good thing, in a way? I mean, it just gives more notoriety to the Linux crowd. Microsoft can't keep saying that there's just a bunch of morons and jerks working in the Linux/Open Source world if they're going to keep hiring them.
    • Two sides

      If Linux were in competition with MS Windows (and it is in some respects), this would be an issue with business secrets being shared. For the Linux side, it really isn't about competing directly with Windows but about creating an excellent operating system with the FOSS community (although many in the community would be ecstatic if MS just went away). On the Windows side, however, this Linux thing is cutting into their profitability and monopoly. Any competitive edge MS can get to snuff out anyone else must be had at all costs. There is a difference in how each side views the other.

      Don't you think MS has GPL software tucked away in their code somewhere? They openly and legally have BSD code, but they also have GPL code. I say this to point out MS is mugging the FOSS community, gaining the benefit of GPL code and developers while trying their best to beat the heck out of the community.
      • Cutting into profitability?

        How do you figure? He's clearly working on the client side, and linux has virtually no impact on the desktop. OS X has maybe 1/18th of the desktop that Windows has, but it on 10-20x as many desktops as Linux.

        Maybe it'll matter someday, but that day is not today.
  • RE: Linux security guru joins Microsoft

    First order of business.

    Move to a Unix based foundation. That would fix a number of things (not all) right off the bat.
  • Microsoft needs to hire...

    someone who understands security with Win 7 in the offing. After all, their feeble attempt at security features in Vista became one of the most disliked and turned off feature.
    • wow.

      <i>After all, their feeble attempt at security features in Vista became one of the most disliked and turned off feature.
      Thanks for that flash of brilliant insight. It made absolutely no sense, but thanks anyway.<br>
      Perhaps you meant to say their attempt at security features produced one of the most turned off features? <br>
      If that is the case, where is your evidence? Or do you just make random statements w/o anything to back it up? <br>
      Of all the copies of Vista in use, how many of those have had this feature, i assume you mean UAL, turned off?
    • You mean the feature like sudo in Ubuntu?

      So why is this feature disliked in Windows but praised in Ubuntu? Why is it a feeble attempt in Windows but a formidable barrier in a Linux distro? You must be in sales because they will say anything. I think they are a little aggravating in both OSes because social engineering entices people to enter the password rendering both systems moot. Just delays the inevitable that the dummies will infect any system no matter how secure it was built. It is still better to educate folks on proper behavior when on the WAN.
      • One word..


        My biggest gripe with UAC is how often it showed up. I can't remember exact details, just feelings, from when I tested it, but it seemed that UAC showed up for things it should not have. I think Microsoft swung the security pendulum too far.

        I hope this guy will be able to bring some balance to Microsoft's security.
        Patrick Jones
        • It is the same

          the implementation, that is. Make a system change, get prompted.

          The biggest problem for UAC is years of 3rd party programmers assuming admin rights on a machine.
          MS has tried to change this (XP certification requires running with least privileges), but few have bothered.

          Hopefully this will change in the future.
        • Popped up plenty in both systems.

          Maybe the reason it popped up more in Windows is because more malware is targeting the system. But to install my Seamonkey, it popped up the same. Also older software requiring administrative rights will trigger this provided you shimmed it first.
      • No, UAC is not like sudo

        UAC is not like sudo. sudo is a means of asking the user, only when necessary, for rootlike credentials solely for the purpose of doing things only root should be able to do, such as changing the computer's low-level configuration or editing files owned by root or another user. Sudo does not routinely ask you to second the mere act of running an executable you by definition have permisison to run, for instance, whereas--very commonly--UAC does.

        To the end user, UAC comes across as an over-intrusive means of moving the primary responsibility for OS security from its developers onto the user, computer expert and soccer mom alike, in real time. The UAC situation is so bad that not only are you repetitively prompted to supply permission to rerun an EXE that you may have run many times in the past, but also in some cases you are superficially disallowed from editing even files that you unequivocally own per Windows access control lists (ACLs) such as INI files for an app you and only you installed. Then you discover that in the presence of UAC Notepad is now accessible via Run and Run as Administrator shortcuts: Silly you! To edit that file you unequivocally own with a Notepad session unequivocally run by you, you must now run Notepad as an administrator. That's just plain wacky. Those those who think otherwise, who keep reciting to themselves the mantra that UAC creates an image of high security rather than popping what was left of it, should reread "The Emperor's New Clothes."

        Another way of expressing what you have expressed is to say that sudo is UAC done right. But understand that UAC has a tougher row to hoe in this sense: Underlyingly, Windows NT began life as a single-user server that has been increasingly gussied up to appear to give the appearance of being a multiuser system, and Linux has been a true multiuser system from the gitgo. Part of UAC's job is therefore the preservation of the fantasy that Windows is multiuser and the mitigation of the security Swiss cheese that results from overintegration of the OS with its apps and with all the hacking done to create the multiuser fantasy. Even Microsoft licensing is set up to treat single-user use of an OS as the norm and multiuser access as something you pay (and pay again and again and again) for.
        • Yes it is.

          The reason UAC popped up is because the programmers want root access and run there. Therefore UAC will be triggered. So would sudo if programs for Linux insisted on running as root.

          Good idea that Notepad needs admin rights to access root files. This is like editing rc.conf by entering gksudo nautilus then getting prompted for the password. However you do not need admin rights to use Notepad to access USER FILES. Ini files are not user files.

          Actually UAC and sudo is the same. You have to invoke it to access root or administrative files. You want the convenience of the old Windows with the security of a BSD. Not going to happen. The more dead bolts you add for security, the more you inconvenience the user. Like I said, social engineering will just convince people to unbolt everything and let the baddies in anyway.