Slashdot Mirror

Ian Lamont writes "Remember the report last year that the FBI was concerned about a 'vishing' exploit relating to the Asterisk IP PBX software? Digium played down the report, noting that it was based on a bug that had already been patched, but now the company's open-source community director says that attacks on Asterisk installations are 'endemic.' There have been dozens of reported vishing attacks in recent weeks, says the article: 'The victims typically bank with smaller regional institutions, which typically have fewer resources to detect scams. Scammers hack into phone systems and then call victims, playing prerecorded messages that say there has been a billing error or warn them that the bank account has been suspended because of suspicious activity. If the worried customer enters his account number and ATM password, the bad guys use that information to make fake debit cards and empty their victim's bank accounts.'"

coondoggie writes in to let us know about a fraud alert issued by the FBI's Internet Crime Complaint Center, warning that an unspecified bug in unspecified versions of Asterisk IP PBX software could allow criminals to generate "thousands of vishing telephone calls to consumers within one hour." PC World checked with Digium, developer of Asterisk, and found some puzzlement as to what bug the FBI had in mind. "In March, researchers at Mu Security reported a bug that could allow an attacker to take control of an Asterisk system. Digium wasn't certain what vulnerability the FBI was referencing in its advisory. However John Todd, the company's Asterisk open-source community director, believes that it was probably this March bug. That vulnerability 'basically allowed you to take over the account of one individual,' he said. ... However, the attack described by the FBI would be extremely hard to pull off, Todd said." Update: 12/09 02:54 GMT by KD : Digium has put out a statement on the IC3 warning (further details), confirming that what the FBI had in mind was an old bug and difficult in the extreme to exploit.

coondoggie writes in to let us know about a fraud alert issued by the FBI's Internet Crime Complaint Center, warning that an unspecified bug in unspecified versions of Asterisk IP PBX software could allow criminals to generate "thousands of vishing telephone calls to consumers within one hour." PC World checked with Digium, developer of Asterisk, and found some puzzlement as to what bug the FBI had in mind. "In March, researchers at Mu Security reported a bug that could allow an attacker to take control of an Asterisk system. Digium wasn't certain what vulnerability the FBI was referencing in its advisory. However John Todd, the company's Asterisk open-source community director, believes that it was probably this March bug. That vulnerability 'basically allowed you to take over the account of one individual,' he said. ... However, the attack described by the FBI would be extremely hard to pull off, Todd said." Update: 12/09 02:54 GMT by KD : Digium has put out a statement on the IC3 warning (further details), confirming that what the FBI had in mind was an old bug and difficult in the extreme to exploit.

ubercombatwombat is looking for a bit of advice: "On the 9th of November, I have a meeting to discuss an Asterisk based phone system for a new elementary school. I am the network admin for the district. Currently, we are migrating from a T-1 based Nortel (option 61, 2 x option 11 and 7 x Norstar 8x32's, for those who care) to 1GB data fiber and a 2nd pair per site — to allow simple copper-to-fiber for the split T-1/Norstar's. We also just got a 10MB (scalable to 100MB) connect to the Internet. I can keep the VoIP basically on a separate network if need be as well. What do I install? Are there Asterisk vendors that are available and have enough experience?" "The hardware support we can handle just fine, it's the software that's the big issue. One thing to keep in mind is that E911 is priority one for any brand or type. No exceptions. Other than that one thing, the field is fairly open.

I see two possibilities:

- A Cisco system or Shortel system — education budgets vary wildly from year to year and recurring cost have to be kept down.

- Hybrid of Cisco, Snom, or Polycom handsets with a custom Asterisk box with good third-party support. I see a few options such as Fonality or Digium. If anyone is aware of online options with good service, please suggest them.

Trixbox may or may not be what I use. I have had systems going 24/7 for over a year and am very happy, but the product's future is unclear just now.

So, what and who? I won't go there without third-party support. What suggestions can Slashdot offer me?"

Microsoft Windows still dominates the desktop. But in many other areas, including Web servers and supercomputing, Microsoft is just one player among many, and often a weak player at that. On the gaming side, despite the latest xBox getting all kinds of media buzz as "the" console to buy, Sony's Playstation outsells the xBox at least two to one, and many analysts expect Sony to widen that gap even more when Playstation 3 comes out in the Spring of 2006. On the Internet, MSN and MSN Search are so far behind AOL and Google that it isn't funny. And even on the desktop, Linux keeps getting stronger, while Mac OS X is commonly accepted as more reliable, secure, and user-oriented than Windows. So why do we keep saying Microsoft is a monopoly? Microsoft (Slowly) Moves Away from Monopolistic Behavior

If a major IT user tells a Microsoft salesperson that he or she is thinking about switching to Linux, Microsoft will usually come back with a cut-price offer, something the company never used to do. Microsoft also now sells something called Windows Starter Edition in some parts of the world -- supposedly for as low as $37 or $38 (US) in Thailand, including a basic version of Microsoft Office. In other words, Microsoft is starting to compete on price, which is not monopoly-style behavior.

This does not mean Microsoft has suddenly adopted a "let's all love one another" attitude.I believe Microsoft is getting more concerned about interoperability not out of goodness, but because of market pressure. But in the long run, as long as Microsoft stops treating every other operating system and file format as some sort of devilspawn, life is a little easier for those of us who would rather not use their products, and that's what really matters.

Microsoft Explorer No Longer Rules the Online World

A majority of desktop computer users may still run Microsoft's Internet Explorer browser, but it no longer has 95% market share. In a 2002 book, and again last year in an online article, I warned Web designers not to make IE-only sites, just as in the (distant) past I'd warned them not to make Netscape-only sites. Some listened. Some didn't.

Firefox adoption may have slowed in 2005, but it certainly hasn't stopped. Opera has become enough of a force that we hear rumors about first Google, then Microsoft, buying it. In any case, whether MSIE is currently running on 90% of all desktops or on only 70% (as a few surveys indicate), it is becoming less popular every month. Now Microsoft has decided that Explorer is no longer fit for Mac users, so its market share will drop even more. Sure, there's a new version of Explorer coming out, but it isn't going to help the millions of "legacy" Windows users who don't want to buy XP. If they want modern browser functionality, they must switch to Firefox, Opera or another non-Microsoft browser.

'The Network is the Computer'

I don't think this is quite true today, if by "the network" we're talking about applications delivered over the Internet instead of over well-maintained LANs. Back in October I explained why I don't think Internet-delivered applications are quite "there" yet. More recently, Salesforce.com had an outage that angered many of its (claimed) 350,000 subscribers. Worse, ZDNet blogger Phil Wainewright pointed out that Salesforce.com compounded the problem, and possibly made users leery of all Internet-delivered applications' claims of "99.9% reliability," by poor communication with its users.

Most of the Web 2.0 (and even Web 3.0) stuff that's getting so much hype these days is not OS-dependent. You can run things like Google Maps on Linux, Mac OS, Unix, and even Windows, using any standards-compliant browser you choose.

Even Microsoft is trying to get into the Web 2.0 game. I got a press release from their PR people that included this sentence:"And if you enjoy taking a drive to check out your neighborhood’s Christmas lights visit this great Windows Live Local developer application at http://msnsearch101.com/searchmap."

I found this online utility's behavior strange and primitive, not nearly up to the standards of Google Maps and some of the mashups based on it. "Ah," I thought, "that's probably because I'm trying to use it with Linux and Mozilla." So I turned to my one Windows (XP) computer and checked the site with both Firefox and Explorer. For some reason the map background didn't load at all in Firefox, on Windows, and its behavior in Explorer, on Windows, was just as clunky as it was in Mozilla, on Linux.

If this is supposed to be a sample of what Windows Live Local can do, I don't think Microsoft is headed for any kind of monopoly -- or even much market share -- in the online map business. Not only that, it makes me wonder how good their promised Microsoft® Office Live is going to be. If even a quarter of the rumors we've heard about Google and Sun joining up to produce a Webified version of OpenOffice.org are true, I suspect Microsoft is going to be a distant also-ran in the (inevitable) Internet-delivered office software business, too.

Hundreds of Thousands of Competitors

It's fun to play the "Google is cooler than Microsoft" game and talk about how Google, not Microsoft, has become the hot place for top-end programmers to work if they want to make their mark on the world, but even Google can only hire a tiny fraction of the world's software development talent. There are over 100,000 Open Source projects on SourceForge.net (which is owned by the same company that owns Slashdot), and SourceForge.net is but one of many Open Source and Free Software hosting services out there. There are literally millions of programmers working on Free and Open Source Software, plus countless others working on personal proprietary projects.

We've all heard -- probably too many times -- the old saw, "If you have enough monkeys banging randomly on typewriters, they will eventually type the works of William Shakespeare." This may or may not be true. But it is certain that if you put millions of programmers in front of millions of computers and let them do whatever they want, some of them will turn out brilliant, world-changing work. Even if 999 out of 1000 of our putative programmers work on established projects or never finish what they start, that still gives us thousands of potential world-changing software projects, most of which won't be developed by Google (or Microsoft) employees.

I've been to India, and the smartest programmers I met there weren't working for outsourcing mills but worked for themselves. I'm sure there are plenty of self-employed programmers in China, Brazil, Kenya, and almost everywhere else on this planet, too, and there are certainly plenty of them here in the United States. And, all over the world, millions of programmers have day jobs doing routine work for corporate employers to put food on the table, and do their "real work" at home, at night.

Neither you nor I nor Google's management nor Microsoft's management know what might be going on right now in the mind of a brilliant Saudi woman with a computer science degree who can't work outside her home because her country's laws keep her from mixing with men who aren't related to her. There may be a poorly-dressed young man coding furiously in a Beijing Internet cafe, while you read this article, whose new operating system will make all current ones obsolete -- and you may not learn about his work until it shows up in a Chinese-made $100 laptop computer.

When Bill Gates and his friends started Microsoft, it was one of very few companies that sold nothing but personal computer software, and the others were so small that Microsoft managed to buy most of its competitors -- or at least license their best work or hire away their best programmers. Back then, programmers were scarce and expensive, as were the computers they programmed on. Now there are both programmers and computers all over the world, linked together by the Internet. The Internet not only helps programmers collaborate with each other across geographic boundaries, but allows them to distribute their work without shipping physical products.

The only reason to have a software company's employees work in an office these days is control, both of employees' schedules and of what they work on. Self-motivated geniuses have no need of offices and may even resent being asked to show up at one on a regular schedule, which means that many of the world's best programmers will never work for Google, Microsoft or any other company. Instead, they'll start their own software companies or, in many cases, Open Source-based consultancies.

So Microsoft doesn't face a few dozen competitors, as it did in the 1980s, but hundreds of thousands. And these competitors are spread all over the world. This kind of competition is a lot harder to co-opt, buy out or fend off than competition from a single company, a la Netscape, or even from a group of companies as substantial as IBM, Sun, Oracle, and their computing industry peers.

Competition has Forced Microsoft to Improve its Products

Microsoft may no longer be able to hire all the top programmers it wants, but there is already plenty of talent among its 60,000-plus employees, and they have done some excellent work in recent years. Windows XP is immeasurably better and more stable than Windows ME or Windows 98. The next generation of Explorer will have many of the modern browser features that those of us who use Firefox or Opera have gotten accustomed to. Microsoft Office may not have some of the features OpenOffice.org users take for granted, like a built-in graphics utility, the ability to act as a front end for industrial-strength free databases like MySQL, and the ability to save your work in 30+ different Open and proprietary formats, including PDF. But Microsoft Office today is a lot better than it was 10 years ago, and the next version may even use a sort-of free XML file format that may not be as open and standardized as the OASIS Open Document Format used by OpenOffice.org, but is less closed and less proprietary than previous Microsoft file formats.

A true monopoly would not need to make these improvements in its products. It would give you whatever it wanted, at whatever price it wanted to charge. It would not be selling cut-down versions of its products at cut-rate prices in developing countries -- many of which, you may note, are rapidly turning into "software developing" countries.

Without Linux, combined with Apple's move to BSD-based Mac OS X, I doubt that Microsoft would have put much development effort into Windows. They sure didn't do much with Explorer between the time they crushed Netscape and the time when Firefox started making a big splash, did they?

The U.S. antitrust case against Microsoft wasn't about the company being a monopoly (which courts agreed that it was at the time), but about illegal misuse of that monopoly. That case was settled in a way that left Microsoft essentially unharmed, but with a judge overseeing its actions for five years, a time period that is going to end before long.

The Age of the Software Monopoly is Over

IBM tried to create a monopoly in the business desktop computer business, but failed to hold onto its market-leading position as dozens, then hundreds, and later thousands of competitors made better/faster/cheaper PCs. Even today, while Dell is the world's largest personal computer vendor, if you add up all the market share reports from major computer vendors in this C|Net article, you'll see that they account for around 60% -- not 100% -- of total sales, with smaller companies getting the rest. (And some of those companies are *really* small, like the one-man Bradenton, Florida, shop where my sailing buddy Gene just bought his latest home computer.)

The personal computer hardware business has become totally demonopolized, decentralized, democratized, and internationalized. If you have enough mechanical ability to assemble components neatly (and enough sales ability to get people to buy what you make), you can get into it yourself with a very small investment, just as Michael Dell started out reselling computer components and assembling systems in his college dorm room.

Starting a software business takes even less investment. If you're a competent programmer -- or you have a friend who is a competent programmer and you are a whiz-bang marketing person -- you have everything you need to get going. You can either produce and sell proprietary software or customize (and probably install and maintain) Free or Open Source Software for corporate clients. If the Internet is your primary sales and distribution channel, you don't need to live and work in expensive IT business hotbeds like Silicon Valley or Boston, either: JBoss, for example, is based in Atlanta, Georgia; and Digium, the company behind Asterisk, is in Huntsville, Alabama.

There are software businesses springing up all over the place. Most of them are tiny, and few of them will ever get big enough that analyst firms like Gartner or IDC will track their market share (or even notice them). But there are so many of them being started that, in aggregate, they are becoming a more significant market force than any single big software company, even Microsoft.

This doesn't mean Microsoft will be replaced next year by 100,000 startups. The company will still be around, it will still get lots of press, and -- assuming it embraces (but does not keep trying to extend and extinguish) Open Standards -- it will still be a powerful force in the software world.

But no matter what Microsoft does, it will never have a software monopoly again. Nor will any other company. The barriers to entry in the software business have become too low for that to happen, and too many skilled software developers are learning that they can earn at least as much working for themselves as they would by working for big software companies.

Small is Beautiful was a fine book title in 1973. Today, it's a fine description of the software industry's future.

-----

Have something important to say to the Slashdot community? Email roblimo at slashdot period org the complete article (or an article proposal).

corso64 writes "Ohio Linux Fest 2005, a free conference/event for Linux and OSS enthusiasts, looks to be every bit as good, if not better than Ohio Linux Fest 2004. Last year, IBM, Novell, Apache, Beowulf, Mozilla, along with Jon "Maddog" Hall made Ohio Linux Festival 2004 a huge success along with tons of swag, freebies, and door prizes (including a Linus-autographed cdrom of the original source release of Linux). This year IBM, Novell, Apache, Digium, KDE and others will be doing sessions on Asterisk, KDE, Digital Forensics,Unified Threat Management, Ubuntu, Server Farms and lots of other topics. Check it out this October 1st!"

n8twj writes " With John 'Maddog' Hall pointing out that Open Source VoIP will be bigger than Linux ever has been. How can we be sure that un-ethical companies will not try to steal code that is covered under the GPL and try to pass it off as their own? Recently, I have become aware that SysMaster has been redistrbuting a version of the Asterisk PBX written by Mark Spencer from Digium and many others. SysMaster claims that they wrote everything in-house, while they have surely done their own development, they are using Asterisk to power their product line without following the rules. In terms of full disclosure, my company also provides Asterisk-based solutions, however we have fully embraced Asterisk and gladly contribute back to the GPL."

bkw.org writes "Today Digium released DUNDi which can be used with the Asterisk Open Source PBX for p2p call routing. Digum has also released a whitepaper (pdf) on DUNDi so others can implement this new technology into their products and give VoIP a push into the mainstream." Voxilla also has a story.