Slashdot Mirror
The Software Monoculture
balster neb writes "CNET News.com has a piece titled 'Seeds of Destruction' on monoculture in software and its effect on security. The article talks about similarities between software attacks such as last year's MSBlast, and agricultural catastrophes such as the Irish Potato Famine. Isn't this another good argument against monopolies?"
Isn't this another good argument against monopolies?"
In a very near sighted way, yes. But we are talking about mono-cultures here, which is a bit more broad than that. And, something that the linux crowd will want to be wary of.
With all the momentum behind linux right now, it could soon find itself faced with the same problems MS is faced with. While I don't doubt the ability of the linux folks to find better solutions than MS did, it is still a concern that people should be aware of.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
C|Net. C|Net run. C|Net run and bite the hand that feeds it. Bad C|Net, bad!
I watched C-beams glitter in the dark near the Tannhauser gate.
Luckily there's a remedy for both... Guinness
"Seeds of Destruction" sounds like a typical aspect of nerd monoculture allright.
Isn't this another good argument against monopolies?
You could use the same argument against "standards." But you wouldn't. Yes, if everything were made completely different from everything else, sure, it would be harder to mount large scale attacks against anything. You would have to tailor your exploit to all of the different architectures you are interested in. The downside of course is that you will have thousands of people constantly working on different designs for the same wheel. Promoting diversity within even a company like Microsoft would likely accomplish the same thing, but once again, would be highly impractical.
With some competition Microsoft would be forced to write more secure software faster, so in a way monopoly is to blame.
Then again, AFAIK, Windows is not leading on the server side, but perhaps somebody can correct or confirm that ?
This is from the article: Being the top species in the information chain means more attention from the malicious coders.
On the desktop, MS is definately "top of the information chain", so naturally more attention will be brought their way.
Potato famine was not deliberate - it was caused by a microorganism. Both the hack and the monopoly are socially constructed. Science can fight the former, but not the latter.
Of course, it is obvious that no computer virus has caused loss of human life (yet). However, it is probably only a matter of time until a virus or computer bug causes a massive loss of human life. Due to our huge reliance on computers, and due to the fact that 90% of the computers out there are running the same OS (including some of those that control critical infrastructures like 911, nuclear reactors, etc), the frightening implication is that in the event of a loss of life, it could be much, much worse than the Irish Potato Famine.
Coming soon: The Irish Potato Virus!
Kierthos
Mr. Hu is not a ninja.
Prevent email address forgery. Publish SPF records for y
To add to michael's point, Jonathan Wignall made an excellent presentation(sorry it's PPT) at DefCon 11 last year about how we could fight network worms.
He basically concluded that we could not launch counter worms (like ones that would patch vulnerable Windows systems). The best solution was to diversify the OS we have our servers running on. A worm can spread in a matter of minutes as the creator of the worm usually chooses a set of powerful vulnerable machines as his first hit.
Some OS like to keep things more open and easy to configure like Windows 2k server, which showed a whole in MS SQL server 2K in which the DB could be accessed over the net. As a network admin you just needed to keep your DB firewalled and things would have been ok. Other OS like Solaris are more of a pain to configure but usually leave less stuff open.
It is not enough to have a good mind. The main thing is to use it well. - Rene Descartes (1637)
"People have brought over species that we didn't expect here, just like people have created viruses that Microsoft didn't expect to deal with," said Jeff Dukes, professor of biology at the University of Massachusetts at Boston, who studies diversity and growth in ecological systems. "These introduced species have had a major impact on our forest and have knocked out entire species."
Excuse me, but how can you compare a biological occurrance to a technological occurrance? There are too many variables in the biological virus. Or can you in fact make a definite comparison?
Saying people created viruses Microsoft didn't expect to deal with is bogus. That's a cop-out.
Microsoft was well aware of many of it's security holes. It's been going on for years.
There is a significant difference between what's happening in computer security and the potato famine. They didn't know any better than to farm without diversity at the time. We've learned a great deal about agriculture and soil conservation since then... the famine itself was one large, nasty lesson.
The big difference wrt computer security is that we *do* know better and are still failing to get it right! The phone "Phreaks" from decades past should have taught us a lesson (not to mention the telco's of the time). The Morris Worm should have been a giant, looming reminder of security and secure programming practices and the internet became more ubiquitous and our economic dependence on it greater... but we (producers of software everywhere) still keep f-ing it up!
The writing is on the wall, has been there for a long time and it needs to be heeded.
I think that this concept also applies to BIND.
Most DNS servers run either ISC BIND, or a package based on BIND source. Although I am a hostmaster and respect BIND, I often wonder if this isn't one of the reasons that DNS is such a prime hacker target.
It seems clear that even with this example of an open-source program (although it's not GPL), groups prefer to avoid the cost of development at the expense of security (via the same monoculture argument). I've asked DNS appliance vendors this question (while they're trying to sell me on their product's security), and it's clear that they've never seriously considered the issue.
"People have brought over species that we didn't expect here, just like people have created viruses that Microsoft didn't expect to deal with"
The difference here is that we have US Customs doing its best to stop people bringing forigne species over. If US Customs did things like Microsoft, they would hand out culture dishes to exicute your Windows Script code on and implant your cultures into the environment w/o asking the end user.
It's funny how a company can leave holes in everything, let people get used to being insecure, then tout fixing the problems as an innovation.
Couldn't this same argument be applied to omnipresent standards and not just monopolies? If everyone uses TCP/IP and a security flaw is found in it, doesn't that amount to the same type of security threat?
:)
And yes I'm playing devil's advocate, but it's a slow morning
I went to the city because I wished to live without deliberation.
Yes. It's an argument against monopolies. But it's also an argument against standards and any kind of compatibility.
With the good comes the bad.
The article glossed over the heart of the matter...
...except for that brief mention. The English were the ones that killed the Irish, because they demanded payment in food, even when the Irish could not pay.
Most of it, however, was intended for export to England.
To liken the conditions of the software industry to the Irish Potato(e) famine is ridiculous. To whom or what is the industry beholden to? If we cannot produce code will we starve to death? Is someone occupying our cities and towns, threatening our lives if our code fails to compile? I'm not Irish, (though I do like potatoes), but please think again before you make analogies such as these.
Sig Hire!
This isn't really a new argument. Marcus Ranum's web site, for example, contains a counterargument, links to articles discussing arguments for and against, a link to the paper by Dan Geer that brought the monoculture argument into the limelight, and some sarcastic comments on the new monoculture study that the C|Net article mentions. ("$750,000 to sit around and whine about Microsoft? How do I get a gig like that?!")
Boardwalk and Park Place rule! Potatoes have nothing to do with this! And, yes, buy the railroads, you'll need the income.
"I only speak the truth"
Karma: null(Mostly affected by an unassigned variable)
Admittedly, this is off-topic. But I did my Ph.D. on the stuff and comments like that perturb me!
It is a common misconception that the disease known as late blight, caused by the Oomycete (Phytophthora infestans) "caused" the Irish potato famine. Yes it is true that the Irish were growing only a few varieties of potato (monoculture), but the REAL reason was the socio-economic structure put in place by those bastard English. Essentially, most of the Irish farmers (which was damn near everyone), "rented" the land from rich English landowners. This meant that they grew vegetables, wheat, etc. to pay for the rent, and grew potatoes for food because they stored well. Late blight reduces crop yield both before harvest (lost foliage) and after harvest (tuber rot), and by removing potatoes as a food source, the Irish began starving. The English did nothing to help the them during this time. In fact, the rental system stayed in place throughout the whole famine.
This is from the article: Being the top species in the information chain means more attention from the malicious coders.
On the desktop, MS is definately "top of the information chain", so naturally more attention will be brought their way.
Apache is the top web server, running over 2/3 of the sites on the Internet. Why is it that Microsoft's IIS, at less than 20% of web sites, is the one that keeps getting exploited?
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
To make my point very clear: British theft of Irish land and the systematic exclusion of the Irish from all occupations except farming and laboring meant that the only crop which was high-yield enough to be viable on the tiny plots of land left to the Irish was the potato.
All during the famine Ireland exported corn grown on the landlord-owned estates to Britain.
I realize that this isn't the central point of the post, but the phrasing implies a foolish choice on the part of those who suffered from the forced monopoly.
In organic farming monoculture is anathema. Having a variety of species in the same field reduces exposure to disease. It is more work to farm like this so the product is more expensive but of better quality. The same can be applied to network running open source software, more work to properly maintain but more secure.
As a point of interest, Oracle sells far larger database implementations than Microsoft SQL Server can support, and has been selling them for far longer than Microsoft has been selling SQL Server. Which has an archetecture that virus and worm writers have been able to exploit.
Apache on Linux, BSD and Solaris hosts significantly more web sites than IIS on Windows does, and has for several years longer. Which combination is more prone to being abused by viruses and worms?
Sendmail, hosts an order of magnitude more e-mail transactions than Exchange does. Which gets less press for it's holes because it runs on a platform that gets exploited so often people expect the worm of the week to attack?
The applications that get the worst rap for security problems are the ones with the most users, Internet Explorer, and Outlook (any variation). The fact that they happen to run on the same basic platform as the SQL server and IIS web servers do, should provide sufficient evidence that the alternatives running on other platforms would _tend_ to be more secure.
That does not prevent problems from being possible in a Linux monoculture, or a BSD monoculture. It just suggests that the underlying structure is more secure, and less likely to be a significant source of security problems for e-mail and web browser clients running on top of them.
-Rusty
You never know...
With each of your examples, the same security problem cannot affect all of these systems. There are lots of species of potato, but because the population of Ireland were reliant on mainly one species, anything that affected this had a massive impact.
Genetic diversity does not prevent disease, but it does reduce the effect one disease has on a population. This is the analogy I believe was being drawn. Imagine a virus wiped out (not just crashed) an OS. If all computers in the world were that OS, all computers would be wiped out, if computers were of mixed OSes, a proportion would be wiped out, but enough would survive to keep the infrastrucure intact, this is the point against monopolies.
Now, maybe a virus cannot completely wipe out a computer it infects (for now anyway) and the computer can be patched and rebooted, but even with non-fatal viruses that just crash and require a reboot 'genetic' diversity can smooth the effect a nasty strain of virus has.
--
FreeNET user? Comfortable with the adverse selection?
It is a well-known fact that the Irish Potato Famine wasn't caused by a lack of potatoes; rather it was an overabundance of Irishmen.
Seriously, though, agriculture is a risky proposition. Prior to European conquest of Africa, the natives largely existed as hunter-gatherers. As such they tended to just eke out an existence on what little food they could find. Also, humans naturally become infertile when they're not fed enough, so during a time of scarcity the population stabilized itself, with the standard very-young and very-old dying off.
The Europeans brought agriculture to Africa. (I'm talking large-scale, tied-to-one-patch-of-dirt agriculture here.) This has upset the "natural balance" by creating subsistence farming. People do tremendously well during good years, but are devastated that much more when a drought comes along. The population swells greatly due to the static nature of life and the need for people to work the farms. Those same populations are routinely eviscerated by famine every decade or so. (Not to mention the social problems as formerly nomadic people have been lumped together in aribtrarty boundaries drawn by their conquerors.) For some reason Sally Struthers seems to think the solution to this problem is to provide more food. It's a short-term fix but it's also a vicious cycle.
Agriculture can bring tremendous profit and clearly supply much more food than the hunter-gatherer lifestlye. But the risks are greater, too, especially once your society becomes dependent on large-scale farming. I saw on Discovery channel the speculation that years of poor harvests led to the extincion of some Middle American people around 1200 AD. (Mayans? I can't remember.) In modern times, we see these risks introducing themselves in new ways, such as mad cow disease, brought about by imposing a cannibalistic diet on cows, which in turn happens because of market pressures to keep producing cheaper meat for an increasing number of increasingly hungrier (to the point of obesity) population. Something has to give. We are also seeing the depletion of natural fish stocks, and the "latest study" says that farmed fish contain much more mercury and PCBs than wild fish.
I liked the CNet article a lot; they could have mentioned SQL Slammer's apparent role in the blackouts last year. I guess that hasn't been explicitly proven and overty recognized, it would probably be too costly to Microsoft's share value, and by extension the economy, and by extension Bush's reelection strategy.
That's right. They stole it fair and square. Per-Processor licensing was introduced in 1988, and illegal.
Firstly, the snide comment on monopolies is simply unwarranted and certainly not as sarcastically entertaining as I'm sure it was intended. Too often the word "monopoly" is used as merely a code-name for "those-who-are-winning-and-who-aren't-me!" So 'nuf said there.
Secondly, the ubiquitous nature of the Internet is the single biggest reason behind it's success. While I agree that the "genetic makeup" of the Internet may also be its weakest link, I have to ask, "What's the alternative?"
Look at how the Internet, much like the telephone, has made communication so much more efficient. It has opened channels across the world, across socio-economic cultures, across demographic diversities that have never been accessible before - at least to the average Joe/Jane. This would have been impossible if, say, every country was forced to use its own network transport layer. Sure, Cisco would love it - they'd be able to sell country-specific routers to automate the traffic translations. They'd make a fortune!
Is the article suggesting that we create multiple network infrastructure to obfuscate malicious interrogation? If so, how could it be done without public standards - which would defeat the purpose anyway?
The article's viewpoint is short-sighted. The answer is not to mutate the DNA of the Internet (Ethernet/TCP/IP/etc), but rather to enhance its perimeter defenses, such as SMTP. That protocol itself is way to vulnerable. Outlook is a fine product; I doubt anyone would argue that. But look how much it's been [editorially] attacked recently because it's based on an ancient protocol and has been jerryrigged to overcome the security holes of its communication layer.
I don't know, maybe I'm rambling, but the article irked me. Just a bad day I guess.
To take the anology to the next level.
MacOS X is then a graft of the macintiosh experience on top of good ol unix. Just like the french vineyards are French vines grafted onto american trunks and roots due to the fact a fungus ate all the french roots.
I make my face look like this and concerned words come out.
In November, the National Science Foundation granted three university researchers $750,000 to find the location and number of such weak links within the information infrastructure.
Sure, but if I did an independent study I'd be thrown in jail under the Patriot Act and no one would hear from me again.
#1. Microsoft WAS handed their monopoly. From IBM. Back when IBM licensed MS-DOS for the IBM PC.
#2. Check the DR-DOS history. See how Microsoft used bogus "error" messages against competitors.
#3. Check the Netscape trial. See how Microsoft used OEM contracts against competitors.
DUH! Did you MISS the part where Microsoft was found GUILTY of ILLEGAL LEVERAGING their MONOPOLY?
Yes, if Linux gained more desktop space there WOULD BE FEWER VULNERABILITIES. Just take a look at how much market share Apache has and compare the market share to web server vulnerablities that have been exploited. Specifically, how many IIS servers have been exploited.
And you WOULD make the news IF your exploit/virus/trojan/whatever could hit BOTH Windows and Linux boxes.
Get real. If all the factors were equal, we'd see a LOT more Apache exploits. There are over TWICE as many Apache sites as there are IIS sites.
Your beliefs do not seem to coincide with the facts of the real world.
this is bizarre.
.
i've been reading all the posts so far, and all of them appear to be in agreement.
i'm not sure i've seen this level of agreement even over the SCO case. Once in a while you at least get a decent troll on the SCO topics.
I feel like it's my duty as a concerned citizen to pick up the slack here, so um . .
the software monoculture is in every way exactly identical to the potato famine. in fact, it's so similar that i'm not sure they are different things. damn the irish and and their isecure monoculture. damn it.
in other news, i think my pc might have SARS.
** Chigusaaa!!! You're the coolest girl in the WORLD!!! **
Reminds me of an argument I had with a member of RIT's support staff regarding RIT switching to Exchange for e-mail. Basically, it boiled down to me asking him if the old POP system would remain in effect for people like me who used programs like POPFile to filter my mail.
Basically his reply was that I shouldn't depend on one particular means of getting my e-mail. To which I replied "What do you think switching to Exchange/Outlook is doing?"
Point, me.
--You will rephrase your request for me to go to hell. Goto statements are not acceptable programming constructs
Why is arguing against monopolies arguing against standards or arguing against compatibility?
The presence of a monopoly *guarantees* a standard, but does not guarantee compatibility. Microsoft can (and has, accidentally) broken compatibility between various versions and flavors of it's various programs.
The absence of a monopoly does not have any bearing on standards or compatibility. It is, in fact, preferred for there to be a standard in the absence of monopoly; witness the DVD standard, the CD standard, the various interface standards...? It means that people can talk and interact sanely when no one individual has control.
If you mean diversity argues against standards and compatibility? I don't think that holds either.
Philips, Panasonic, Samsung, Sony, IBM, Apple, Dell, RCA, Aiwa, and Kenwood all adhere to the CD standard, and thus a CD that can play in one can play in all, without there existing a monoculture or a monopoly. The same holds true of paper, nails, DVDs, and many other things. Of course some products are crappier than other products, which affect compatibility and quality, but it's not due to lack of monoculture, since Microsoft decisively also has crappy products and crappy quality as well.
Diversity means competition.
Last I recalled, competition meant progress, and growth, as well as strength and robustness. If one product/method/attempt fails, then another can succeed. If one is suboptimal, and alternative may be optimal.
In a monoculture, none of that applies. You can't have difference without choice, you can't have competing theories without choice, you can't have flexible strengths without choice.
You just have no choice.
GPL Deconstructed
There's that evolutionary aspect to it in the long term (less desirable species die off), but more importantly diversity leads to resistance. If, for example, your web site runs on both Windows and Linux servers, and an exploit against either one cannot take down your entire site.
According to a Netcraft report, 2/3 of the web now runs on Apache.
Granted, it could be Window/Apache, it's most likely Linux/Apache.
It is not enough to have a good mind. The main thing is to use it well. - Rene Descartes (1637)
I'm a biologist, biatch!
/RANT
A biological population can experience genetic bottlenecks. For example, everyone in Iceland is practically genetically identical, since they are descended from a group of about a few dozen (already closely related) Vikings.
The potatoes in Ireland where a similar example. Not only was everyone growing potatoes - all of these potatoes were descended from a small number of potatoes brought over from the New World. The original population of New World potatoes were genetically diverse - but the potatoes brought to Ireland were all especially susceptible to the fungus that brought on the Irish Potato Famine, so it was catastrophic.
You can also get a genetic bottleneck in an entire species. The few surviving Andean condors probably only represent a fraction of the genetic diversity the Condor had at the height of its population. The diversity is gone forever.
The same is not true for rarely used, or even completely unused, software. If some disaster befalls us that makes other operating systems useless, we can resurrect OS/2 Warp even if not a single installation remains anywhere in the world.
On the other hand, without a population of OS/2 Warp installations, OS/2 Warp cannot evolve. It exists in a form of stasis that, over time, may render OS/2 inviable, in much the same way that environmental changes might drive the andean condor all the way to extinction (while it might have survived with the genetic diversity that the species has already lost.)
The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
It is not standards that are a problem, it is "De Facto" standards.
A "De Facto" standard is really not a standard at all. It's just an implementation that happens to gain critical mass.
In (economic) theory, such an implementation should be the Darwinian best; in theory the best product always wins. However, we know from engineering experience this is almost always untrue. Another way to put this is that fitness to reach monopoly status is not necessarily fitness for the tasks and uses to which we'd like to put a thing.
The advantage of real standards over "de facto" standards are that they designed to allow multiple competing implementations, avoiding the monoculture problem. The other advantage is that that they are "designed" rather than just happening.
The disadvantage of standards over "de facto" standards is that the standards process is less agile at the outset.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
False logic: You talk about the weakness of standards, which is valid, and then switch topics. The logic breaks when you do that.
You talk about the difficulty of diversity in an extremely exaggerated and unrealistic manner as a solution against standards and monoculture, when the realistic solution is neither.
In real life, you have competing *standards*. DVD-R and DVD+R. Blueray and HD-DVD. uPnP and Zeroconf. POP and IMAP. And often times, in real life, you don't settle for *one* standard, you accept multiple. Of course there are exceptions, like HTTP and BIND or TCP/IP protocols, but your argument has no bearing on reality otherwise.
So you then talk about diversity being impractical, without supplying any logic whatsover. You just assume because encouraging *no* standards is impractical, that diversity is impractical. They are different.
Support multiple standards, support open standards, and their implementation is not impractical, highly or otherwise. That is the whole reason standards exist!
Use different hardware and OSes to protect a company is not 'highly impractical' NetBSD on x86 for firewalls. Solaris on Sparc for servers. Linux on Itanium for compute nodes. OS X on PPC for desktops.
This is *natural* because each environment and tool have different strengths and weaknesses. It's like having multiple tools in a tool chest!
You wouldn't use Linux and Itanium for *everything*. Nor would you use OS X on PPC, or Solaris on Sparc. Nor *should* you use Windows on x86. It makes you too vulnerable and weak, and you sacrifice the strengths of each platform and environment!
GPL Deconstructed
That does not prevent problems from being possible in a Linux monoculture, or a BSD monoculture. It just suggests that the underlying structure is more secure, and less likely to be a significant source of security problems for e-mail and web browser clients running on top of them.
Part of the problem with an MS monoculture isn't just a lot of people using Windows, it's a lot of people using Windows + Outlook + IE. If we take a hypothetical situation where the three in combination are individually more secure than some other OS/Browser/Mail Client combo, it is still more profitable for a virus writer to find one flaw in the dominant software then to find a much more exploitable flaw in some other less prevalent software.
William of Ockham had no beard. The most likely explanation is that it was chewed off by squirrels every morning.
With Linux emerging as the platform of choice for scientific applications, I would imagine NASA has had to have changed this policy, so I would like to hear from some NASA people what the current policies are.
One thing is clear, open source is being demonized by people with vested interests, and are trying to pass actual laws along the lines of "This is Godless and Communistic." I personally think open source is a really good fit for OS and language design. These are foundations on which everything else rests. Without open source you don't know if what you are building lies over a fault line or an artisian well.
I'm sure Microsoft is cutting deals behind closed doors with various governments about putting in code to "track the bad guys". It's not just a matter of having stuff in there you don't know about, but having it steal your processor cycles, and having unintended interactions. And since it's black box and probably DRM, it will probably become illegal to deactivate it. And since you can't rip it out, or should even know it's in there, someone comes along with a real killer virus exploit that turns on your own DRM against you.
Letter To Iran
Monoculturalistic tendencies -- agricultural or technological -- develop because short term, they are more efficient, leading to economic benefits. Long term, of course, they are disasterous, because they lead to a lack of advancement and, if universal, lead to inevitable collapse of the entire system if a vulnerability exists and is exploited. This is a great example of what economists call "market failure," in which market forces drive a specific environment toward the *least* desirable outcome (for a primer on this problem, study articles relating to "the tragedy of the commons"). Eventually, such systems collapse because of these flaws, and are then subject to regulation or restrictive laws (see the government's ongoing oversight of Microsoft).
Potato Famine: people died by the cartful.
MSBlast: affected computers were unusable until patched.
There's one. Comparing computer problems to real-world situations where death is involved is a mistake (aka: a fucking joke.) Just like the comparison of Windows to automobiles.
"Plain old capitalism" is exactly what the railroad robber barons did in the 1800s. And it is one reason that anti-trust laws exist today. It is not legal to use "industry leadership" in one area whether it's railroads or operating systems to create monopolies in areas where you are not the best player but just the richest or most powerful (due to dominance in another area).
Let's imagine a "hypothetical situation." A company produces a software application in addition to its very popular operating system. The new software application is not as good as the competition's product and isn't as popular with secretaries. By bullying the retailers (as in "if you include our competitor's software on your computers, we won't let you use our operating system"), that company might very well find itself an industry leader without ever having to improve the product.
Of course, this is purely an hypothetical example...
"Obviously, I'm not an IBM computer any more than I'm an ashtray" (Bob Dylan)
Many different vendors implemented SMTP/POP3 and TCP/IP differently - and yet they were all succeptible to their historical fiascos.
We got a TTL field, a clean-up of the Ack response, and a reorganization of the old email-handoff architecture - but it still ended up costing a comparable amount of time and resources to deal with as any other hack.
HTTP, like any technical standard monoculture, is also susceptible to legal problems - just as linux is. The [object] debacle is going to cost more than just microsoft manpower, and money. And should a legitimate SCO-style IP claim be levelled against Linux, updating all the various builds out there will be a similar resource drain for every vendor.
So while standards may not have the same attraction for directed malicious individuals as does a monoculture OS - they do still come with monoculture risks and vulnerabilities.
One might argue that the prevalence of SMTP/POP3 as mail standards is to blame for much of the time, energy, and money used to combat spam.
If there wasn't such entrenched usage of the dominant standards, software would necessarily need to support multiple standards. Then it would be easier for clients to demand an improved solution, as they'd be more free to junk a particularly troublesome standard.
Sure, standards are largely a necessary evil for effective communication across systems. But because they are necessary doesn't mean they don't still carry traditional monoculture risks.
// "Can't clowns and pirates just -try- to get along?"
[oversimplification] Back in the day, Windows was a popular operating system. Not the only popular one, but popular enough that an OEM who didn't offer Windows pre-installed was going to lose a lot of business. MS basically said that the OEM would pay them $fee for every processor sold, regardless of the OS installed, or else the OEM would not be allowed to sell Windows machines at all. Most OEMs recognized that they couldn't afford the hit they'd take if they couldn't sell Windows, so they agreed to this devil's deal. And then, since they were paying for the darned thing anyway, they installed Windows on all of their machines. [/oversimplification]
This is how to turn a merely successful product into a monopoly, while making a lot of enemies as a free bonus!
160,000 animals would not feed a population of millions for a year (Ireland's population at this time was ~8 million). They may have made a small difference but would not solve it. The majority of Ireland's population were serfs, at the subsistence level, they would never have been able to eat this food, it would have gone on the plates of the landowners and never into the general population's mouths. It was the social structure of Ireland which caused this problem, not exports. Black-rot not only changed Ireland, but farming practices over the entire world.
Also note Ireland was part of Britain at this time, so "exports to Britain [from Britain]" is an odd way of putting it.
There is a lot of info about the famine online, not least this.
--
FreeNET user? Comfortable with the adverse selection?
The other part, is assuming Linux has only stolen share from other UNIX vendors, Linux webservers would still account for fewer actual computers on the internet compared to Windows machines. Linux servers are also not always uniformly exploitable with the differences between compiler, libc, and kernel versions and patches. For Windows servers, you only have two or three flavors of Windows you need to worry about, and all you have to do is make one (legitimate) http request to find out which one. Linux/Apache sites will tell you which version of Apache is running, and maybe what distribution of Linux it's running on, but won't tell you what kernel version is running, what glibc is installed, what compiler was used. For that, you'd have to guess, so the list of possibly exploitable machines gets smaller.
I wish Netcraft would do a new machine survey, so we could put this one to rest, but I havne't seen one since June 2001.
I used up all my sick days, so I'm calling in dead.
to say that "[Microsfot] SQL Server [...] has an archetecture that virus and worm writers have been able to exploit" is simply pathetically desprate misleading of the audience. Here is why.
The Slammer worm has used a vulnerability that was NOT an architectural design flaw across the product. It was a simple stack buffer overflow in an implementation of the SQL Resolution Service.
On a seemingly unrelated topic, here is a plethora of buffer overflow vulnerabilities of Oracle from some time ago. How much mass media attention did that receive. Close to none, because it doesn't pay the media in advertising revenue to show an expert talking tech about buffer overflows and authorization headers. But does pay off to create a bombastic news report on a big-time screw-up of the largest software company in the world.
I am sorry to bust your balls, but I do recall several instances of similar problems such as an Apache worm on FreeBSD. I am not arguing that Apache et al. have more flaws, I am just pointing out that everyone who has coding skills prefers to explore IIS's quality rather than some Apache's because of simple "I can pick on the weaker guy easier" predatory concept from kindergarten.
Well, there's sendmail.
Oh, wait. Err... well, there's BIND.
Umm.... well, OK, not really.
-Esme
. . . what I just don't understand is why did these OEMs agree to this? Collectively couldn't they have had some leverage against Microsoft in a business sense?
You really expect companies who are trying to cut each other's throats to band together against a company they need to deal with on an individual basis? At least one company did complain about Microsoft's tactics; it was Gateway, IIRC.
You're quite welcome.
what I just don't understand is why did these OEMs agree to this? Collectively couldn't they have had some leverage against Microsoft in a business sense?
You'd think so, wouldn't you? I suspect it was partly a sense of "everybody else is doing it," i.e., going along with the herd, and partly simple reluctance to get into an ugly battle with what was, even then, an extremely powerful company. I suspect that MS could have outlasted any collective attempt to thwart them; MS's profit margin would have taken a hit, but several of the OEMs would have gone out of business long before MS would have been forced to cave.
That doesn't change the fact that the Irish were dependent on the potato. And it doesn't change the fact that when a disease came along that attacked the food that they depended on, the people starved.
You should do some research before spouting off, then admitting you know nothing. Ireland was a victim of classic Colonialism - the natives' land was forcibly seized and they were converted from self-sufficient communities into tenant farmers. They were told they had to pay "rent" to live on the land that they had formerly owned. The only way to pay this "Rent" was to grow cash crops for export. The cash crops occupied all the best land. The renters were forced to eke out a living on marginal land with non-cash crops. When the non-cash crops failed, they had no money to buy food in the form of cash crops, and in any case most of the cash crops were already pledged through forward contracts to overseas buyers, who could always outbid the renters. The remaining farmers who owned some land were forced to buy food at inflated prices, often going into debt. This caused many of their farms to be foreclosed. Famine is thus a political tool that leads to collectivisation. The British knew this in the 1940s, and Stalin knew this in the 1920s and 1930s. There's more here, if you care to educate yourself.
Da Blog
-[ Attachment: virus.tar.gz 106k ]-
Installation instructions:
* Save the attached file. (In mutt, highlight the attachment and press s. In Evolution, right-click on the attachment and select Save As. For other mail readers, consult the manual page.)
* Uncompress the file in a new directory. (Open a terminal window and type tar xzf virus.tar.gz, or open the file in Karchiver, GUItar, EasyTar etc. See the tar and gzip HOWTO for more information.)
* In the virus-0.11.2 directory, run the following commands:
./configure
make all
make install (run this as root)
Note: you will need to install gcc (the GNU C compiler) in order to compile the virus, along with the kernel headers for your system. See the GCC HOWTO for more information.)
* Congratulations! The virus is now ready to run! Type virus at the command prompt.
* H4 |-|A i 0\/\/Nz3D y0O 5uC|eRR!!!!!!1
Open specifications
With multiple implementations
On multiple platforms
This is what published standards allow.
Monopolies tend to produce:
Closed specifications
With single implementations
On single platforms
which is why they're easier targets for exploits.
Note that most of the modern scripting languages occupy an intermediate point here, since they tend to have a single implementation which effectively is the specification. Perl/Ruby/tcl are like that. Python is a little better since it has multiple implementations, but no formal specification other than a test suite (correct me if I'm wrong, Python people).
To a Lisp hacker, XML is S-expressions in drag.
I may of course be mistaking, but the operating system was not Windows, but DOS. And the popularity came not from the operating system, but the price of the machines (combined with the IBM brand).
When there are similarities in software running on computers over the internet the process of fixing bugs is simplified e.g. Microsoft only needs one copy of the relevant patches per OS version.
Which means that they really *do* need to get iexplore.exe OUT of the OS. I mean really, isn't the need for that kind of tight bundling long gone with the death of Netscape? Making that *one* move could probably eliminate most of MS security probs, I bet. Just trying to give them a hint here.
C|N>K
Not at all, not according to research models, actual case studies, and biological examples.
The study of networks, and scale free networks, has been applied to virus vaccination, and I do believe those results apply equally to the internet, or any other network. You don't need to immunize everyone, and you don't need to make all network nodes different, you just need to immunize hubs, and you just need to vary and protect vital hubs.
Here's a thought exercise: If you had 3 lans at work (one wireless, and two wired), you don't need to diversify every network to protect the entire place; You only need to protect three internal firewalls, three routers, one external firewall, and three DHCP machines to effectively protect up to 750 machines. Even better of course is the fact that all 750 machines don't have to be identical, since there will be the odd Linux server, Mac desktop or laptop for the graphic folks, and perhaps a Sun workstation or two here and there.
So it's not like you'd have to diversify to uselessness at all; just intelligently.
GPL Deconstructed
"It's not a question of whether Linux vs. Windows on security is arguable or not, just whether it can be proven."
It can never be "proven" because there is no way to know that every possible bug has been found.
All that can be shown is statistical evidence.
"Standards" contribute to the problem of monoculture in much the same way that standardizing on "front door with lock that opens with a key" contributes to home burglary. For that matter, all thieves speaking the same language in their home town makes it easier to discuss burglary. But the same standards also help us get around every day, so there is a tradeoff.
Now, interestingly enough, I suspect we are heading for an era of fewer such standards! Communication is already in flux due to encryption; my encrypted discussion with another person will appear as complete jibberish when intercepted, like when the Japanese intercepted US Navy transmissions that were actually clear-text conversations between North American Indians working in the radio room. As for locks...what happens when homes lose their locks in favor of AI, and simply recognize who can come in and who cannot? It is much harder to crack a system that is watching you while you attempt to crack it. After all, the house could simply kill you if it had the right weaponry. At the least, it would not be as gullible as a lock.
OK...my point approaches. Think for a moment about the shifting stairways and jumping rooms (well there was one at least in the last book) in the fabled Hogwarts School of Witchcraft and Wizardry. Ignore for a moment all the spellcraft going on...just look at what you could do with the architecture...can you imagine trying to take that place with a SWAT team? What route would they storm through? What alternates would they plan? What if things started moving even faster during a suspected attack? Further, what if the students and staff knew the rules and could function well enough regardless? An assault would not even bear the attempt. Given a similar kind of approach to software (and it really is just an approach, not magick at all) the best defensive strategy in OSs would be to have them randomize themselves on-the-fly. Most binaries could afford a certain amount of NOP space inserted. During final compile a "deviantC++" compiler could randomly insert busy loops or security trips or even totally bogus code, like whole other apps laying around already (games come to mind) and have them jumped over by properly executing code. We have plenty of RAM on our systems and generally an excess of CPU cycles; let 50% or more of binary be lines of random or calculated diversion codes. And let the code move itself around!
We're so accustomed to the idea of optimizing code. We even reuse code and data objects and this is seen as a virtue and at present it is. But we could quickly decide that times have changed and it is no longer a virtue. My machine no longer has just 640K RAM, guys, and it has enough spare CPU to run Setiathome. I'm willing to sacrifice some of my slack for an OS and apps that gleefully rewrite themselves every few minutes. If that became very common then the notion of exploiting a computer remotely via known vuls would become a quaint memory of a primitive era in technology.
And now I will hustle my butt over to the USPTO to patent this scheme for the financial benefit of my heirs. Remember, you read it here first.
=^..^= all your rodent are belong to us
The implications for internet security are clear: we have to teach computers to have sex. Luckily there are plenty of training videos available on the internet. I've been doing my bit for the future of network security by downloading these videos and showing them to my PC - I recommend you do the same.
Your point is well-taken, but it has some uncomfortable consequences. Consider that most people on this planet don't get enough to eat. They're not as badly off as the potato-dependent Irish, but they're still pretty badly off. And, like the Irish, they're not starving because there's no food to feed them. They're starving because the economic deck is stacked against them.
There is a difference in that the Irish lived on the very land that could have fed them, and even grew the crops they weren't allowed to eat. But I'm not sure that's a difference with any moral value. It certainly isn't a difference that matters to the millions who hate and envy us for our full bellies.