Slashdot Mirror
The Software Monoculture
balster neb writes "CNET News.com has a piece titled 'Seeds of Destruction' on monoculture in software and its effect on security. The article talks about similarities between software attacks such as last year's MSBlast, and agricultural catastrophes such as the Irish Potato Famine. Isn't this another good argument against monopolies?"
Isn't this another good argument against monopolies?"
In a very near sighted way, yes. But we are talking about mono-cultures here, which is a bit more broad than that. And, something that the linux crowd will want to be wary of.
With all the momentum behind linux right now, it could soon find itself faced with the same problems MS is faced with. While I don't doubt the ability of the linux folks to find better solutions than MS did, it is still a concern that people should be aware of.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
C|Net. C|Net run. C|Net run and bite the hand that feeds it. Bad C|Net, bad!
I watched C-beams glitter in the dark near the Tannhauser gate.
Luckily there's a remedy for both... Guinness
Isn't this another good argument against monopolies?
You could use the same argument against "standards." But you wouldn't. Yes, if everything were made completely different from everything else, sure, it would be harder to mount large scale attacks against anything. You would have to tailor your exploit to all of the different architectures you are interested in. The downside of course is that you will have thousands of people constantly working on different designs for the same wheel. Promoting diversity within even a company like Microsoft would likely accomplish the same thing, but once again, would be highly impractical.
With some competition Microsoft would be forced to write more secure software faster, so in a way monopoly is to blame.
Then again, AFAIK, Windows is not leading on the server side, but perhaps somebody can correct or confirm that ?
This is from the article: Being the top species in the information chain means more attention from the malicious coders.
On the desktop, MS is definately "top of the information chain", so naturally more attention will be brought their way.
Potato famine was not deliberate - it was caused by a microorganism. Both the hack and the monopoly are socially constructed. Science can fight the former, but not the latter.
Of course, it is obvious that no computer virus has caused loss of human life (yet). However, it is probably only a matter of time until a virus or computer bug causes a massive loss of human life. Due to our huge reliance on computers, and due to the fact that 90% of the computers out there are running the same OS (including some of those that control critical infrastructures like 911, nuclear reactors, etc), the frightening implication is that in the event of a loss of life, it could be much, much worse than the Irish Potato Famine.
I think that this concept also applies to BIND.
Most DNS servers run either ISC BIND, or a package based on BIND source. Although I am a hostmaster and respect BIND, I often wonder if this isn't one of the reasons that DNS is such a prime hacker target.
It seems clear that even with this example of an open-source program (although it's not GPL), groups prefer to avoid the cost of development at the expense of security (via the same monoculture argument). I've asked DNS appliance vendors this question (while they're trying to sell me on their product's security), and it's clear that they've never seriously considered the issue.
"People have brought over species that we didn't expect here, just like people have created viruses that Microsoft didn't expect to deal with"
The difference here is that we have US Customs doing its best to stop people bringing forigne species over. If US Customs did things like Microsoft, they would hand out culture dishes to exicute your Windows Script code on and implant your cultures into the environment w/o asking the end user.
It's funny how a company can leave holes in everything, let people get used to being insecure, then tout fixing the problems as an innovation.
Couldn't this same argument be applied to omnipresent standards and not just monopolies? If everyone uses TCP/IP and a security flaw is found in it, doesn't that amount to the same type of security threat?
:)
And yes I'm playing devil's advocate, but it's a slow morning
I went to the city because I wished to live without deliberation.
The article glossed over the heart of the matter...
...except for that brief mention. The English were the ones that killed the Irish, because they demanded payment in food, even when the Irish could not pay.
Most of it, however, was intended for export to England.
To liken the conditions of the software industry to the Irish Potato(e) famine is ridiculous. To whom or what is the industry beholden to? If we cannot produce code will we starve to death? Is someone occupying our cities and towns, threatening our lives if our code fails to compile? I'm not Irish, (though I do like potatoes), but please think again before you make analogies such as these.
Sig Hire!
Admittedly, this is off-topic. But I did my Ph.D. on the stuff and comments like that perturb me!
It is a common misconception that the disease known as late blight, caused by the Oomycete (Phytophthora infestans) "caused" the Irish potato famine. Yes it is true that the Irish were growing only a few varieties of potato (monoculture), but the REAL reason was the socio-economic structure put in place by those bastard English. Essentially, most of the Irish farmers (which was damn near everyone), "rented" the land from rich English landowners. This meant that they grew vegetables, wheat, etc. to pay for the rent, and grew potatoes for food because they stored well. Late blight reduces crop yield both before harvest (lost foliage) and after harvest (tuber rot), and by removing potatoes as a food source, the Irish began starving. The English did nothing to help the them during this time. In fact, the rental system stayed in place throughout the whole famine.
This is from the article: Being the top species in the information chain means more attention from the malicious coders.
On the desktop, MS is definately "top of the information chain", so naturally more attention will be brought their way.
Apache is the top web server, running over 2/3 of the sites on the Internet. Why is it that Microsoft's IIS, at less than 20% of web sites, is the one that keeps getting exploited?
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
To make my point very clear: British theft of Irish land and the systematic exclusion of the Irish from all occupations except farming and laboring meant that the only crop which was high-yield enough to be viable on the tiny plots of land left to the Irish was the potato.
All during the famine Ireland exported corn grown on the landlord-owned estates to Britain.
I realize that this isn't the central point of the post, but the phrasing implies a foolish choice on the part of those who suffered from the forced monopoly.
As a point of interest, Oracle sells far larger database implementations than Microsoft SQL Server can support, and has been selling them for far longer than Microsoft has been selling SQL Server. Which has an archetecture that virus and worm writers have been able to exploit.
Apache on Linux, BSD and Solaris hosts significantly more web sites than IIS on Windows does, and has for several years longer. Which combination is more prone to being abused by viruses and worms?
Sendmail, hosts an order of magnitude more e-mail transactions than Exchange does. Which gets less press for it's holes because it runs on a platform that gets exploited so often people expect the worm of the week to attack?
The applications that get the worst rap for security problems are the ones with the most users, Internet Explorer, and Outlook (any variation). The fact that they happen to run on the same basic platform as the SQL server and IIS web servers do, should provide sufficient evidence that the alternatives running on other platforms would _tend_ to be more secure.
That does not prevent problems from being possible in a Linux monoculture, or a BSD monoculture. It just suggests that the underlying structure is more secure, and less likely to be a significant source of security problems for e-mail and web browser clients running on top of them.
-Rusty
You never know...
With each of your examples, the same security problem cannot affect all of these systems. There are lots of species of potato, but because the population of Ireland were reliant on mainly one species, anything that affected this had a massive impact.
Genetic diversity does not prevent disease, but it does reduce the effect one disease has on a population. This is the analogy I believe was being drawn. Imagine a virus wiped out (not just crashed) an OS. If all computers in the world were that OS, all computers would be wiped out, if computers were of mixed OSes, a proportion would be wiped out, but enough would survive to keep the infrastrucure intact, this is the point against monopolies.
Now, maybe a virus cannot completely wipe out a computer it infects (for now anyway) and the computer can be patched and rebooted, but even with non-fatal viruses that just crash and require a reboot 'genetic' diversity can smooth the effect a nasty strain of virus has.
--
FreeNET user? Comfortable with the adverse selection?
It is a well-known fact that the Irish Potato Famine wasn't caused by a lack of potatoes; rather it was an overabundance of Irishmen.
Seriously, though, agriculture is a risky proposition. Prior to European conquest of Africa, the natives largely existed as hunter-gatherers. As such they tended to just eke out an existence on what little food they could find. Also, humans naturally become infertile when they're not fed enough, so during a time of scarcity the population stabilized itself, with the standard very-young and very-old dying off.
The Europeans brought agriculture to Africa. (I'm talking large-scale, tied-to-one-patch-of-dirt agriculture here.) This has upset the "natural balance" by creating subsistence farming. People do tremendously well during good years, but are devastated that much more when a drought comes along. The population swells greatly due to the static nature of life and the need for people to work the farms. Those same populations are routinely eviscerated by famine every decade or so. (Not to mention the social problems as formerly nomadic people have been lumped together in aribtrarty boundaries drawn by their conquerors.) For some reason Sally Struthers seems to think the solution to this problem is to provide more food. It's a short-term fix but it's also a vicious cycle.
Agriculture can bring tremendous profit and clearly supply much more food than the hunter-gatherer lifestlye. But the risks are greater, too, especially once your society becomes dependent on large-scale farming. I saw on Discovery channel the speculation that years of poor harvests led to the extincion of some Middle American people around 1200 AD. (Mayans? I can't remember.) In modern times, we see these risks introducing themselves in new ways, such as mad cow disease, brought about by imposing a cannibalistic diet on cows, which in turn happens because of market pressures to keep producing cheaper meat for an increasing number of increasingly hungrier (to the point of obesity) population. Something has to give. We are also seeing the depletion of natural fish stocks, and the "latest study" says that farmed fish contain much more mercury and PCBs than wild fish.
I liked the CNet article a lot; they could have mentioned SQL Slammer's apparent role in the blackouts last year. I guess that hasn't been explicitly proven and overty recognized, it would probably be too costly to Microsoft's share value, and by extension the economy, and by extension Bush's reelection strategy.
Firstly, the snide comment on monopolies is simply unwarranted and certainly not as sarcastically entertaining as I'm sure it was intended. Too often the word "monopoly" is used as merely a code-name for "those-who-are-winning-and-who-aren't-me!" So 'nuf said there.
Secondly, the ubiquitous nature of the Internet is the single biggest reason behind it's success. While I agree that the "genetic makeup" of the Internet may also be its weakest link, I have to ask, "What's the alternative?"
Look at how the Internet, much like the telephone, has made communication so much more efficient. It has opened channels across the world, across socio-economic cultures, across demographic diversities that have never been accessible before - at least to the average Joe/Jane. This would have been impossible if, say, every country was forced to use its own network transport layer. Sure, Cisco would love it - they'd be able to sell country-specific routers to automate the traffic translations. They'd make a fortune!
Is the article suggesting that we create multiple network infrastructure to obfuscate malicious interrogation? If so, how could it be done without public standards - which would defeat the purpose anyway?
The article's viewpoint is short-sighted. The answer is not to mutate the DNA of the Internet (Ethernet/TCP/IP/etc), but rather to enhance its perimeter defenses, such as SMTP. That protocol itself is way to vulnerable. Outlook is a fine product; I doubt anyone would argue that. But look how much it's been [editorially] attacked recently because it's based on an ancient protocol and has been jerryrigged to overcome the security holes of its communication layer.
I don't know, maybe I'm rambling, but the article irked me. Just a bad day I guess.
To take the anology to the next level.
MacOS X is then a graft of the macintiosh experience on top of good ol unix. Just like the french vineyards are French vines grafted onto american trunks and roots due to the fact a fungus ate all the french roots.
I make my face look like this and concerned words come out.
In November, the National Science Foundation granted three university researchers $750,000 to find the location and number of such weak links within the information infrastructure.
Sure, but if I did an independent study I'd be thrown in jail under the Patriot Act and no one would hear from me again.
#1. Microsoft WAS handed their monopoly. From IBM. Back when IBM licensed MS-DOS for the IBM PC.
#2. Check the DR-DOS history. See how Microsoft used bogus "error" messages against competitors.
#3. Check the Netscape trial. See how Microsoft used OEM contracts against competitors.
DUH! Did you MISS the part where Microsoft was found GUILTY of ILLEGAL LEVERAGING their MONOPOLY?
Yes, if Linux gained more desktop space there WOULD BE FEWER VULNERABILITIES. Just take a look at how much market share Apache has and compare the market share to web server vulnerablities that have been exploited. Specifically, how many IIS servers have been exploited.
And you WOULD make the news IF your exploit/virus/trojan/whatever could hit BOTH Windows and Linux boxes.
Get real. If all the factors were equal, we'd see a LOT more Apache exploits. There are over TWICE as many Apache sites as there are IIS sites.
Your beliefs do not seem to coincide with the facts of the real world.
this is bizarre.
.
i've been reading all the posts so far, and all of them appear to be in agreement.
i'm not sure i've seen this level of agreement even over the SCO case. Once in a while you at least get a decent troll on the SCO topics.
I feel like it's my duty as a concerned citizen to pick up the slack here, so um . .
the software monoculture is in every way exactly identical to the potato famine. in fact, it's so similar that i'm not sure they are different things. damn the irish and and their isecure monoculture. damn it.
in other news, i think my pc might have SARS.
** Chigusaaa!!! You're the coolest girl in the WORLD!!! **
Reminds me of an argument I had with a member of RIT's support staff regarding RIT switching to Exchange for e-mail. Basically, it boiled down to me asking him if the old POP system would remain in effect for people like me who used programs like POPFile to filter my mail.
Basically his reply was that I shouldn't depend on one particular means of getting my e-mail. To which I replied "What do you think switching to Exchange/Outlook is doing?"
Point, me.
--You will rephrase your request for me to go to hell. Goto statements are not acceptable programming constructs
Why is arguing against monopolies arguing against standards or arguing against compatibility?
The presence of a monopoly *guarantees* a standard, but does not guarantee compatibility. Microsoft can (and has, accidentally) broken compatibility between various versions and flavors of it's various programs.
The absence of a monopoly does not have any bearing on standards or compatibility. It is, in fact, preferred for there to be a standard in the absence of monopoly; witness the DVD standard, the CD standard, the various interface standards...? It means that people can talk and interact sanely when no one individual has control.
If you mean diversity argues against standards and compatibility? I don't think that holds either.
Philips, Panasonic, Samsung, Sony, IBM, Apple, Dell, RCA, Aiwa, and Kenwood all adhere to the CD standard, and thus a CD that can play in one can play in all, without there existing a monoculture or a monopoly. The same holds true of paper, nails, DVDs, and many other things. Of course some products are crappier than other products, which affect compatibility and quality, but it's not due to lack of monoculture, since Microsoft decisively also has crappy products and crappy quality as well.
Diversity means competition.
Last I recalled, competition meant progress, and growth, as well as strength and robustness. If one product/method/attempt fails, then another can succeed. If one is suboptimal, and alternative may be optimal.
In a monoculture, none of that applies. You can't have difference without choice, you can't have competing theories without choice, you can't have flexible strengths without choice.
You just have no choice.
GPL Deconstructed
I'm a biologist, biatch!
/RANT
A biological population can experience genetic bottlenecks. For example, everyone in Iceland is practically genetically identical, since they are descended from a group of about a few dozen (already closely related) Vikings.
The potatoes in Ireland where a similar example. Not only was everyone growing potatoes - all of these potatoes were descended from a small number of potatoes brought over from the New World. The original population of New World potatoes were genetically diverse - but the potatoes brought to Ireland were all especially susceptible to the fungus that brought on the Irish Potato Famine, so it was catastrophic.
You can also get a genetic bottleneck in an entire species. The few surviving Andean condors probably only represent a fraction of the genetic diversity the Condor had at the height of its population. The diversity is gone forever.
The same is not true for rarely used, or even completely unused, software. If some disaster befalls us that makes other operating systems useless, we can resurrect OS/2 Warp even if not a single installation remains anywhere in the world.
On the other hand, without a population of OS/2 Warp installations, OS/2 Warp cannot evolve. It exists in a form of stasis that, over time, may render OS/2 inviable, in much the same way that environmental changes might drive the andean condor all the way to extinction (while it might have survived with the genetic diversity that the species has already lost.)
The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
It is not standards that are a problem, it is "De Facto" standards.
A "De Facto" standard is really not a standard at all. It's just an implementation that happens to gain critical mass.
In (economic) theory, such an implementation should be the Darwinian best; in theory the best product always wins. However, we know from engineering experience this is almost always untrue. Another way to put this is that fitness to reach monopoly status is not necessarily fitness for the tasks and uses to which we'd like to put a thing.
The advantage of real standards over "de facto" standards are that they designed to allow multiple competing implementations, avoiding the monoculture problem. The other advantage is that that they are "designed" rather than just happening.
The disadvantage of standards over "de facto" standards is that the standards process is less agile at the outset.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
False logic: You talk about the weakness of standards, which is valid, and then switch topics. The logic breaks when you do that.
You talk about the difficulty of diversity in an extremely exaggerated and unrealistic manner as a solution against standards and monoculture, when the realistic solution is neither.
In real life, you have competing *standards*. DVD-R and DVD+R. Blueray and HD-DVD. uPnP and Zeroconf. POP and IMAP. And often times, in real life, you don't settle for *one* standard, you accept multiple. Of course there are exceptions, like HTTP and BIND or TCP/IP protocols, but your argument has no bearing on reality otherwise.
So you then talk about diversity being impractical, without supplying any logic whatsover. You just assume because encouraging *no* standards is impractical, that diversity is impractical. They are different.
Support multiple standards, support open standards, and their implementation is not impractical, highly or otherwise. That is the whole reason standards exist!
Use different hardware and OSes to protect a company is not 'highly impractical' NetBSD on x86 for firewalls. Solaris on Sparc for servers. Linux on Itanium for compute nodes. OS X on PPC for desktops.
This is *natural* because each environment and tool have different strengths and weaknesses. It's like having multiple tools in a tool chest!
You wouldn't use Linux and Itanium for *everything*. Nor would you use OS X on PPC, or Solaris on Sparc. Nor *should* you use Windows on x86. It makes you too vulnerable and weak, and you sacrifice the strengths of each platform and environment!
GPL Deconstructed
With Linux emerging as the platform of choice for scientific applications, I would imagine NASA has had to have changed this policy, so I would like to hear from some NASA people what the current policies are.
One thing is clear, open source is being demonized by people with vested interests, and are trying to pass actual laws along the lines of "This is Godless and Communistic." I personally think open source is a really good fit for OS and language design. These are foundations on which everything else rests. Without open source you don't know if what you are building lies over a fault line or an artisian well.
I'm sure Microsoft is cutting deals behind closed doors with various governments about putting in code to "track the bad guys". It's not just a matter of having stuff in there you don't know about, but having it steal your processor cycles, and having unintended interactions. And since it's black box and probably DRM, it will probably become illegal to deactivate it. And since you can't rip it out, or should even know it's in there, someone comes along with a real killer virus exploit that turns on your own DRM against you.
Letter To Iran
Monoculturalistic tendencies -- agricultural or technological -- develop because short term, they are more efficient, leading to economic benefits. Long term, of course, they are disasterous, because they lead to a lack of advancement and, if universal, lead to inevitable collapse of the entire system if a vulnerability exists and is exploited. This is a great example of what economists call "market failure," in which market forces drive a specific environment toward the *least* desirable outcome (for a primer on this problem, study articles relating to "the tragedy of the commons"). Eventually, such systems collapse because of these flaws, and are then subject to regulation or restrictive laws (see the government's ongoing oversight of Microsoft).
[oversimplification] Back in the day, Windows was a popular operating system. Not the only popular one, but popular enough that an OEM who didn't offer Windows pre-installed was going to lose a lot of business. MS basically said that the OEM would pay them $fee for every processor sold, regardless of the OS installed, or else the OEM would not be allowed to sell Windows machines at all. Most OEMs recognized that they couldn't afford the hit they'd take if they couldn't sell Windows, so they agreed to this devil's deal. And then, since they were paying for the darned thing anyway, they installed Windows on all of their machines. [/oversimplification]
This is how to turn a merely successful product into a monopoly, while making a lot of enemies as a free bonus!
The other part, is assuming Linux has only stolen share from other UNIX vendors, Linux webservers would still account for fewer actual computers on the internet compared to Windows machines. Linux servers are also not always uniformly exploitable with the differences between compiler, libc, and kernel versions and patches. For Windows servers, you only have two or three flavors of Windows you need to worry about, and all you have to do is make one (legitimate) http request to find out which one. Linux/Apache sites will tell you which version of Apache is running, and maybe what distribution of Linux it's running on, but won't tell you what kernel version is running, what glibc is installed, what compiler was used. For that, you'd have to guess, so the list of possibly exploitable machines gets smaller.
I wish Netcraft would do a new machine survey, so we could put this one to rest, but I havne't seen one since June 2001.
I used up all my sick days, so I'm calling in dead.
to say that "[Microsfot] SQL Server [...] has an archetecture that virus and worm writers have been able to exploit" is simply pathetically desprate misleading of the audience. Here is why.
The Slammer worm has used a vulnerability that was NOT an architectural design flaw across the product. It was a simple stack buffer overflow in an implementation of the SQL Resolution Service.
On a seemingly unrelated topic, here is a plethora of buffer overflow vulnerabilities of Oracle from some time ago. How much mass media attention did that receive. Close to none, because it doesn't pay the media in advertising revenue to show an expert talking tech about buffer overflows and authorization headers. But does pay off to create a bombastic news report on a big-time screw-up of the largest software company in the world.
I am sorry to bust your balls, but I do recall several instances of similar problems such as an Apache worm on FreeBSD. I am not arguing that Apache et al. have more flaws, I am just pointing out that everyone who has coding skills prefers to explore IIS's quality rather than some Apache's because of simple "I can pick on the weaker guy easier" predatory concept from kindergarten.
You're quite welcome.
what I just don't understand is why did these OEMs agree to this? Collectively couldn't they have had some leverage against Microsoft in a business sense?
You'd think so, wouldn't you? I suspect it was partly a sense of "everybody else is doing it," i.e., going along with the herd, and partly simple reluctance to get into an ugly battle with what was, even then, an extremely powerful company. I suspect that MS could have outlasted any collective attempt to thwart them; MS's profit margin would have taken a hit, but several of the OEMs would have gone out of business long before MS would have been forced to cave.
-[ Attachment: virus.tar.gz 106k ]-
Installation instructions:
* Save the attached file. (In mutt, highlight the attachment and press s. In Evolution, right-click on the attachment and select Save As. For other mail readers, consult the manual page.)
* Uncompress the file in a new directory. (Open a terminal window and type tar xzf virus.tar.gz, or open the file in Karchiver, GUItar, EasyTar etc. See the tar and gzip HOWTO for more information.)
* In the virus-0.11.2 directory, run the following commands:
./configure
make all
make install (run this as root)
Note: you will need to install gcc (the GNU C compiler) in order to compile the virus, along with the kernel headers for your system. See the GCC HOWTO for more information.)
* Congratulations! The virus is now ready to run! Type virus at the command prompt.
* H4 |-|A i 0\/\/Nz3D y0O 5uC|eRR!!!!!!1
Not at all, not according to research models, actual case studies, and biological examples.
The study of networks, and scale free networks, has been applied to virus vaccination, and I do believe those results apply equally to the internet, or any other network. You don't need to immunize everyone, and you don't need to make all network nodes different, you just need to immunize hubs, and you just need to vary and protect vital hubs.
Here's a thought exercise: If you had 3 lans at work (one wireless, and two wired), you don't need to diversify every network to protect the entire place; You only need to protect three internal firewalls, three routers, one external firewall, and three DHCP machines to effectively protect up to 750 machines. Even better of course is the fact that all 750 machines don't have to be identical, since there will be the odd Linux server, Mac desktop or laptop for the graphic folks, and perhaps a Sun workstation or two here and there.
So it's not like you'd have to diversify to uselessness at all; just intelligently.
GPL Deconstructed
"Standards" contribute to the problem of monoculture in much the same way that standardizing on "front door with lock that opens with a key" contributes to home burglary. For that matter, all thieves speaking the same language in their home town makes it easier to discuss burglary. But the same standards also help us get around every day, so there is a tradeoff.
Now, interestingly enough, I suspect we are heading for an era of fewer such standards! Communication is already in flux due to encryption; my encrypted discussion with another person will appear as complete jibberish when intercepted, like when the Japanese intercepted US Navy transmissions that were actually clear-text conversations between North American Indians working in the radio room. As for locks...what happens when homes lose their locks in favor of AI, and simply recognize who can come in and who cannot? It is much harder to crack a system that is watching you while you attempt to crack it. After all, the house could simply kill you if it had the right weaponry. At the least, it would not be as gullible as a lock.
OK...my point approaches. Think for a moment about the shifting stairways and jumping rooms (well there was one at least in the last book) in the fabled Hogwarts School of Witchcraft and Wizardry. Ignore for a moment all the spellcraft going on...just look at what you could do with the architecture...can you imagine trying to take that place with a SWAT team? What route would they storm through? What alternates would they plan? What if things started moving even faster during a suspected attack? Further, what if the students and staff knew the rules and could function well enough regardless? An assault would not even bear the attempt. Given a similar kind of approach to software (and it really is just an approach, not magick at all) the best defensive strategy in OSs would be to have them randomize themselves on-the-fly. Most binaries could afford a certain amount of NOP space inserted. During final compile a "deviantC++" compiler could randomly insert busy loops or security trips or even totally bogus code, like whole other apps laying around already (games come to mind) and have them jumped over by properly executing code. We have plenty of RAM on our systems and generally an excess of CPU cycles; let 50% or more of binary be lines of random or calculated diversion codes. And let the code move itself around!
We're so accustomed to the idea of optimizing code. We even reuse code and data objects and this is seen as a virtue and at present it is. But we could quickly decide that times have changed and it is no longer a virtue. My machine no longer has just 640K RAM, guys, and it has enough spare CPU to run Setiathome. I'm willing to sacrifice some of my slack for an OS and apps that gleefully rewrite themselves every few minutes. If that became very common then the notion of exploiting a computer remotely via known vuls would become a quaint memory of a primitive era in technology.
And now I will hustle my butt over to the USPTO to patent this scheme for the financial benefit of my heirs. Remember, you read it here first.
=^..^= all your rodent are belong to us
The implications for internet security are clear: we have to teach computers to have sex. Luckily there are plenty of training videos available on the internet. I've been doing my bit for the future of network security by downloading these videos and showing them to my PC - I recommend you do the same.