Slashdot Mirror
The Software Monoculture
balster neb writes "CNET News.com has a piece titled 'Seeds of Destruction' on monoculture in software and its effect on security. The article talks about similarities between software attacks such as last year's MSBlast, and agricultural catastrophes such as the Irish Potato Famine. Isn't this another good argument against monopolies?"
Isn't this another good argument against monopolies?"
In a very near sighted way, yes. But we are talking about mono-cultures here, which is a bit more broad than that. And, something that the linux crowd will want to be wary of.
With all the momentum behind linux right now, it could soon find itself faced with the same problems MS is faced with. While I don't doubt the ability of the linux folks to find better solutions than MS did, it is still a concern that people should be aware of.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
C|Net. C|Net run. C|Net run and bite the hand that feeds it. Bad C|Net, bad!
I watched C-beams glitter in the dark near the Tannhauser gate.
Luckily there's a remedy for both... Guinness
Isn't this another good argument against monopolies?
You could use the same argument against "standards." But you wouldn't. Yes, if everything were made completely different from everything else, sure, it would be harder to mount large scale attacks against anything. You would have to tailor your exploit to all of the different architectures you are interested in. The downside of course is that you will have thousands of people constantly working on different designs for the same wheel. Promoting diversity within even a company like Microsoft would likely accomplish the same thing, but once again, would be highly impractical.
With some competition Microsoft would be forced to write more secure software faster, so in a way monopoly is to blame.
Then again, AFAIK, Windows is not leading on the server side, but perhaps somebody can correct or confirm that ?
This is from the article: Being the top species in the information chain means more attention from the malicious coders.
On the desktop, MS is definately "top of the information chain", so naturally more attention will be brought their way.
Potato famine was not deliberate - it was caused by a microorganism. Both the hack and the monopoly are socially constructed. Science can fight the former, but not the latter.
Of course, it is obvious that no computer virus has caused loss of human life (yet). However, it is probably only a matter of time until a virus or computer bug causes a massive loss of human life. Due to our huge reliance on computers, and due to the fact that 90% of the computers out there are running the same OS (including some of those that control critical infrastructures like 911, nuclear reactors, etc), the frightening implication is that in the event of a loss of life, it could be much, much worse than the Irish Potato Famine.
I think that this concept also applies to BIND.
Most DNS servers run either ISC BIND, or a package based on BIND source. Although I am a hostmaster and respect BIND, I often wonder if this isn't one of the reasons that DNS is such a prime hacker target.
It seems clear that even with this example of an open-source program (although it's not GPL), groups prefer to avoid the cost of development at the expense of security (via the same monoculture argument). I've asked DNS appliance vendors this question (while they're trying to sell me on their product's security), and it's clear that they've never seriously considered the issue.
"People have brought over species that we didn't expect here, just like people have created viruses that Microsoft didn't expect to deal with"
The difference here is that we have US Customs doing its best to stop people bringing forigne species over. If US Customs did things like Microsoft, they would hand out culture dishes to exicute your Windows Script code on and implant your cultures into the environment w/o asking the end user.
It's funny how a company can leave holes in everything, let people get used to being insecure, then tout fixing the problems as an innovation.
Couldn't this same argument be applied to omnipresent standards and not just monopolies? If everyone uses TCP/IP and a security flaw is found in it, doesn't that amount to the same type of security threat?
:)
And yes I'm playing devil's advocate, but it's a slow morning
I went to the city because I wished to live without deliberation.
The article glossed over the heart of the matter...
...except for that brief mention. The English were the ones that killed the Irish, because they demanded payment in food, even when the Irish could not pay.
Most of it, however, was intended for export to England.
To liken the conditions of the software industry to the Irish Potato(e) famine is ridiculous. To whom or what is the industry beholden to? If we cannot produce code will we starve to death? Is someone occupying our cities and towns, threatening our lives if our code fails to compile? I'm not Irish, (though I do like potatoes), but please think again before you make analogies such as these.
Sig Hire!
Admittedly, this is off-topic. But I did my Ph.D. on the stuff and comments like that perturb me!
It is a common misconception that the disease known as late blight, caused by the Oomycete (Phytophthora infestans) "caused" the Irish potato famine. Yes it is true that the Irish were growing only a few varieties of potato (monoculture), but the REAL reason was the socio-economic structure put in place by those bastard English. Essentially, most of the Irish farmers (which was damn near everyone), "rented" the land from rich English landowners. This meant that they grew vegetables, wheat, etc. to pay for the rent, and grew potatoes for food because they stored well. Late blight reduces crop yield both before harvest (lost foliage) and after harvest (tuber rot), and by removing potatoes as a food source, the Irish began starving. The English did nothing to help the them during this time. In fact, the rental system stayed in place throughout the whole famine.
This is from the article: Being the top species in the information chain means more attention from the malicious coders.
On the desktop, MS is definately "top of the information chain", so naturally more attention will be brought their way.
Apache is the top web server, running over 2/3 of the sites on the Internet. Why is it that Microsoft's IIS, at less than 20% of web sites, is the one that keeps getting exploited?
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
As a point of interest, Oracle sells far larger database implementations than Microsoft SQL Server can support, and has been selling them for far longer than Microsoft has been selling SQL Server. Which has an archetecture that virus and worm writers have been able to exploit.
Apache on Linux, BSD and Solaris hosts significantly more web sites than IIS on Windows does, and has for several years longer. Which combination is more prone to being abused by viruses and worms?
Sendmail, hosts an order of magnitude more e-mail transactions than Exchange does. Which gets less press for it's holes because it runs on a platform that gets exploited so often people expect the worm of the week to attack?
The applications that get the worst rap for security problems are the ones with the most users, Internet Explorer, and Outlook (any variation). The fact that they happen to run on the same basic platform as the SQL server and IIS web servers do, should provide sufficient evidence that the alternatives running on other platforms would _tend_ to be more secure.
That does not prevent problems from being possible in a Linux monoculture, or a BSD monoculture. It just suggests that the underlying structure is more secure, and less likely to be a significant source of security problems for e-mail and web browser clients running on top of them.
-Rusty
You never know...
It is a well-known fact that the Irish Potato Famine wasn't caused by a lack of potatoes; rather it was an overabundance of Irishmen.
Seriously, though, agriculture is a risky proposition. Prior to European conquest of Africa, the natives largely existed as hunter-gatherers. As such they tended to just eke out an existence on what little food they could find. Also, humans naturally become infertile when they're not fed enough, so during a time of scarcity the population stabilized itself, with the standard very-young and very-old dying off.
The Europeans brought agriculture to Africa. (I'm talking large-scale, tied-to-one-patch-of-dirt agriculture here.) This has upset the "natural balance" by creating subsistence farming. People do tremendously well during good years, but are devastated that much more when a drought comes along. The population swells greatly due to the static nature of life and the need for people to work the farms. Those same populations are routinely eviscerated by famine every decade or so. (Not to mention the social problems as formerly nomadic people have been lumped together in aribtrarty boundaries drawn by their conquerors.) For some reason Sally Struthers seems to think the solution to this problem is to provide more food. It's a short-term fix but it's also a vicious cycle.
Agriculture can bring tremendous profit and clearly supply much more food than the hunter-gatherer lifestlye. But the risks are greater, too, especially once your society becomes dependent on large-scale farming. I saw on Discovery channel the speculation that years of poor harvests led to the extincion of some Middle American people around 1200 AD. (Mayans? I can't remember.) In modern times, we see these risks introducing themselves in new ways, such as mad cow disease, brought about by imposing a cannibalistic diet on cows, which in turn happens because of market pressures to keep producing cheaper meat for an increasing number of increasingly hungrier (to the point of obesity) population. Something has to give. We are also seeing the depletion of natural fish stocks, and the "latest study" says that farmed fish contain much more mercury and PCBs than wild fish.
I liked the CNet article a lot; they could have mentioned SQL Slammer's apparent role in the blackouts last year. I guess that hasn't been explicitly proven and overty recognized, it would probably be too costly to Microsoft's share value, and by extension the economy, and by extension Bush's reelection strategy.
Firstly, the snide comment on monopolies is simply unwarranted and certainly not as sarcastically entertaining as I'm sure it was intended. Too often the word "monopoly" is used as merely a code-name for "those-who-are-winning-and-who-aren't-me!" So 'nuf said there.
Secondly, the ubiquitous nature of the Internet is the single biggest reason behind it's success. While I agree that the "genetic makeup" of the Internet may also be its weakest link, I have to ask, "What's the alternative?"
Look at how the Internet, much like the telephone, has made communication so much more efficient. It has opened channels across the world, across socio-economic cultures, across demographic diversities that have never been accessible before - at least to the average Joe/Jane. This would have been impossible if, say, every country was forced to use its own network transport layer. Sure, Cisco would love it - they'd be able to sell country-specific routers to automate the traffic translations. They'd make a fortune!
Is the article suggesting that we create multiple network infrastructure to obfuscate malicious interrogation? If so, how could it be done without public standards - which would defeat the purpose anyway?
The article's viewpoint is short-sighted. The answer is not to mutate the DNA of the Internet (Ethernet/TCP/IP/etc), but rather to enhance its perimeter defenses, such as SMTP. That protocol itself is way to vulnerable. Outlook is a fine product; I doubt anyone would argue that. But look how much it's been [editorially] attacked recently because it's based on an ancient protocol and has been jerryrigged to overcome the security holes of its communication layer.
I don't know, maybe I'm rambling, but the article irked me. Just a bad day I guess.
To take the anology to the next level.
MacOS X is then a graft of the macintiosh experience on top of good ol unix. Just like the french vineyards are French vines grafted onto american trunks and roots due to the fact a fungus ate all the french roots.
I make my face look like this and concerned words come out.
Why is arguing against monopolies arguing against standards or arguing against compatibility?
The presence of a monopoly *guarantees* a standard, but does not guarantee compatibility. Microsoft can (and has, accidentally) broken compatibility between various versions and flavors of it's various programs.
The absence of a monopoly does not have any bearing on standards or compatibility. It is, in fact, preferred for there to be a standard in the absence of monopoly; witness the DVD standard, the CD standard, the various interface standards...? It means that people can talk and interact sanely when no one individual has control.
If you mean diversity argues against standards and compatibility? I don't think that holds either.
Philips, Panasonic, Samsung, Sony, IBM, Apple, Dell, RCA, Aiwa, and Kenwood all adhere to the CD standard, and thus a CD that can play in one can play in all, without there existing a monoculture or a monopoly. The same holds true of paper, nails, DVDs, and many other things. Of course some products are crappier than other products, which affect compatibility and quality, but it's not due to lack of monoculture, since Microsoft decisively also has crappy products and crappy quality as well.
Diversity means competition.
Last I recalled, competition meant progress, and growth, as well as strength and robustness. If one product/method/attempt fails, then another can succeed. If one is suboptimal, and alternative may be optimal.
In a monoculture, none of that applies. You can't have difference without choice, you can't have competing theories without choice, you can't have flexible strengths without choice.
You just have no choice.
GPL Deconstructed
I'm a biologist, biatch!
/RANT
A biological population can experience genetic bottlenecks. For example, everyone in Iceland is practically genetically identical, since they are descended from a group of about a few dozen (already closely related) Vikings.
The potatoes in Ireland where a similar example. Not only was everyone growing potatoes - all of these potatoes were descended from a small number of potatoes brought over from the New World. The original population of New World potatoes were genetically diverse - but the potatoes brought to Ireland were all especially susceptible to the fungus that brought on the Irish Potato Famine, so it was catastrophic.
You can also get a genetic bottleneck in an entire species. The few surviving Andean condors probably only represent a fraction of the genetic diversity the Condor had at the height of its population. The diversity is gone forever.
The same is not true for rarely used, or even completely unused, software. If some disaster befalls us that makes other operating systems useless, we can resurrect OS/2 Warp even if not a single installation remains anywhere in the world.
On the other hand, without a population of OS/2 Warp installations, OS/2 Warp cannot evolve. It exists in a form of stasis that, over time, may render OS/2 inviable, in much the same way that environmental changes might drive the andean condor all the way to extinction (while it might have survived with the genetic diversity that the species has already lost.)
The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
It is not standards that are a problem, it is "De Facto" standards.
A "De Facto" standard is really not a standard at all. It's just an implementation that happens to gain critical mass.
In (economic) theory, such an implementation should be the Darwinian best; in theory the best product always wins. However, we know from engineering experience this is almost always untrue. Another way to put this is that fitness to reach monopoly status is not necessarily fitness for the tasks and uses to which we'd like to put a thing.
The advantage of real standards over "de facto" standards are that they designed to allow multiple competing implementations, avoiding the monoculture problem. The other advantage is that that they are "designed" rather than just happening.
The disadvantage of standards over "de facto" standards is that the standards process is less agile at the outset.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
[oversimplification] Back in the day, Windows was a popular operating system. Not the only popular one, but popular enough that an OEM who didn't offer Windows pre-installed was going to lose a lot of business. MS basically said that the OEM would pay them $fee for every processor sold, regardless of the OS installed, or else the OEM would not be allowed to sell Windows machines at all. Most OEMs recognized that they couldn't afford the hit they'd take if they couldn't sell Windows, so they agreed to this devil's deal. And then, since they were paying for the darned thing anyway, they installed Windows on all of their machines. [/oversimplification]
This is how to turn a merely successful product into a monopoly, while making a lot of enemies as a free bonus!
The other part, is assuming Linux has only stolen share from other UNIX vendors, Linux webservers would still account for fewer actual computers on the internet compared to Windows machines. Linux servers are also not always uniformly exploitable with the differences between compiler, libc, and kernel versions and patches. For Windows servers, you only have two or three flavors of Windows you need to worry about, and all you have to do is make one (legitimate) http request to find out which one. Linux/Apache sites will tell you which version of Apache is running, and maybe what distribution of Linux it's running on, but won't tell you what kernel version is running, what glibc is installed, what compiler was used. For that, you'd have to guess, so the list of possibly exploitable machines gets smaller.
I wish Netcraft would do a new machine survey, so we could put this one to rest, but I havne't seen one since June 2001.
I used up all my sick days, so I'm calling in dead.
1. DOS does not equal windows
Check back to the 1995 Consent Decree. DOS won out initially fair and square (DOS cost $100, CP/M cost $200, so people chose DOS). But when Windows came out, Microsoft's licensing agreements stated that if you wanted to include DOS or Windows on any computer you sold, you would have to pay Microsoft for both products for every system you sold, *even if it didn't include MS software*. That is the sole reason that Windows ever became popular. You would occasionally see computers running GEOS or OS/2 in stores, but not very many because of the need to pay for two OS's. The government eventually investigated Microsoft for illegal leverage of a monopoly. The result was the 1995 Consent Decree, but by then the damage had been done and the government action was too little, too late.
2. MacOS, UNIX, AmigaOS, BeOS, Solaris, etc. Operating systems have competed, and lost (so far). Is it because Microsoft practices illegal monopolistic crap? That certainly is likely to be a contributing factor. But so do other businesses that fail.
See above. Bad business decisions were factors too, but by far the largest factor was Microsoft's illegal leverage of their monopoly.
As to DR-DOS and the bogus Microsoft error messages, here's the basic story. After DR-DOS was good enough to compete with MS-DOS, Microsoft began making their products try detecting DR-DOS. If they detected it, the program would print a random error message and return you to a DOS prompt. The most notable program to do this was Windows 3.1. I'm not sure if this is correct, but I seem to recall reading in a magazine that the code to check for DR-DOS was encrypted, and that Microsoft would attempt to disable any debugger that might be running before decrypting the code, making it very difficult to figure out what the code was doing.
Regarding the Netscape trial, Microsoft's contracts with OEMs prevented them from loading Netscape onto computers they sold.
-[ Attachment: virus.tar.gz 106k ]-
Installation instructions:
* Save the attached file. (In mutt, highlight the attachment and press s. In Evolution, right-click on the attachment and select Save As. For other mail readers, consult the manual page.)
* Uncompress the file in a new directory. (Open a terminal window and type tar xzf virus.tar.gz, or open the file in Karchiver, GUItar, EasyTar etc. See the tar and gzip HOWTO for more information.)
* In the virus-0.11.2 directory, run the following commands:
./configure
make all
make install (run this as root)
Note: you will need to install gcc (the GNU C compiler) in order to compile the virus, along with the kernel headers for your system. See the GCC HOWTO for more information.)
* Congratulations! The virus is now ready to run! Type virus at the command prompt.
* H4 |-|A i 0\/\/Nz3D y0O 5uC|eRR!!!!!!1
The implications for internet security are clear: we have to teach computers to have sex. Luckily there are plenty of training videos available on the internet. I've been doing my bit for the future of network security by downloading these videos and showing them to my PC - I recommend you do the same.