Slashdot Mirror
Microsoft, Monocultures, Security FUD & Other Fun
techiemac writes "Dan Geer, who has been mentioned on Slashdot before due to his warnings about Microsoft's "monoculture" has just been written up by AP for his warnings about the widespread use of Microsoft products and the serious security flaws that are being discovered. This story is quickly becomming big news (Yahoo is currently carrying it on their front page). For those who don't know, Dan Greer was fired from @Stake Inc for his criticism of Microsoft (they are a big client of @Stake Inc). " Somewhat related, there has been interesting reaction pieces on ORA and OSDN to a recent, some say ill-informed article run on DevX.
This is not the first time that A. Russell Jones has made controversial claims about Linux on DevX. At the end of august last year this story was run here on /. where he claimed that there should be a standard desktop for Linux.
You can't win Darth. If you mod me down, I shall become more powerful than you could possibly imagine
For those who don't know, Dan Greer was fired from @Stake Inc for his criticism of Microsoft
Dan Greer was not fired because he criticized Microsoft. He was fired because he published his opinions about the Microsoft monoculture without making it clear that those were his personal opinions and not those of @Stake.
Tarsnap: Online backups for the truly paranoid
The benefit of linux, bsd, and other non-microsoft OS's come from the variety of services run. Microsoft's OS's have to run many services and modules that other OS's can leave to the discretion of the operator. For instance, I can run an old version of linux with no services and its safe. I can run any number and variety of servers. Microsoft seems to have to do it one way and one way only with all these modules that have to be running.
One solution to the monoculture problem is multi-OS architectures in which a single process is executed on multiple independent codebases within each box.
On high-reliability systems (Space Shuttle & X-29 flight controls), multiple redundant subprocessors attempt to compute the same answer. If the subprocessors get different answers, the majority-rules and the system logs the exception. If each processor ran independent code, then exploits of any one codebase would be detected and disinfected. A multi-system with one exploited/infected codebase would continue running while ignoring the output of the infected subprocessor.
The system would still have some vulnerabilties. Simultaneous attack on a majority of the codebases might succeed in redefinig the majority to suit the malware. Also, codebase independence is very hard. More than likely several codebases might share the same fault (e.g. a buffer overrun bug). Attacks on the overseer/majority-rules system might also succeed. Finally, if the standard has an exploit (e.g., decrypting WiFi WEP), then all codebases implementing the standard are vulnerable.
The biggest downside is bloat and cost. But at least it would give people a reason to buy the latest greatest chips from Intel, AMD, IBM, etc.
Two wrongs don't make a right, but three lefts do.
What's certainly true is that there's a lot more to having good security than getting rid of the monoculture problem. Probably the most important thing is to care about security from the start...
Anyway, something the DoD and others have done for some time is to have triple barriers for certain things like firewalls. So instead of having the same firewall product and system all over the place, for each firewall, you have a series of 3 systems: one is a "hardware" firewall (an appliance basically), followed by two different firewall products running on two different architectures. This way a single flaw on one firewall or system will not comprimise overall security.
They also turn the IT infrastructure into compartments, each walled out with firewall groups. So you have one compartment for front-end servers, one for desktop users, one for your data, etc.
Yeah it adds to complexity, but this is what the paranoid types do to give themselves peace of mind.
It's Dan Geer.
-dave
The integration of the browser's ability to directly run code in Windows is the big hole that Microsoft has failed to fix. Integration of user software, such as Outlook or Office, directly to the operating system makes Windows the virtual equivalent of a petri dish for the internet and giving every 11 year old hacker the ability to cripple corporate networks globally.
I call bullshit. Give me one example.
I work as a consultant in Health IT and I'll give you 5 that I've found in my travels.
1. Pharmacy systems
2. Allergy interaction checking systems
3. Dietary system, wrong or delayed diets can kill a patient
4. Workstations in the ER that have access to critical applications and patient charts
5. Workstations that communicate with the ambulence and med chopper teams
"the Slammer worm knocked out 911 emergency telephone service in Bellevue, Washington."
a st er_security/index_np.html
http://www.salon.com/tech/feature/2003/12/16/bl
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
As I said in the news about the source code leakage, this is a false fear, the same one MS uses about the GPL "do not read GPL code or you'll never be able to write commercial code afterwards".
Copyright is _NOT_ patent. You can read copyrighted work and then write something similar by yourself. Copyright does not protect ideas, structures, algorithms or data formats. Copyright protectes the actual code - copy/pasting or recopying Windows code into Free Software would be disastrous. Reading Windows source code to understand protocols or formats and then writing your own Free implementation is not.
Of course, you're not allowed to have windows source code at first, and you can be sued for having it. Not for writing source code with the knowledge you gained for it; the same way that reverse engineering is fordbidden in US, but if you use reverse to write Samba or a XFree driver, Samba or the driver will be legal. You can be sued if it's proven you used reverse, but your code will not.
Yeah, without Microsoft products, Al Gore couldn't have invented the internet.
I see my mission now.. to reply to every post with this lame ass joke with information about how it is NOT TRUE. You've heard of snopes.com, the Urban Legends Reference Pages? Please read this article before posting this lie. The proper joke would be, "Al Gore says he took the initiative in creating the Internet!". While certainly a poor choice of words for Mr. Gore even in context of the interview, he did not claim to invent the Internet.
That goes for you too, moderators. This cliche is certainly not +5 Funny and you know it.
Speak truth to power.
Reverse engineering is NOT illegal, you just have to do it carefully. Various companies do it ALL THE TIME. You have one group decompile the program or take apart the device. They then write a specification for the device based on what they learned (bonus points if it's a school). This specification is given to a middle layer which then passes it on to the programming team. The programming team writes code to match the spec they got from the middle layer. The code is no different from what they would write if the spec was simply made from scratch, in fact, the programming team is never told that they're working from a reverse engineered spec. All you have to do is make sure that no one from the decompile team has contact with anyone from the programming team and you're good to go.
If absolutely nothing else, you can do the reverse engineering in the UK, where reverse engineering is explicitly allowed by law. The law even says that regardless of EULA terms, you can decompile software.
To the letter of the law, that's true. However, there's also something called plagiarism which DOES NOT have to be a "cut-n-paste," but can be a situation in which I looked at your work and implemented my version in much the same way. That is a potentially illegal breach of copyright in software just as it is in school with papers.
As such, the best way to protect oneself from copyright violations is complete ignorance of anything one might potentially infringe. As you say, an implementation is not copyrightable, so if you have never seen someone eles's implementation, you're clean. Basically, proving you've seen someone else's code can be damaging if you get sued for violation. You don't want that. And there's no reason to make the first critical part of their case for them.
Of course, this is what makes copyright different than patent, as you say. Ignorance does not protect one from patent violations (although it can with regard to penalties, which can be trebled given intent, I believe). Ignorance aka "cleanroom implementation" DOES give complete immunity with regard to potential copyright violations.