Dealing with Corporate FUD About Linux?

Lumpy asks: "After this morning's IT conference call, Linux was once again attacked here in the company by the upper management as 'a threat' to our company security. With articles, like the recent one from Information Week, fueling the Upper management with outdated information and half truths, how does an IT professional defend his position and educate upper managers to take those articles with a tiny grain of salt and trust their experts? Should we as professionals expect to be attacked for our decisions, even though Linux has prooven itself (time and time again), for over 5 years in our company? How do you deal with all of the baseless claims, that your superiors may read in the mainstream media?"

Comments

my advice

[kebes]

Be honest and matter-of-fact about it. Tell them the truth and hope that they are smart enough to realize how this will help the company.

You can say impressive things without lying. For instance, you can say (if it happens to be true): "I trust Linux for my home computer and all my important files." That alone means alot. Or you can say "if I were asked to place a $1000 bet on a computer OS that would run without getting infected with viruses or crashing for a whole year (while connected to the net!) I would place the bet on Linux instead of Windows."

Or, you can point out other projects/companies. For instance, according to top500.org, in 2005, 390 of the top 500 super-computers were using Linux. That means that 78% of super-computers run Linux. For instance, the world's most powerful computer is IBM Blue Gene, and it uses Linux for its I/O nodes (more info here). Also, Google's gigantic, powerful, and distributed search engine runs using over 60,000 Linux machines (more info here, here, and on Google's Research page). The fact that big, complicated, and highly successful operations use Linux shows what it can do. In the case of Google, it shows that they trust it to deliver the security they need.

You can urge them to get a second opinion. For instance, tell them to look over Secunia's report on Windows XP compared to Ubuntu 5.10.

Ultimately, however, all you can do is provide them with an honest assessment of Linux' strengths and weaknesses, and point out in what ways the media reports are wrong. If they respect your opinion, then they'll make the right choice. If they refuse to listen to reason, then there is nothing you can do. People who are more interested in media sound-bites than expert discussion are essentially impossible to convince of anything they don't already believe. Don't waste your time, and don't buy company stock.

Re:my advice

[Captain Sarcastic]

That's pretty much what I tried. The down side is when the boss asks, "OK, so if it's free, how do the people who build the distro make money?"

This isn't quite as pointy-haired as it might sound. With some of the monkeyshines that went on during the dot-com craze, with various companies bragging about their respective cash burn rates, many managers want to have an idea that the company who is providing the software will be around in X number of years.

Of course, another approach is to point out that, "Well, you know, MS-DOS worked just fine, and nobody had complained about the 80-by-25 character cell screen... so how come we aren't still using it? Because [at this point you will want to sigh - DON'T!] Windows 3.1 did things well that MS-DOS was only marginally capable of doing."

Of course, depending on the manager, they might look at you funny when you mention "MS-DOS", but bear up...

Re:my advice

[Saeed al-Sahaf]

Be honest and matter-of-fact about it. Tell them the truth and hope that they are smart enough to realize how this will help the company.

Hahhaaaa... ha haaa... ha ha ha haaaaa.... Hahaaaha... ha haaaaa... haaha haaa ha ha ha... OH MY! Hahaha... Haaa ha haaaaaa ha ha ha ha...

Re:my advice

[NoMoreNicksLeft]

It is pretty pointy-haired after all. You don't say "Home Depot" may go out of business in 5 years, and then use it as a reason that you will no longer be able to buy 2x4s.

It's open, anything can be compiled for the version you use, even if there are no versions. Lack of a upgrade treadmill means your apps are safe, even if you have to use 2.6.x linux for the next 20 years. Computers always used we that static, at least until stupid people started using them.

Open source. If push comes to shove, hire a person or two to fix what needs to be fixed, even if Torvalds is gored to death by angry reindeer. Or more likely, as yours wouldn't be the only company that needs this, the costs can be spread out among lots of different companies, probably in the form of a vendor appearing to take over.

It's commodity parts people. Ford might go out of business, but we're always going to be able to buy parts to fix the engine and transmission. Linux is like that too. Microsoft is the one to be worried about, not because they will somehow die next year (I pray every night though), but because if they somehow did, we'd *ALL* be shit out of luck.

That anyone can spin things in such a way contrary to reality is incredible.

Re:my advice

[Reality Master 101]

To be honest, you're not really thinking like a businessman, you're thinking like a programmer.

You don't say "Home Depot" may go out of business in 5 years, and then use it as a reason that you will no longer be able to buy 2x4s.

That's because Home Depot doesn't support the 2x4s for the foreseeable future. A better analogy is using them for their contractor services -- if anything goes wrong with your floor installation, you know Home Depot will be around to complain to.

Open source. If push comes to shove, hire a person or two to fix what needs to be fixed, even if Torvalds is gored to death by angry reindeer.

OSS advocates bring this up a lot, but what a business person hears when this is said is, "Yeah, they're admitting this business will gone in a couple years, and then I'll have to go into the software business, and I don't freaking WANT to be in the software business. I want to sell my widgets. I'll go with someone that won't force me to be in the operating system business."

Business types understand business, which comes down to money. If you want them to buy into something, then express how it either saves money, or produces more money. If you can't make that case, then maybe your argument isn't as strong as you think.

Re:my advice

[Angostura]

Let's face it, your managers gave you a perfectly correct answer when they said: ""We've got Windows, it's easier to stick with that."

It *is* always going to be easier to stick with what you have already.

It sounds to me as if the management are quite happy with what they've got, it works well enough and they have some annoying techie lobbying to change half their infrastructure software. Naturally they are going to be floundering around to find ways to get them out of their hair.

So, what are your reasons for wanting the company to switch to Linux, really? Are you a groupie, or are there solid reasons that will translate to the company's bottom line that you can put to them.

The security issue can be defused fairly easily - present some research into .mil adoption of Linux, for example.

But the security issue is probably just a smokescreen. You need some damn good reasons that you can set out cooly and rationally, and hopefully with a spreadsheet attached that will convince them of the advantages. "But it's free" probably won't cut it. Factor in third-party support costs, or in-house support for them so that it is NOT free. That'll make them take you more seriously.

Re:my advice

[grcumb]

"It *is* always going to be easier to stick with what you have already."

Damn, and I was going to mod this thread....

I think you're almost on target, but not quite. The easier decision is to stick with what you've got, and it's often much safer to avoid changing horses in mid-stream, but it is not always easier to stick with what you've got.

Case in point: A large government agency in the country where I live had incredible problems managing its Internet traffic, to the extent that sometimes messages would take over a day to cross from one department to the other. The delays were mostly due to a bottleneck caused by placing all the content, spam and traffic filtering on the same box. An acquaintance of mine quietly installed a(n experimental) Linux box on the network to take up some of the slack, and even though traffic problems were significantly reduced, the decision was made to spend USD 25,000 more to beef up the existing system, because 'That's what we know.'

In other words, a conservative viewpoint with regards to technology is good, but it can lead to situations where the well-trodden path isn't nearly as efficient as clearing a new one. As a wise man once said, 'A foolish consistency is the hobgoblin of little minds.'

Re:my advice

[sparkz]

I'm with you on this one, Saeed.

An interesting and useful thing a headhunter told me recently about looking for jobs - don't tell them what you know and what you're good at, tell them how much money you have saved, and how much income you have generated, in your current/previous jobs.

If you can come up with figures, saying that (eg) "We spend $x per annum on Anti-Virus software for Wintel; we could reduce that to $y by moving to Linux", or "We lose x hours per annum with unscheduled downtime on Wintel servers, costing $XX; we could reduce that to y hours with Linux servers, costing only $YY", you are more likely to get the attention of the beancounters.

A Ferrari is faster than a Volkswagen, but it costs more. It's down to the beancounters to sign-off the outlay. If you can show that you need a Ferrari's speed, and the benefits justify the cost, then they'll get the Ferrari. If you can show that the Volkswagen is quick enough, and is cheaper to buy/run, then they'll get the Volkswagen. Note that I've not gone into any details about the technical differences between the two manufacturers, but I've sold them on whichever option best suits the need.

In some cases, the Ferrari is the best buy; in others, the VW is the best buy.

If I'm in the high-end chauffeur business, then a Ferrari could win on the prestige alone; If I'm in the taxi business, the VW will win on TCO.

I know - I'm using the traditional car analogy, and I am failing to specify which option is Wintel and which is Linux; sorry for going against the mould, but it doesn't work that way in the CEO/CTO/CIO mindset. There is no "best"... we all know that a Ferrari is "bettter" than a VW, but is it better in this situation? If the objective is security, *nix is likely to beat Wintel; If the objective is massive user-acceptance and low training costs, Wintel could beat *nix.

Whether the criteria are right or wrong is a different issue; you could say that it doesn't matter that the users don't need retraining to use the *nix solution, because the Wintel solution is riddled with flaws; again, you can put that into CEO language by costing the (Wintel flaws) vs the (*nix (flaws + training)) to show that training on *nix, whilst an extra expense, is overall lower than the Wintel solution.

If you cannot show that, then you are not actually benefitting the company.

As a simple example, if the proposal is a stand-alone workstation with no external I/O devices, does it really matter (for security) if it runs Windows 95? The security argument doesn't hold up as strong in this case, as compared to a publically-accessible web server.

Think about what it costs, and what it delivers. Don't bother telling non-technical people about technical details - they don't understand, and it's not their place to understand (if they did understand, we'd be out of a job!). We have to translate the technical details into costs.

So if replacing a Wintel server with a Linux server is "better", you have to define "better", even (especially!) when it's obvious. If it's better because the Wintel server was a security issue, then work out the total cost for keeping the Wintel server secure, and the cost to the company if it was breached, along with the likelihood of that occuring. Do the same costings for your proposal, along with any additional costs incurred (new hardware, licenses, training, etc). If it turns out that there's a very low risk if the Wintel server is compromised (eg, it's not connected to the internal network, contains no sensitive data, and is blocked by the firewall from doing anything nasty), and there'd be a large cost in migrating to Linux (eg, retraining, HW changes, etc), then Wintel is the right answer, and all the "but Linux is better than Windows" arguments are ignored, and your credibility is reduced. That reduced credibility will carry on to the next time you propose something, like the boy who cried "Wolf!".

Cost. That's all the business people care about. If they can spend $10k on a

Re:my advice

[jc42]

A Ferrari is faster than a Volkswagen, but it costs more.

Not a good comparison re computer systems. If autos were like computers, the Ferrari would be both faster and cheaper than the VW (and would use less fuel). But most businessmen would still insist that the company fleet be VWs. In fact, they'd order a fleet of VW Golf convertibles to handle heavy shipping, and complain that they can't get a Golf with the capacity of a semi-trailer, while ignoring the suggestion that they talk to a truck dealer.

Aren't similes and metaphors fun?

Also on the conference call

[Profane MuthaFucka]

These were the other topics on the conference call

-Reminder to keep up with the latest COBOL and FORTRAN standards. Sharpen those programming skills.
-A notice that the Data General minicomputer is going to have its batches put onto the new IBM System 36.
-A work crew is going to be on floor 3 pulling Arcnet cable through the walls. Since there's asbestos in the walls, it may be disturbed. Hint: a lint brush can take asbestos right off your suit if some should land on you.

One word...

[Ustice]

Powerpoint. Like it or not, if upper-management sees it in Powerpoint then it is the God's truth.

Here's an easy way to sum it up...

[PFI_Optix]

Title from TFA: "A report warns of security vulnerabilities, raising the question of whether the open-source model can provide bullet-proof software"

What you might say: We get reports of security vulnerabilities on Microsoft products on a weekly basis, and there is unfortunately no such thing as bullet-proof software. Just recently Microsoft opted not to release an automatic update related to a virus before the virus went active, which would indicate that, contrary to what comes out of the PR department, Microsoft's commitment to security is not significant.

(I know the last sentence can be somewhat deceptive and there's more to the story, but if they're going to flap their lips when they're clueless, I doubt they'll catch it).

Wrap up with: No, Linux isn't perfect. There is a risk of vulnerability in every product. Microsoft, Apple, Unix, Linux, all of them carry some risk. It's our job to assess the risks and find the safest, most secure software that meets the company's productivity needs. It's what we do every day.

Fight fire with fire

[egarland]

Hold your ground and respectfully disagree. Then seek out reputable reports backing up your position. If you are right and you respectfully, calmly and clearly explain why to others you will almost always prevail.

Ignore them

[Vellmont]

If your upper management is still believing FUD about linux after all this time, there's nothing you're going to say to them to disuade them. These guys just like believing garbage. You say you've been using linux for 5 years in the business, so someone must believe in it. Just ignore what the upper management is saying since it doesn't sound like they're micro-managing things down to the level of "we aren't using linux, period". Continue to make the right decisions about what OS to use and justify them with good evidence. Don't worry about the personal opinions of upper management, since they shouldn't be making those technical level decisions, and they should know that.

On a personal note, at one job I had the CTO once said "we'll never use Linux in the Enterprise". About one year later we were running ten low end linux servers to replace a single, very poor performing AIX machine. The CTO ate his words and admited the mistake. A lot of these guys just like to talk big just so people think they know what they're talking about.

Believability of the media.

[AJWM]

Ask them if they've ever read a media story about something they knew a lot about. Ask them how much of it the media got right. Ask them why they think it would be any different with respect to IT.

Dealing with FUD

[db32]

Honestly I have never really had a problem with the FUD. There are so many articles and studies surrounding Linux that its fairly simple to dig up better studies, or facts showing why the biased ones are biased. Or you can simply do demonstrations. The tricky one for me is the more experienced/educated users. Windows admins that have been doing it for some years are much harder to convince of the merits of any *nix based OS. I know alot of /. folks don't like to think about it...but there really are some very sharp people that only use Windows. Most of the ones I run into latch on to one little gem of Windows knowledge and tout they are experts, but I have run into quite a few that really do understand the ins and outs of that operating system very well and can get it to impressive things through registry manipulations and other things.

Don't argue - just tell them to get the facts

[filesiteguy]

Of course, the facts won't be found in your average MS website. Simply add to your blog, journal or whatever. Also, I'd suggest start hosting "open source" and "Linux" seminars during lunch. I've done it. In the past year or so, weve gone from zero linux servers (out of several hundred) to twelve full-time production RHE servers. I know it is a small amount, but it is a start.

You ARE the linux expert.

[Spy der Mann]

The so-called analysts are NOT. Plus, there's the SELinux distribution promoted by the NSA, and it's as secure as Fort Knox. (well that's what you can say. And certainly your boss can't contradict the NSA, can he? ;-) )

Re:You ARE the linux expert.

[CaymanIslandCarpedie]

your boss can't contradict the NSA, can he?

Not on the phone, thats for sure! ;-)

Give them reasons to switch

[danmart]

Fight the FUD with benefits to the company for switching to linux. Here is a nice list of 25 reasons to use linux in your organization from the linux information project. They also have a list of success stories with links for companies that successfully switched to linux.

Go back to the old days.

[LWATCDR]

Nobody ever got fired for buying from IBM.
Simple as that IBM is pushing it. Linux is so not fringe anymore that anyone with a brain knows that it is a viable alternative for servers.
Companies that sell Linux distributions and offer support.
RedHat
Novell

Companies that sell servers with Linux installed.
IBM
Dell
SGI
Sun

Companies that use Linux
IBM
Google
Oracle

The idea that Linux is some kind of hippie hacker commune is so 90s...

There might be good reasons for your company not to use Linux but security really isn't one of them. If it is you should probably be running OpenVMS or OS/400. I dare someone to hack that :)

I tried hard at the windows shop i was at

[DaedalusHKX]

OLD NEWS
Enough time has passed, I can now freely say this out loud about my previous employer :)

Seems now, the fellow wanted me back, but was offering shitty pay, a few months ago that is.

Overall, man said he was switching to linux, and they got contracts, where I'd have to even have TS clearance. I'd love to help move an entire half of a state's government machines to Linux but sadly, I'm NEVER working for that outfit again. I fear being entangled by contracts far too much. I also have bills to pay, taking a pay cut to go back to all the stress is simply not worth it. He wanted me bad enough to offer a raise, but he still couldnt match or promise me guaranteed employment.

In regards to the topic at hand.

Let them know about security, let them also know that what you hear from M$ salesmen is not necessarily true. Also, remind them TWO KEY TOPICS.

TOPIC ONE
Closed Source vendors only reveal the holes they are FORCED to reveal because they've received publicity, via exploits or proof of concept exploits. Open Source projects see note1, on the other hand, publicize any holes and POSSIBLE holes and they usually have a MUCH faster turnaround for a patch and one that works, as we can all remember how well some of the M$ patches work.

note1 notice I said projects vs vendors, OSS ppl don't sell you anything, you CHOOSE to use it, and nobody takes your lunchmoney because of it.

TOPIC TWO
Remember that the biggest issue with windows is that it was a one user system, non network aware, and designed for absolute integration. You cannot remove a component easilly without breaking several (if not the entire system). Remind them also that the biggest issue with integration is that an attack only needs to target the lowest trusted component. This is why "userland" apps in linux behave differently than desktop apps in windows. Linux is, at heart, a Unix and so is BSD, and thus the apple os X, but that is another subject. Which means Linux is inherently a capable server, designed as such, and also designed to be modular, which means you can kill the front end, all of its subprocesses, and restart it, without rebooting the machine and killing any work any non front end users might have been doing via SSH or some other custom app you might have.

Since most users have to work as local machine administrator, as opposed to domain administrator, Windows automatically allows the user to install software and modify any non domain specific settings. As should be obvious to anyone, the moment a user runs a virus or trojan, or spyware and what have you, the local machine admin has been compromised. Windows XP, even after many "fixes" to the well known "Shatter Attack" see note2 STILL suffers from this vulnerability.

note2 a windowed program with even a guest account with NO privileges can hijack any root process running inside another window. To this day winlogon is a system/root process that still suffers from this problem, and you cannot disable it and STILL use windows, there are slipstreamed cds with NO graphics console, but they are pure servers, and have to be command or remote administered, no pretty front end for users.

In the end while Linux and BSD may have their flaws, at the very least they are more quickly fixed, the fixes are more than just a port block, like the Microsoft solution to Winnuke (which was a popular script kiddie port 139 icmp attack) or just plain lies (as is the case, apparently with the Shatter Attack. Granted for Shatter attacks to work, the user running the trojan must have guest access or better to the machine, or trick a legitimate user into running a compromised app but, heh, use your imagination. How often do foolhardy users run things they are not supposed to such look at porn, download "bonzi buddy" or "weatherbug" or any such crap? Spyware and trojans get around via users themselves since real hackers have better things to do, like write code for linux ;-)

~D

Define "free".

[jd]

Local phone calls are free, but AT&T and Bell aren't exactly poor.

Google is "free" to use as a search engine, but any company that can "report revenue of $1.919 billion" for a single quarter can probably afford to pay the staff. I wouldn't advise asking your CEO when he last made almost two billion in a four month timespan, though.

Linux is "free" (as in price) if you get no assurance and minimal support. If, on the other hand, you want EAL4-rated Linux (certified for commercially-sensitive and confidential information for Government use in Europe and the US) with 24-hour support, fine-tuning of hardware and software, etc, then you pay a bit more. Same software, different parameters.

I'd argue that there are examples even the dimmest PHB can understand - some have been around long enough to just be accepted, others are so stinking rich that the arguments self-evidently don't hold.

Learn Management Speak

[couch_warrior]

When selling Linux to corporate america, you just CAN'T do it using geek speak.
Managers use the same english words, but when you are a manager, your goal is to confuse and misdirect. NEVER take what a manager says literally, or try to respond to it logically. Managers make decisions based purely upon gut feeling and emotional reaction, then rationalize the decisions with vaguely related reports and misapplied studies.

Here are some simple translations:
        Management Speak(M) to Engineerish(E)
1M) I'm concerned about linux security
1E)I dont understand linux and it makes me feel insecure
2M) I've heard that linux has security problems
2E) A rival vendor's sales rep in an expensive suit told me linux has security problems, I need someone in a more expensive suit to tell me he was wrong
3M) No one supports linux
3E) If a linux server crashes there is no linux sales rep to yell at and blame it on
4M) I need more data
4E) I want the information reduced to powerpoint slides and presented by someone with a nice butt in tight fitting clothes(gender varies)
5M) Lets discuss the issues involved
5E) I'm afraid to make a decision until the whole industry stampedes in that direction
6M) Is this the right business decision?
6E) Can I be fired for doing this?