How To Argue That Open Source Software Is Secure?

Smidge207 writes "Lately there has been a huge push by Certified Microsoft Professionals and their companies to call (potential) clients and warn them of the dangers of open source. This week I received calls from four different customers saying that they were warned that they are dangerously insecure because they run open source operating systems or software, because 'anyone can read the code and hack you with ease.' Other colleagues in the area also have noticed that three local Microsoft Partners have been trying to strike fear in the minds of companies that respond, 'Yes, we use open source or Linux' when the sales call comes in. I know this is simply a sales tactic by these companies, but how do I fix the damage these tactics cause? I have several customers who now want more than my word about the security of systems that have worked for them flawlessly for 5-6 years, with minimal expense outside of upgrades and patching for security. Does anyone have a good plan or sources of reliable information that can be used to inform the customer?"

Comments

That's a new low

[Daishiman]

Really, that's a new low for Microsoft lackeys. Being ISV's you'd expect them to be a bit more honest and pragmatic. Turns out they're just like their evil overlords.

Re:That's a new low

[Ethanol-fueled]

Eh. Two of the three ads served on this page since I first viewed it are Microsoft ads.

Never understood why people didn't like KDawson, but approving articles from known professional trolls with links to Twitter(not to mention the fact that other Slashdot admins post Twitter's articles) smells funnny. There's always a market in people you love to hate ;)

Re:That's a new low

[squidinkcalligraphy]

I wonder if that's because suddenly companies are trying to save money by moving to open source software? And this is a pre-emptive response by the people who have the most to lose?

turn tables

[TheSHAD0W]

How about telling them that Microsoft has taken code from open-source operating systems like BSD (true) and people have discovered bugs which had been fixed long ago in the open-source versions, and missed in the closed-source versions BECAUSE they were closed-source?

Re:turn tables

[man_of_mr_e]

Actually, it's not true.

You should read this article http://www.kuro5hin.org/?op=displaystory;sid=2001/6/19/05641/7357

Microsoft did use code from BSD, but it was licensed from UCB (via Spider Software) and predates the first open source versions of BSD's network stack, as evidenced by the copyright dates. And Windows Network stack is not based on it anymore.

Re:turn tables

[Pav]

I'm not sure "counter-spin" is the right tactic. Sure, you can offer some counter arguments, but personally I'd suggest the customer do an Internet search with something like "windows linux security". Microsoft has advertising muscle, editorial influence and sales teams... but despite this many people in-the-know choose open source specifically for security - an Internet search should make that clear. It will also demonstrate your integrity.

Re:turn tables

[TubeSteak]

How about telling them that Microsoft has taken code from open-source operating systems like BSD (true) and people have discovered bugs which had been fixed long ago in the open-source versions, and missed in the closed-source versions BECAUSE they were closed-source?

What the argument really boils down to is this:
Open Source - You/I/We/The Community can audit the code and fix problems now
Closed Source - Wait for the vendor (MS) to release a patch (once a month) if the vendor thinks it is worth patching

Re:turn tables

[Roger W Moore]

Ah, but how do we know it is not true? Since it is closed source we can never be completely certain and just have to take someone's word for it....which is really the whole point of the argument for OS.

Re:turn tables

[sumdumass]

Many small shops like to think they are more important then they are. I don't know how many times I have had to switch to some other software because a partner found that a larger firm used something else just to find it willfully inadequate compared to what was being used before the 20 grand switch. This is true for law firms, Tax shops and accounting shops, insurance agencies and almost everything else I have worked with. They seem to think that using the software they use will give them the edge to be as profitable as they are.

The counter spin tactics that would probably be beneficial is something along the lines of Sun, IBM, Novel, and several other big Iron shops use OSS. Even the smaller shops mid level shops that use DB back ends use OSS like pervasive SQL, Oracle, MySQL, and so on. How is it that the large shops who spend the money for the Sun or Novel or IBM or Oracle servers that cost probably more then what they paid for IT in the last year don't have security concerns with Open-Source Software but a Microsoft rep who is attempting to sell you software and lock your into their specific version/line can convince you that it is unsafe?

I would still attempt to back that up with other facts concerning OSS usage like by Cisco, Zycell, and several other routing companies who provide industry leading security and routing products. I mean if the routers are configures correctly and capable of acting as a firewall, it's the first line of defense. And if their OSS servers and software aren't directly connected to the internet, then where is the worry because in order to hack them, you would need to bypass the routers or gain physical access to them.

Re:turn tables

[Hooya]

If I were in that situation, I'd cite:

Cisco - ASA - Based on Linux
A10 - Loadbalancer/Firewall - Has Linux
Coyote Point - Loadbalancer - *BSD

And I'm sure several others.

If open source is good enough for Cisco to use for Firewalls that you'd need to secure your network, you'd think it's secure enough for the common man?

Any references where Windows was used for firewalls to secure the rest of the network?

I'm not sure if I'd take the combative approach but the point is that even if you went 'proprietary' and wiped out all open source servers, put windows on 'em - what would you put in front to firewall them? Another windows box? Or a Cisco ASA? So, did you really get rid of Open Source?

Re:turn tables

[the_womble]

It does not invalidate the point that the bugs were fixed in the open source versions and not in the MS version.

Other points to make:
1) Open = open to independent security audits. I think the Open BSD audit covers other people's code, so there is at least one example of it happening.
2) MS code has been leaked, and other code is deliberately shared with selected people. The bad guys probably have ways of getting hold of a lot of MS source code; whereas open source is available to you as well.
3) Track record. Not just Windows vs Linux, but IIS vs Apache etc.

Re:turn tables

[JWSmythe]

    An obvious one would be....

    "So, why do my non-public facing workstations constantly get viruses; my public facing Windows machines get exploited; yet my non-public facing Linux machines have no security problems; and my public facing Linux machines have never been exploited. They're all patched in accordance to the distribution guidelines."

    To appease the C-level folks, good documentation and quantification of the instances of security problems will make them happy.

    "We spent 5,000 man hours last year cleaning up exploit problems on properly patched Windows machines, yet we spent 20 hours investigating potential security problems on the open source machines and found them to be simply user error. Per machine they equate to 50 hours per Windows machine, and 0.01 hours per open source machine.

    In the last fiscal year, the TCO per machine on average, including cost of licenses, upgrade licenses, maintenance, and required security response for Windows machine was $800, while it was only $2.50 per open source machine. Hardware costs are not accounted into this, as the open source users are happy with the superior performance achieved versus the Microsoft based counterparts."

    Those numbers are just yanked out of thin air. Fill them in with the appropriate numbers for your network.

    If you can provide a brief yet complete statement like that, it won't matter what the sales minions say, you have factual data to back up your side. Scare tactics aren't as good as hard evidence. Well, except in court. Juries will believe anything if you wrap it up right.

Re:turn tables

[isorox]

Have you personally gone through the millions of lines of code in the Linux kernel to make sure that there isn't a backdoor? No? Then you're just taking someones word for it.

I haven't gone through the designs of a 747 either, and I haven't checked that the plane I'm about to board matches those designs. Even if I did, I wouldn't know what I'm looking for.

Fortunatly I trust that many independent people have been through those designs, and I trust the the qualified pilot has checked the plane out. More importantly, I trust that if the pilot is wrong, he suffers the same consequences I do.

Re:turn tables

[damburger]

In other words "Science - it works bitches"

As a physicist I am quite comfortable arguing the merits of evolution over creationism because I understand the strength of the process that favored the former over the latter. I don't have to see every single experiment performed in that area of research; I know dodgy research would've been (and has been) spotted.

how to argue that closed source is secure?

[bugi]

Open source is verifiable. Closed source is not.

Open source is verified, by many people, who discuss it in public. Closed source is not.

Re:how to argue that closed source is secure?

[cptdondo]

Did you ever monitor a project maillist? I'm constantly amazed at the nit-picky details that must be addressed before a patch is accepted. The submitter is held to an incredibly high standard.

I've worked in a commercial outfit, and if it worked, we shipped.

The quality control that a patch goes through, the ruthless dissection of programming style, usefulness, and clarity is something I've never seen in a commercial environment.

Re:how to argue that closed source is secure?

[rtfa-troll]

You seem to be a bit trolling, but you're an interesting troll, so lets go ahead :-)

It's very clear that different parts of open source have different standards of review. Whilst the Debian SSL situation is bad to terrible (I had just installed my home web server on Debian for an experiment; I was not pleased!), however it was discovered only due to the source being open. It's known that actual deliberate attempts to put back doors into the Linux Kernel have been thwarted. By choosing properly supported stable well audited parts of Linux there can really be a benefit. Personally I would strongly recomment RedHat. I was impressed that ther distribution wasn't actually compromised during the recent attacks on their signing infrastructure. It showed a real commitment to defense in depth to a level which surprised me.

Even the compiler attack you mention has now been countered (see also Schneier's interesting discussion of double compilation). I'm surprised you don't mention it when discussing a 1980's paper (which is why I wonder about the trolling bit). This means that it really is possible to leverage the benefit of "open source" for better security.

I'd take a slightly different moral; you should have layered trust. More for Linux; less for Apache; little for Open Office very little for random Linux games; none for closed source software. Use SELinux to partition your software (if your OS doesn't support SELinux then change it :-). If you care about security then insist on source and actually pay for some parts of source level audits.

A key "talking point" in this discussion would be why the Chinese insisted on having Windows source whilst commercial customers don't get it. Discuss whether your company has any Chinese competitors. Seriously consider switching off a system which gives those competitors a benefit you don't have (sometimes Chinese competitors seem indistinguishable from the government). If they insist on source then so should you.

Go to the bug logs for your software

[wtansill]

Show them how quickly discovered vulnerabilities are patched and how much discussion each bug receives. Ask the competitors to provide access to their discussion groups and bug logs. Compare. Contrast.

Re:Go to the bug logs for your software

[grcumb]

Show them how quickly discovered vulnerabilities are patched and how much discussion each bug receives. Ask the competitors to provide access to their discussion groups and bug logs. Compare. Contrast.

I'd put the emphasis on 'Compare'.

Print two lists. One containing all the critical vulnerabilities that have been reported in the last twelve months, along with numbers of exploited machines worlwide. The other will be a list of how many of these vulnerabilities have affected your supported machines.

If you've been doing your job well, the second list will be a blank page.

Of course...

[QuietLagoon]

they are dangerously insecure because they run open source operating systems or software, because 'anyone can read the code and hack you with ease.'

.
Of course, Microsoft Windows has proven that closed-source, proprietary software is secure. Ha-ha-ha-ha-ha-ha-ha-...

Microsoft is desperate to fight the lower cost of Open Source in these troubled economic times. Microsoft is having trouble justifying their economic exstence. So, instead of fighting on a cost basis, Microsoft is tryng to shift the battleground to a different arena --- one of security. Unfortunately, in the arena of security, Microsoft loses big.

Re:Of course...

[joocemann]

I don't think they are aiming to battle on the concept of 'security' but rather the easily exploitable human characteristics of fear and susceptibility. This is, to a knowledgeable person, an obvious attempt at spreading rumor/mudslinging to create a widescale negative buzz among the weeble peoples.

I also heard Obama is a Muslim?

*sigh*

[faedle]

If it's good enough for the NSA, it's good enough for you.

Think of it like an academic report

[TheSpoom]

Open source software is like any report in an academic journal.

While a little more informal, it has usually been similarly vetted by competent experts in the field before it's been allowed into the wild, especially in large projects.

Therefore, it's much more reliable than closed source software like Windows, for which you have to take Microsoft's word alone, as opposed to the reviews of several top developers in their fields who approved the commits in the first place.

Plus, tell them to examine their sources; the bias is obvious.

Not sure about customers, but...

[Lord Kano]

I had a professor say that kind of thing in class once. He said that "Linux will never be as secure as Windows because it's open source. Anyone can see the source code and use it to hack your computers."

It was completely involuntary on my part, but I let out a loud, and I do mean LOUD, "WHAT?".

He turned and looked at me, I said "I'm sorry but that's not correct. Look at OpenBSD, it's open source too and there has been exactly one remote exploit in a default install in the past six years. Microsoft wishes that Windows had that kind of track record." He stammered and stuttered and then moved on with his lecture.

LK

Re:Point Out Their Records

[ColdWetDog]

I'd just suggest rolling on the floor in hysterical laughter, just sobbing until your chest hurts whenever anybody says that to your face. Maybe after a couple of times, people will get the idea.

For anybody too dense to get it, show them the You Tube clips of Gates & Seinfeld.

Antivirus

[lena_10326]

2 points.

1. The fact that an antivirus program combined with a firewall is mandatory for any windows box (closed source) to remain virus free for longer than 20 seconds connected to the internet, whereas linux (open source) requires no such antivirus program, is experiential proof that linux is more secure.
2. Many firewall/routers run linux. If linux is good enough to protect your windows machines from intrusion, then a logical person would conclude an open source operating system such as linux is more secure.

This is easy

[garada]

Tell your customers that Microsoft is trying to sell them stuff. It has nothing to do with open source vs.closed source, just money.

Windows is Open source on Balckhat sites already

[goombah99]

Since 2004 The source code for windows is available for $20 on blackhat websites. SO it's avaialble for scrutiny by a very select few since possession is criminal.

Also it's worth noting that even for-profit companies like Sun and Apple often open source their code (e.g. apple's Darwin Kernel and openSolaris). And those companies have much better security reputations than Microsoft.

Re:No Software is More (or Less) Secure Due to Sou

[oGMo]

Whether or not the source code is available does not make software less secure.

Disagree. Security is not a static rating but a process; part of that process is fixing found problems. Guess which is easier to fix: the stuff you've got the source to, or the stuff you have to wait 6 months before the vendor acknowledges as flawed.

Fight back

[missing000]

Don't discuss the attack, that's just playing into the hand they gave you.

What I would point out is the monthly patch cycle you buy into with MS.

Any vendor worth using releases patches as vulnerabilities are discovered, keeping software safe. MS doesn't do this, and claims it as a feature.

The rest of the world releases patches as soon as someone with eyes sees a flaw. This is a clear advantage and negates all the FUD you are seeing.

Re:Fight back

[Malc]

Microsoft have a shocking history of sitting on a known vulnerability for years, but saying that releasing monthly instead of immediately is a problem is to spread your own FUD. They used to release as they patched, but that was even more problematic and so they responded to their customer's needs. In most cases, exploits don't appear in the wild until Microsoft release a patch for it.

Re:Fight back

[rtfa-troll]

Don't discuss the attack, that's just playing into the hand they gave you.

Well; if nobody's discussing it, then no. If they do discuss it you should definitely be ready to discuss their specific points with the people who have heard them. Preparing in advance so those points seem silly at the time they are told is also good.

What I would point out is the monthly patch cycle you buy into with MS.

It should be remembered that whilst this doesn't work properly, it was introduced partly at the demand of corporate customers. Some of them still like the idea and so it's maybe not the strongest point. What is worth discussing.

• Linux has SELinux / iptables and other second level defenses which make many vulnerabilities easier to control
• Linux patch management is integrated for both standard applications and OS making the likelyhood of an unpatched system much less than on Windows;
• Linux patch management is flexible, allowing automated patching of systems on a self imposed schedule; e.g. desktops automatically, servers at night after warning.

If you do want to discuss Microsoft's patch cycle, discuss it in the light of specific problems it causes. You should know of a specific "zero day" unpatched vulnerability which should obviously be patched and hasn't been.

Re:Fight back

[LurkerXXX]

They claim it's a feature, because it's a feature their large corporate customers asked for. You aren't likely to get bonus points for going against that one.

Microsoft used to release patches as soon as they were discovered. They worked that way for decades. A hole was found, a fix was built, tested, and released. Patches would come out almost daily sometimes. The big companies didn't like that because besides the plethora of standard 3rd party apps that MS and others tested the patch against, they also all had tons of custom in-house software that each patch had to be tested against. When patches were coming out frequently (sometimes daily as I said), their testing teams would only get a start on one patch, when they'd have to begin the testing process again with another patch. Things stacked up in the queues and they blew a lot of money on large testing teams. They requesting less frequent, but scheduled patch releases from MS so that they could set a regular manageable cycle for testing. It's certainly a security risk, but the pointy-hairs and bean counters at the large corps thought it was a good risk for the dollar savings.

By attacking MS's patch cycle, you are attacking the pointy-hairs and bean counters at those companies you are trying convince open-source is good. Probably not the best approach.

Re:Fight back

[jd]

Oh, there's actually a much better ways to do things. Windows 2000 had its NIST certification withdrawn due to insecurities (you don't have to say those were fixed and it was revalidated).

Whereas Linux is certified at around EAL5 - one of the highest Government ratings for commercial software and above the standards needed for classified work. Linux also has security code by the NSA. They can't endorse it, being the Government and all, but would the NSA spend money on software they can't use?

Even NASA and the Department of Energy have spent millions on Linux systems and putting some of their most essential work in that environment. If it's good enough to secure our nation against terror, doesn't it have to be better than the system you're patching monthly and still getting break-ins on?

Re:Fight back

[HungryHobo]

Well there's an old quote you could pull out.

If I take a letter, lock it in a safe, hide the safe somewhere in New York, then tell you to read the letter, that's not security. That's obscurity. On the other hand, if I take a letter and lock it in a safe, and then give you the safe along with the design specifications of the safe and a hundred identical safes with their combinations so that you and the world's best safecrackers can study the locking mechanism -and you still can't open the safe and read the letter - that's security.

This might be a way to explain it to your clients.

Re:Fight back

[init100]

I'm still waiting for a Debian security update to break anything.

OpenSSL?

Re:Fight back

[suckmysav]

"They used to release as they patched, but that was even more problematic"

Translation: Admins were sick and tired of rebooting servers on a daily basis.

Rather than do the impossible and redesign their OS from the ground up to make the constant rebooting issue irrelevant, they did the only thing possible wh

Clump all their updates into bundles so that reboots were "scheduled" and admins got used to the cycle.

 

Re:Fight back

[ScuzzMonkey]

There are a load of fine suggestions in this thread which are well-constructed for logical minds, but I can't help but feel this tactic is best answered in kind: a gut-level fear-check. And so the best response isn't to sit down and try to explain the perils of security through obscurity, nor to try to sell additional security services, or to discuss patch cycles and the like, but instead to simply ask the client this: "When's the last time you heard on the evening news anything about a new virus, exploit, or vulnerability discovered in your Linux software? Now, how about Microsoft software?"

Overly simplistic? Absolutely. Sure to make them reconsider what the Microsoft vendors are trying to sell them on its supposed security? Definitely.

Re:Fight back

[erroneus]

If Microsoft "discovers" patches, that kind of scares me.

Vulnerabilities are not patched when they are discovered. Some are, others sit waiting acknowledgement for a very long time before they are addressed.

In any case, the only true and reasonable metric is track record.

So first, one needs to explain that source code does not necessarily mean vulnerabilities are visible or present any more than knowing how a lock works makes them insecure. That is a pretty challenging hurdle to overcome. Frankly, I am not sure how I would address that in a way that would be universally understandable. But that is the beauty of FUD. Fear is easy to do, but not easy to undo. And since Microsoft is the accepted "religion" speaking against it is blasphemy.

But it is easy to point to track record of security and it might be helpful to select some specific cases of known vulnerabilities in Windows that went unpatched for a very long time. It is also easy to point to the many, widely-known disasters that have occurred with Windows over the years... disasters that occur regularly without the use of source code proving that availability of source code is somewhat irrelevant.

In the end, there will be arguments for both sides and neither will make clear sense to the non-technical. Request a 3rd party penetration test and security audit and be sure your ducks are in a row.

What does the government think?

[Toe, The]

DHS - linux
FBI - linux
Navy - linux
Air Force - linux

Wonder why those agencies are using such an "unsecure" platform...?

Ask your customers just some simple questions

[Johnny Loves Linux]

What is the #1 website on the planet today? Answer: google. How many machines does google have to support it's busines? Answer: tens of thousands. What operating system does google use? Answer: Linux. How many times has google been hacked in its 11 year history? Answer: Anybody, anybody? What is the #1 desktop operating system today? Answer: Microsoft. How many worms, trojans, viruses, etc. are there for Microsoft OSes? Answer: > 100,000 (source: pick you're favorite anti-virus company counting scheme.) How many times have businesses been hosed by using Microsoft software? Answer: Too many to count. The latest blunder today? The French navy. Reference: http://www.networkworld.com/news/2009/020909-conficker-worm-sinks-french-navy.html Now for the last and most important question: What does Microsoft think that it knows about security that Gooogle doesn't? Because comparing their security track records, it's not obvious to me that Microsoft knows anything about security. --Johnny says when in doubt just ask Google.

You already have what you need, a positive record

[NevarMore]

"...[systems] that have worked for them flawlessly for 5-6 years, with minimal expense outside of upgrades and patching for security."

Prove, document, and send your customers exactly that. None of my customers give a rats ass about philosophy, they care about the bang for the buck.

If you can clearly point out to your customers that:
1. The sales calls they're getting are SALES CALLS. Your customers will realize that the salesman will spin things so that they buy his kit. That spin may not be accurate or apply to them.
2. Uptime of your systems in a given time period.
3. Cost of your systems/services over that time period.
4. Be honest, unplanned downtime in the same time frame for your systems/services.
5. Distill all of that to brief bullets or an executive summary paragraph.
6. Follow on with a request for feedback. You strive to provide the best service to your customers, make sure that they're happy.
7. Double check all of your numbers before sending, assume it will be shown to the sales people from other companies. CYA.

Waffling on about philosophy and visibility of code and yadda yadda is all well and good, but the person cutting the cheques does.not.care. What they do care about is ROI and cost/benefit. They care about your track record of performance.

Use an Analogy...

[Rinnon]

I watched a "How's it Made" episode on combination locks. Knowing how a lock is made, didn't make it any easier to break into one. If the code is made correctly, the passwords can't just be bypassed. You can't just change the code and load it in for a fun filled night of hacking any more than you can with a closed source OS. That's how I'd explain it to a customer.

Actually, it is true.

[tpgp]

It is true - the GP said they used BSD licensed code and the source you cite agrees:

Keep in mind there is no reason to rewrite that code. If your ftp client works fine (no comments from the peanut gallery!) then why change it? Microsoft has other fish to fry. And the software was licensed perfectly legally, since the inclusion of the copyright notice satisfied the BSD license.

Furthermore, I think the GP was thinking of the BSD licensed zlib. This library had a security issue several years back. Linux / BSD / etc were patched almost immediately (just update a single library), but MS products, including DirectX, FrontPage, Internet Explorer, Office, Visual Studio, Messenger and the Windows InstallShield program, were not patched as quickly.

buying the false argument

[Anonymous Coward]

You don't "argue" security--you test security. Offer your clients periodic penetration tests as a routine part of your service.

But it's not only being dishonest...

[Enleth]

That's also being disinformed - the Microsoft itself is ENDORSING AND FUNDING Open Source!

Just put the phrase "Microsoft funding apache" in any web search engine. It was on Slashdot a few weeks ago anyway. And show that to your customers. MS's CMPs are telling that Apache is insecure? Well, Microsoft is funding it and telling that it's good, so it looks like those MCPs know crap even about things Microsoft has say in officially and they shouldn't be trusted in those matters, or probably in any matters.

There is one HUGE thing people are overlooking

[RichiH]

You must stress that being able to _read_ the code is not the same as being able to _write to the released codebase_. This is an assumption I have encountered again and again and again.

The evil thing is, people don't ask about this, they assume it's fact and that's that.

"We" need to make sure this myth dies.