maybe because they aren't distributing it they are in the clear?
Exactly. Basically, GPL only says that anyone you pass the software on to must also receive source code. If you're just playing with yourself, you don't have to give anyone anything.
Good question. I haven't spent much time with any BSD system, but I've spent enough with SELinux (personal pet peeve: it's not `SE Linux', though `SElinux' or 'selinux' are acceptable) to know a bit about the difference. Pardon me if I wax loquacious...
In the computing world, the vast majority of security flaws come from bugs: improper handling of untrusted data leads to buffer overflows time and time again. Fix the bugs, and those security flaws go away. However, what about the ones you didn't catch? Someone is perfectly capable of discovering them, and exploiting them, until you discover the same problem and fix it. It's a vicious cycle, and you can never win: there's always another security hole, because there's always another bug. The security holes from bugs you haven't found yet are known as zero-day attacks, since any patches to the bugs have existed for zero days (or something like that).
The OpenBSD solution to the threat of zero-day attacks is to spend lots of time looking at its code, and reviewing its code, and testing its code, before vetting it to be `secure' enough to use. They do an excellent job: I don't know particulars, but I'd guess that an OpenBSD system out of the box is more secure than even a no-frills Linux distribution. They lock everything down, and generally don't run software that hasn't been tested thoroughly. Note, however, that you can poke holes in your shiny OpenBSD system by downloading and installing buggy code: Try any poorly-written FTP server, for instance, and watch your box get 0wnd.
The OpenBSD approach shouldn't really be seen as a choice, because every operating system that wants any hope at security needs to go through this process, of reviewing code time and again, and squashing those bugs dead. The deviation from other operating systems is the point where the code is declared to be `good enough', and put into production. OpenBSD developers are just really careful about declaring software to have reached that point. But they aren't perfect. Go to OpenBSD's website, and notice the text that says "Only two remote holes in the default install, in more than ten years!" Pretty good, right? Yup. However, as recently as three months ago, that read "Only one remote hole [...]". What gives? OpenBSD didn't handle some obscure IPv6 stuff right, and it was found that someone could run arbitrary code through this bug.
Does this mean that OpenBSD is a failure? No, though it does mean that they failed in their (rather lofty) goals at least twice (that we know about; I maintain they should change the banner to read 'Only X remote holes in the default install, in the last Y years, that we've discovered so far!'; but, that's just me). This doesn't (shouldn't) besmirch their reputation, and the OS is still one of the best, I'm sure. But ultimately, things like this will happen again; and inevitably, some cracker one day will write an OpenBSD exploit, and steal millions of credit card records because of an OpenBSD system which had a security hole, while the owner of the system believed it to be secure. In short, it's like most any other publicly available operating system: it tries really hard to be secure; and it is probably more secure than any of them, according to their accepted definition of having no security holes. It is an excellent goal, but it's ultimately impossible.
SELinux, which is the core of what was required of Red Hat Enterprise Linux 5 to pass this certification, is a very different approach to security. There're tons of things that go in to making SELinux, but I'll try to keep things as succinct as possible, at the risk of leaving (hopefully unimportant) things out. SELinux operates on the principle of `domains', which are made far more abstruse than they need to be. A domain is a
Though some of his logic was overblown (see the comments made directly on his blog), I think his larger point has some merit. In fields which require lots of studying before beginning as a professional, such as medicine and law, you always hear that you have to be absolutely brilliant to 'get in'. The fact of the matter is that this is not the case: you should be darn smart, but you needn't be the best student in the world to be successful as a doctor. Many of the students who go to law or medical school (I'd guess most) are completely qualified for positions in their respective fields, but by the same token, are not necessarily any more qualified than their peers: they've all studied the same material, had the same experience in the lab, and know the whole picture within a reasonable approximation of each other.
Yet to maintain the level of exclusivity that these careers have, there must be some way to select a subset of the candidates to proceed, and at this point, there are few distinguishing features among them. Some will be far and away brilliant, and will easily get a career regardless; but the majority can't be differentiated from one another. So, how should it be decided who is a doctor and who isn't? By making a test that's so hard it amounts to a randomising function, and then selecting a subset of top scorers to pass. Passing doesn't mean one is inherently more qualified; it just means one guessed better on that day. This also explains why people can pass on their second or third try: they are no better than their competitors the next time around, but eventually one will guess luckily, and get in. It'd be interesting to do some statistical analysis on how many tries it takes people to 'pass' a particular exam, and see if the results fit probabilistic models: If the results of such analysis fit too well, the test is too hard, whereas if they deviate greatly from probabilistic expectations, then the test is more likely to be an actual test of one's knowledge.
To be sure, there will be some individuals who can pass based entirely on their knowledge, just as there will be some individuals who simply aren't cut out for life as a lawyer that will fail the exam. But ultimately, it allows the higher-ups to select candidates for job positions based on the single indisputable criterion of the candidate having passed an exam, thus avoiding any messy issues when someone complains about them choosing a particular candidate in lieu of one better qualified.
Time for a terrible analogy, since it's 0300 here: Really hard exams are the bouncers at the door to the club of medical careers.
Once again, Steven J. Vaughan-Nichols proves that he is a Microsoft shill who should be forever ignored by intelligent, thinking people.
That's the impression I got from the article. Nothing but poor armchair speculation: he quotes Shuttleworth as saying `I'd love to work with Microsoft', but can't bother to give a citation for the quote; he shamelessly cross-links his own pieces, and then asks his readers, `did you read my other stuff?', as though to suggest that those who haven't are less than quality human beings. His condescension nearly reached through the screen and physically browbeat me.
The worst part is, the pages don't have a place to comment and point out how he was so wrong, so I'm left with no recourse other than to point it out here.
The current executive branch has been pretty respectful of legislative and judicial checks on its power thus far.
I hear you there. I doubt this'll actually get anywhere; at least, it won't any time soon.
The real problem isn't that the FBI is unlikely to comply with the judge's order; it is that these sort of issues happen in the first place. What country allows stuff like this? What country shrugs its shoulders when the president pushes the Patriot Act through Congress (not that he had to push very hard)? I hope that 2009 might bring a repeal of this bill, and the reversal of many injustices of the previous eight years. Considering President Bush's current approval rating, I don't doubt that there will be many reversals in the next presidency; however, the FBI has been around the block more than once, so it's probably unlikely that the vast attacks they continue to make on the rights of American citizens will ever be brought under control.
I've thought, more than once and for various reasons, that it might be wise to emigrate. Any suggestions on good countries which respect their citizen's rights, and allow the export of strong cryptography?
People who think that the idea of being able to delete your profile is in any way simple or trivial are deluding themselves. Google themselves have said that because of the way GFS works they can *NEVER* know when a piece of data flagged for deletion is actually no longer recoverable. That fault tolerance and redundancy is built into the design. With a little work using cryptographic techniques, all companies such as Google could encrypt all their data, including all the data for individual users, with individual keys; then, erasing the data is a simple matter of forgetting the key. In reality it wouldn't be completely trivial to develop and use such a system, but it is certainly possible without too much headache.
Why don't they do this? Because no one who uses their services really cares.
I'm not trying to suggest anything in particular about PI's findings by this, but:
If you look at the 'Interim Rankings' PDF (thanks echucker!), the presentation seems pretty shoddy to me. For instance: under the 'Corporate Leadership' column, if you only pay attention to the wording of companies involved with Trust-e and/or Safe Harbor, I find varying wordings ('member of' Safe Harbor, versus 'signed up to'), with no obvious semantic distinction; also, varying capitalization ('Safe Harbor' versus 'safe harbor'); presentation order ('Trust-e and Safe Harbor' transposed); and even spelling locale ('Safe Harbor' versus 'Safe Harbour'). On page 3, the colour for the overall privacy level for Last.fm and Livejournal doesn't match their overall colour scheme (though it is arguably not going to be misinterpreted). The font is painfully small for the computer screen, and could easily be doubled in size. These are just a few things I noticed in about two whole minutes looking at it.
How long would it take someone to go through and standardize the presentation? An hour, maybe? Maybe it's only an interim report, but I'd appreciate a little more effort on their part to give us a nice looking document.
Like I said, not trying to disparage their findings, about which I am far from an expert.
One good way to engender Linux support among the diehard Windows fans is, when their computer inevitably crashes and Windows won't boot, come to the rescue with a Linux LiveCD (Knoppix comes to mind, there are many others), mount their Windows drives read-only, and save all their data to backup via the network. Or, rip their case open, put the hard drive in your Linux computer, and proceed as above. Make sure they're around when you do this. I've had opportunity to do this on several occasions over the years, and each time I get immense admiration from the victim of Redmond's software. Even with computer-savvy individuals who were familiar with Linux, it still can get an appreciative ``Damn, I didn't know Linux could do that!'' Linux can do that.
They're unlikely to go out and install Linux right then, but when you let them know that Linux can save them from such problems, they are usually much more well-disposed towards it later; plus, they're likely to tell their friends to talk to you with computer problems, allowing you to put in the good word with others. And if they ever give you too much crap about using Linux again, ask them if they want you to recover their data next time their computer dies.
Slashdot Mirror
Exactly. Basically, GPL only says that anyone you pass the software on to must also receive source code. If you're just playing with yourself, you don't have to give anyone anything.
Good question. I haven't spent much time with any BSD system, but I've spent enough with SELinux (personal pet peeve: it's not `SE Linux', though `SElinux' or 'selinux' are acceptable) to know a bit about the difference. Pardon me if I wax loquacious...
In the computing world, the vast majority of security flaws come from bugs: improper handling of untrusted data leads to buffer overflows time and time again. Fix the bugs, and those security flaws go away. However, what about the ones you didn't catch? Someone is perfectly capable of discovering them, and exploiting them, until you discover the same problem and fix it. It's a vicious cycle, and you can never win: there's always another security hole, because there's always another bug. The security holes from bugs you haven't found yet are known as zero-day attacks, since any patches to the bugs have existed for zero days (or something like that).
The OpenBSD solution to the threat of zero-day attacks is to spend lots of time looking at its code, and reviewing its code, and testing its code, before vetting it to be `secure' enough to use. They do an excellent job: I don't know particulars, but I'd guess that an OpenBSD system out of the box is more secure than even a no-frills Linux distribution. They lock everything down, and generally don't run software that hasn't been tested thoroughly. Note, however, that you can poke holes in your shiny OpenBSD system by downloading and installing buggy code: Try any poorly-written FTP server, for instance, and watch your box get 0wnd.
The OpenBSD approach shouldn't really be seen as a choice, because every operating system that wants any hope at security needs to go through this process, of reviewing code time and again, and squashing those bugs dead. The deviation from other operating systems is the point where the code is declared to be `good enough', and put into production. OpenBSD developers are just really careful about declaring software to have reached that point. But they aren't perfect. Go to OpenBSD's website, and notice the text that says "Only two remote holes in the default install, in more than ten years!" Pretty good, right? Yup. However, as recently as three months ago, that read "Only one remote hole [...]". What gives? OpenBSD didn't handle some obscure IPv6 stuff right, and it was found that someone could run arbitrary code through this bug.
Does this mean that OpenBSD is a failure? No, though it does mean that they failed in their (rather lofty) goals at least twice (that we know about; I maintain they should change the banner to read 'Only X remote holes in the default install, in the last Y years, that we've discovered so far!'; but, that's just me). This doesn't (shouldn't) besmirch their reputation, and the OS is still one of the best, I'm sure. But ultimately, things like this will happen again; and inevitably, some cracker one day will write an OpenBSD exploit, and steal millions of credit card records because of an OpenBSD system which had a security hole, while the owner of the system believed it to be secure. In short, it's like most any other publicly available operating system: it tries really hard to be secure; and it is probably more secure than any of them, according to their accepted definition of having no security holes. It is an excellent goal, but it's ultimately impossible.
SELinux, which is the core of what was required of Red Hat Enterprise Linux 5 to pass this certification, is a very different approach to security. There're tons of things that go in to making SELinux, but I'll try to keep things as succinct as possible, at the risk of leaving (hopefully unimportant) things out. SELinux operates on the principle of `domains', which are made far more abstruse than they need to be. A domain is a
I think you might have just triggered Godwin's Law there. On to the next article...
Though some of his logic was overblown (see the comments made directly on his blog), I think his larger point has some merit. In fields which require lots of studying before beginning as a professional, such as medicine and law, you always hear that you have to be absolutely brilliant to 'get in'. The fact of the matter is that this is not the case: you should be darn smart, but you needn't be the best student in the world to be successful as a doctor. Many of the students who go to law or medical school (I'd guess most) are completely qualified for positions in their respective fields, but by the same token, are not necessarily any more qualified than their peers: they've all studied the same material, had the same experience in the lab, and know the whole picture within a reasonable approximation of each other.
Yet to maintain the level of exclusivity that these careers have, there must be some way to select a subset of the candidates to proceed, and at this point, there are few distinguishing features among them. Some will be far and away brilliant, and will easily get a career regardless; but the majority can't be differentiated from one another. So, how should it be decided who is a doctor and who isn't? By making a test that's so hard it amounts to a randomising function, and then selecting a subset of top scorers to pass. Passing doesn't mean one is inherently more qualified; it just means one guessed better on that day. This also explains why people can pass on their second or third try: they are no better than their competitors the next time around, but eventually one will guess luckily, and get in. It'd be interesting to do some statistical analysis on how many tries it takes people to 'pass' a particular exam, and see if the results fit probabilistic models: If the results of such analysis fit too well, the test is too hard, whereas if they deviate greatly from probabilistic expectations, then the test is more likely to be an actual test of one's knowledge.
To be sure, there will be some individuals who can pass based entirely on their knowledge, just as there will be some individuals who simply aren't cut out for life as a lawyer that will fail the exam. But ultimately, it allows the higher-ups to select candidates for job positions based on the single indisputable criterion of the candidate having passed an exam, thus avoiding any messy issues when someone complains about them choosing a particular candidate in lieu of one better qualified.
Time for a terrible analogy, since it's 0300 here: Really hard exams are the bouncers at the door to the club of medical careers.
That's the impression I got from the article. Nothing but poor armchair speculation: he quotes Shuttleworth as saying `I'd love to work with Microsoft', but can't bother to give a citation for the quote; he shamelessly cross-links his own pieces, and then asks his readers, `did you read my other stuff?', as though to suggest that those who haven't are less than quality human beings. His condescension nearly reached through the screen and physically browbeat me.
The worst part is, the pages don't have a place to comment and point out how he was so wrong, so I'm left with no recourse other than to point it out here.
I hear you there. I doubt this'll actually get anywhere; at least, it won't any time soon.
The real problem isn't that the FBI is unlikely to comply with the judge's order; it is that these sort of issues happen in the first place. What country allows stuff like this? What country shrugs its shoulders when the president pushes the Patriot Act through Congress (not that he had to push very hard)? I hope that 2009 might bring a repeal of this bill, and the reversal of many injustices of the previous eight years. Considering President Bush's current approval rating, I don't doubt that there will be many reversals in the next presidency; however, the FBI has been around the block more than once, so it's probably unlikely that the vast attacks they continue to make on the rights of American citizens will ever be brought under control.
I've thought, more than once and for various reasons, that it might be wise to emigrate. Any suggestions on good countries which respect their citizen's rights, and allow the export of strong cryptography?
Why don't they do this? Because no one who uses their services really cares.
I'm not trying to suggest anything in particular about PI's findings by this, but:
If you look at the 'Interim Rankings' PDF (thanks echucker!), the presentation seems pretty shoddy to me. For instance: under the 'Corporate Leadership' column, if you only pay attention to the wording of companies involved with Trust-e and/or Safe Harbor, I find varying wordings ('member of' Safe Harbor, versus 'signed up to'), with no obvious semantic distinction; also, varying capitalization ('Safe Harbor' versus 'safe harbor'); presentation order ('Trust-e and Safe Harbor' transposed); and even spelling locale ('Safe Harbor' versus 'Safe Harbour'). On page 3, the colour for the overall privacy level for Last.fm and Livejournal doesn't match their overall colour scheme (though it is arguably not going to be misinterpreted). The font is painfully small for the computer screen, and could easily be doubled in size. These are just a few things I noticed in about two whole minutes looking at it.
How long would it take someone to go through and standardize the presentation? An hour, maybe? Maybe it's only an interim report, but I'd appreciate a little more effort on their part to give us a nice looking document.
Like I said, not trying to disparage their findings, about which I am far from an expert.
One good way to engender Linux support among the diehard Windows fans is, when their computer inevitably crashes and Windows won't boot, come to the rescue with a Linux LiveCD (Knoppix comes to mind, there are many others), mount their Windows drives read-only, and save all their data to backup via the network. Or, rip their case open, put the hard drive in your Linux computer, and proceed as above. Make sure they're around when you do this. I've had opportunity to do this on several occasions over the years, and each time I get immense admiration from the victim of Redmond's software. Even with computer-savvy individuals who were familiar with Linux, it still can get an appreciative ``Damn, I didn't know Linux could do that!'' Linux can do that. They're unlikely to go out and install Linux right then, but when you let them know that Linux can save them from such problems, they are usually much more well-disposed towards it later; plus, they're likely to tell their friends to talk to you with computer problems, allowing you to put in the good word with others. And if they ever give you too much crap about using Linux again, ask them if they want you to recover their data next time their computer dies.