Security

Ask something
Discussion Locked

Security Solutions: Open source risk

0 helpful
22 replies

by discussion

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

In this week's Security Solutions TechMails column, Mike Mullins highlights some of the security issues regarding open source software deployment. Are your servers running Linux? Are you satisfied with the security that they provide to your network?Do you modify your own source code or depend on patches?

----
If you're interested in the Security Solutions TechMail, but would like to learn more about it before signing up, point to this link and then click Security Solutions to see a sample:
https://www.techrepublic.com/techmails.jhtml?repID=r001

22 replies

by j.vajda

Dear colleagues,
I had a bad feeling of "deja vu" reading the article, as it sounded very much of "MS senior executive talk".
In theory the report is sound, but the practical side of it is far from reassuring, I think MS is very unresponsive, very quick to drop products, and absolutely unwilling to provide help, if it is "no longer supported".
With open source you always have the possibility to create the correction for a flaw, as the source is open.
I find the article significantly biased, and in line with MS policy which aims to discourage migration away from closed source development, at certain stages even implying that open source is "un American" and contrary to "free enterprise".
I think that the MS way of indicating things is more "un American" and contrary to "free enterprise".

by sean®

I agree with J Vadja. There are security issues with any software - MS sent out three security notifications on Wednesday.

The author states that security is not the vendor's responsibility; it is arguable that this may be the case with open source as we all 'own' it, but if I pay a large sum of money for a complete software package then security is the responsibility of the software house.

It's no different then buying a car in this respect. If I buy a Ford I expect it to work without mehaving to constantly test the brakes etc.

If I put in an OS or any system, I expect it to work; the fact that it has security holes in it is to do with its design and build. Why am I responsible for the failure of other people to get those right?

It's this kind of attitude that allows companies to sell shoddy software.

by vladimir.simek

Until I've red this article, I've considered TechRepublic as an objective source of information for IT pros.
But, this artice looks like one of that marketing bull-shits, which uses MS to make Fear, Uncertainty and Doubt about some uneducated usersand executives, who know nothing about the differences in Open Source and proprietary systems.
It looks to me, this article was completed paid by Microsoft and I am very angry, that TechRepublic published it. Either you want to announce flame war between Linux and MS fans, or you have been paid by marketing from Redmont.
Ok, now to arguments:
- SuSE and RedHat issued 56 soft updates. How many (critical) updates issued MS? Now, I'm downloading all patches for Win2K/XP,IE5.0-6.0, JVM, IIS intoSoftware Update Services, and it is more than 199 updates!
- Vendor support. Yes, you can find basic advices in support.microsoft.com. But if you want phone support, you must a) pay for it to MS, or b)you speak to idiots who didn't see computer in their whole live. If you want to have Linux support, you can pay to RedHat or SuSE, or you can find many informations in internet, manual pages or Linux Documentation Project.
- Time from discovering security flaw to issue the patch. Patches for Open Source system come in a shorter time (days), than for MS products (months).
- Quality Assurance. Does for you the MS Quality Labs certificate be enough? For me, not. I've never seen the "blue screen of death" in my Linux installation. In a companywith cca 200 computers with Win2k Professional I see it sever times in a week.
- Final Thought. Linux is not secure system, but Windows too. It depends on network (or security) administrator. But no one who can click with mouse, says "I'm Linux administrator". But how many people, who know nothing about security and networks say "I'm good Windows admin"???
TechRepublic, I'm really disappointed with this article.

by dennis.smith

This guy is definitely biased. Has he even tried setting up and using a Linux system. When a flaw is discovered in Linux, it gets fixed fast. You could even fix it yourself if you want. Just try calling MS with a bug and see how fast it gets fixed. Let's not look at the number of flaws, but the number of time a MS system gets comprised compared to a Linux/Unix system. Not even close.

by paulsenj

I agree with the posts so far, the article said RedHat and SuSE released 56 security updates but it didn't point out the 200 MS updates ytd. The article also says who do you go to for tech support. Well I know RedHat sells support sollutions and I'm sure SuSE does to. As for network security that has allways been the SysAdmins job. For example If you set up a server and install all the security updates the manufacture has, and then lets say install telnet. If some unauthorized person telnets in and deletes all of you inportant info, whos fault is that. Yours, the SysAdmin! Its not the manufactures fault you didn't set a telnet password, or if you set one that was so simple a 3 year old could figure it out.

The person who wrote the article says he uses an open source software and perhaps he thinks that 56 security patches ytd is a lot, and if he hasn't used windows yet this year he probubly didn't realise the 200 MS has released. But that would mean he got fed up with windows and went to Linux. :)

by jrmint

I can't believe what I just read. I had to sit back and relax before posting. I missed the banner that said 'Paid for by Microsoft'.

If you have ever dealt with 'vendor support' you would know that you would rather poke your own eyes out with redhot pokers then deal with most of the morons on the phone. Every experience I have had with email/phone support usually ends a few days later with me telling the 'support engineer' what is wrong and how to fix it. That fix may take many months to come out ... am i supposed to shut the machine down and wait for it. If you have ever applied a patch to a production server without first applying it to a test instance because the vendor certified it then you are suicidal.

There is no perfect O/S.You have to decide what is acceptable for your organization. Would you rather wait 3 months for a vendor patch that may even be the old "the next version addresses that why don't you upgrade" OR would you like to have the option available to you to fix it yourself or even ask the larger community to fix it. You have to decide where do you want to invest your time and money?

by romerogt

Is it objetive to compare the sum of updates of 3 operating systems, against anything else ? Is it fair to compare un updates without comparing mitigation factors, likehood of ocurrence and versions affected ?. I think it is not.

Product maturityis not equal to time in market. How many times has linux been compiled and a release tested in the Open Source community ?

Vendor support is a mith. I use very little of open source products, but my experience tells me the flaw are fixed faster on some open source products that they are on the ones my company paid for. I will no go in details, but Apache has been quite a good experience for me, will other paid webservers have not been as good as it.

Focus on support and security on open source products is real, four years ago I would have share your opinion, but since I've been researching on different open source products this has change, and I think that from a marketing point of view companies have a bigger banner stating "Security", doesn's always mean it is backed up with real work.

Using open source, does not mean you must code and compile your version, it is up to you, I don't see an issue of security, rather than personal likes and capacity.

Keep your mind open, we do not have to migrate to open source, but we do not have to keep on payed software. We must evaluate, compare, make decisions; options have changed, we are not on 1998 when "Open Source at enterprise" was a bad word.

by trichart

I will remember this article every time I read a MS Kb article that ends with "first fixed in Service Pack 2" or some thing along those lines.
The fact is, in my opinion that support is fairly spotty everywhere (ever try to get a straight answer for the many programatic errors in Outlook 2003?).
The answer is a combination of open source, direct source and your own tuning.
As for the idea that the more popular an application (or OS) is, the more it will be attacked is partially true, but itdoes not explain why IIS is so much more vulnerable than Apache or iPlanet. Perhaps is is better explained this way: What you need from any application is performance, security and stability. You can pick any two.

by manit

How many of the 56 updates put out by RedHat dealt with their version of Linux, and how many dealt with open source software distributed with RedHat? If you include the sendmail alert, then all Unix distros were vulnerable. Some major unix vendorsalso distribute samba, another recent piece of software that was found to be vulnerable. QA is done by the whole community in the open, look at bugtraq as an example.

I agree with the author that security is the ultimate responsibility of the admin (all must work as a team ? security, network, unix, linux, microsoft, db, etc.) whatever the OS.

by aaube

A common FUD tactic among the anti-Linux crowd is to add up all Linux vendor updates and use that as a measure of security.

What happens is that, if RedHat, SuSE, and Mandrake each release an update to cover the same flaw in the same software (such as Sendmail), that gets counted as 3 vulnerabilties.

Tell me, do these same Linux critics count the same vulnerability in Windows 2000, Windows XP, and Windows NT as 3 vulnerabilities? I think not.

by prana7

I agree with this post. Linux have alot of update security and front of people who created linux redhat unix etc program. Open source who will help them to fix and what they see big leak or bug etc,. I think Open source is wondeful and FREE.

I agree with person who wrote "For example If you set up a server and install all the security updates the manufacture has, and then lets say install telnet. If some unauthorized person telnets in and deletes all of you inportant info, whos fault is that. Yours, the SysAdmin! Its not the manufactures fault you didn't set a telnet password, or if you set one that was so simple a 3 year old could figure it out."
That s totally true. It s system or newtork adminstrator/engineer s fault not your or user or so.

They have to be careful to configure and manuel without default.

:)

by eagle77

Mike, you talk about quality control. Where is the quality control that permits the extraneous programs within the OS like MS does. I have yet to see a Linux OS install with the games and Eater eggs unless they are selected for install. There areliterally tens of thousands of lines of dormant code within the MS OS's. Compare that to open source. The Open source community reviews prevent those occurences and perform a much more through quality control than with many of the closed source software houses. No software is perfert but when I pay hard earned cash for a product I expect a level of quality. I get that level of quality from open source software but I have yet to receive it from MS. The lack of quality on the patches is notorious. "Nuff said.

by mishap

I have mixed emotions about this article. It sounds like something from Redmond, but not quite.

I am far more concerned with the number of EXPLOITS then the number of vulnerabilities! And I am far more concerned with the time from discovery to time of repair when a vulnerability is found.

Based on all of the indicators that I have seen, Open Source is FAR ahead in the discovery to repair cycle. And FAR behind in the exploitation area. I have far more CERT notifications of exploits forMS products than for Open Source. Most of the Open Source issues seem to end up being 'possible' vulnerabilities instead of real ones.

As for support, companies like Red Hat and SuSE, and most of the other distros are responsive and have good support. I can not same the same for MS.

Security is two issues: Vulnerabilities that the administrator can not address (software bugs and etcetera) and Vulnerabilities that administrator can address (bad passwords, un-ncecssary services, and etcetera). The vendor IS responsible for the former. The vendor needs to be responsive and plug vulnerabilities quickly, The vendor also needs to supply a secure system rather then seeing how many bells and whistles can be added to the next distro. The Administrator needs to verify that only services needed are run, and that the security on those services is properly maintainted.

by mikatrob

Any system needs to be updated, patches tested before installed on production boxes.
Vendors can only be so responsible, but not for ignorance on SysAdmins behalves.

Follow this link and here is MS responce to customer questions about
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/policy/rateFAQ.asp
Why have you made these improvements to the severity rating system?

"Customers provided us with feedback about the former system, and we believe that, after ayear, the time has come to respond to this feedback:"

After a YEAR no one know what they were talking about.
Not to bash but get real!
Patches for open source normally have heres the work around, we do this on production boxes, then test patch on test servers.
Paid for products we patch, our tummy's gurgle as the system re-boots and we pray to God the system comes back up witout errors.
Yes we test the "Paid" products patches but even if broke we cannot patch our selves.
We would have far less problems if the SysAdmins had to "understand" what they were doing and involve thier selves a little more than to leave auto update on.

by mikatrob

By learning how Hotmail.com have implemented their webemail service, we can gain extra information/insight on how to build a similar system using @Mail. Scalability is the key , it is important to choose a reliable and fast platform to host the service under.

See http://www.unix-vs-nt.org/kirch/hotmail.html for reference

?The software giant has attempted to exchange the Sun/Solaris infrastructure of Hotmail with NT since buying it in December 1997. However, the demands of supporting 10 million users reportedly proved too great for NT, and Solaris was reinstated. In a leaked report, sources close to Hotmail said: "... its whole mail server infrastructure is Solaris. NT couldn't handle it. On the web server, they're running MP Pentiums and Apache on FreeBSD. They're moving to Solaris for threads. The engineering team did its best to run NT - and failed. The issue's being escalated." Hotmail is running Apache's /1.2.1 web server which is not available for NT due to technical difficulties. A statement on Apache's website states: "The road to Windows NT has not been a pretty one. Several attempts have been made, both by Apache Group members and outside folks, but due to a lack of stability and a clear consensus on how to managea true cross-platform development project, NT is not yet a standard platform supported by Apache. ?

Hotmail use FreeBSD machines as the web servers, that communicate to a cluster of Sun machines that store user-emails/profiles in an Oracle Database. Using both Mod_Perl and CGI, hotmail.com was initially created. Since Microsoft purchased the service, they have attempted to port over the software to Windows with failure.

Make up your own mind!, and for those who play follow the leader, well follow your leader and use open source.

Sorry about the flames I couldn't help it.

by hal 9000

Interesting here is not so much the bit about the number of soft fixes and no mention that MS has released far more but the implication that by using Open Source you are somehow putting your orginasition at risk from a hacker and if you use MS your safe. Well sorry but thats not the case. If the author actually took the time to read MS documation it is virtually impossible to instigate legal action against MS for any failure of one of their products and I'm only thinking Security flaws here nothe normal simply won't work bugs. This author seems to me to imply that you have some form of protection by using MS products and while I do have MS Servers at where I work and Linux Servers as well it's always the MS ones where the problems arise and touch wood so far I have never experienced a security flaw that comprimises a Linux Server it a pitty that I can't say the same for the MS alternative.

My only question on this artical is "Who actually pays the writer?" Microsoft or TechRepublic?

by mike mullins

Thank you all for your comments. I read everything. Both good and bad, so if you?re having a bad day and need to unload, let it fly. I don?t offend easily, but sprinkle some constructive criticism in with the flames.

I?ll try to address all the above posts, in this single reply:

J.Vajda@omh.hu - You?re right MS does things when there?s a financial incentive. As for the bias, it?s the way I see it. I don?t have time to fix every flaw individually; I depend upon the engineers that sold me the poor product to fix it. Smart people don?t use MS because it?s secure. We use it because of convenience and time management. Re-read Final Thoughts

seang@blueyonder.co.uk - You can?t hold a vendor responsible for security (unless that?s what they?re selling). What I was talking about is quality assurance and I agree with you. However, no one can test for everything and immature products will consistently display new vulnerabilities. Re-read Final Thoughts

vladimir.simek@sk.pwcglobal.com- The Linux crowd does do an excellent job at addressing security related issues (I think I said that). However, they need a more centralized approach and focus. Windows is an immature OS and new flaws are discovered weekly. As for the quality lab certificate, if I have one, then I can blame vulnerabilities on the vendor and not my own poor installation (it?s job security, not bias).

dennis.smith@philps.com - Read my Final Thoughts. I?m a proud Linux user.

paulsenj ? You?re right. I have gotten fed up with MS. As for the number of flaws discovered, it?s significant because it means that more people are using the system ? therefore ? more people are discovering flaws.

--continued with Authors Comments part 2

by mike mullins

Jrmint ? You?re correct. It?s up to you to decide where to invest your money and time. That was part of my Final Thoughts.

emromero@sat.gob.gt - Exactly! Migrate, but forget your preconceived notions and hated of MS and do it based on confidence in the OS to do the job it?s intended.

Trichart ? Thanks! However, I prefer all three (performance, security and stability) when it comes to a web server. That?s why I use Apache on Linux. Wouldn?t run an IIs machine for my dog.

ManIT ? It was 56 combined (RedHat and SUSE), they didn?t address the same issues. Thanks for getting my final point.

aaube ? see the above comments.

Prana7 ? I agree you. Open source is the way to go.

Don Smith ? Absolutely, the admin should have total control over what is installed and I applaud open source for giving us that flexibility. But quality control is more about testing and certification than application bloating.

larry@unicode.com - I agreed with you on open source leading in the time to discovery. Vendors (MS) need to do a better job of supplying a finished product not a work in production.

Final Thoughts ? First, If I offended anyone. I apologize. I write the way I see it (which might be myopic). Open source is definitely theway to go, and it will only get better as more time goes on. Finally, I use MS products when I don?t have voice in the decision. When I have a choice. I go with Linux every time! Sorry Microsoft.

by malexand

Mike,

I think the main issue, is that while you may support opensource, your article looked like it was blasting opensource as being insecure and having many holes compared to MS products.

It is more about what you didn't say that causes concern. You didn't say that MS has flaws, and that it also isn't responsive to them. There are many security holes that MS has admitted to, and has also said will NOT be fixed because the OS it is part of is 2years old. for many closed source software, its upgrade or suffer. Once a new release is out you are own your own (actually less than on your own because you couldn't fix problems if you wanted to)
The open source vendors are very responsive. By the time I've read about a vunerablility in something, such as sendmail. RedHat already has a fix available to download, and their up2date utility is even better than Windows Update. It doesn't even attempt to send back data.

I also don't have to reboot after updates, nor do I have to go back again 5 times because the updates can only be installed seperately.

Even though you may support open source, your article did sound like MS rhetoric.

by tom

Why use linux with all the patches and holes in it??
I use open source, but not Linux.
Try OpenBSD. 1 Remote hole in 7 years. With about 10 patches per 6 months, but not all security patches.

by snap

(Originally submitted as a reply direct to the author).

Your article seems to suggest that non-free software should warrant better protection against flaws, and that the vendor should be willing to fix flaws quickly.
That may be correct in a few cases. However, experience suggests that the vendor often will charge a hefty fee for correcting flaws in such commercial software.
Unfortunately the user will have no option but to pay out in such circumstances.
With open-source software there is no need for the user to fix any flaws himself, because there will be an abundance of qualified consultants willing, and allowed, to do so at very competitive rates.
With the commercial software it can even at times be regarded as a breach of contract to even approach somebody to have security flaws fixed, as this may be seen as an act of publicising such flaws.

Regards,
O.K.

This discussion is closed to new replies.