Web Development
This is page 2 of the discussion. Read the opening post
by wmarkhall
The, ahem, 'article' states: "Without a complete review of the source code and an independent compile yourself, you have absolutely no assurance that the code you are running matches the source code that it's supposed to. Should that code damage or otherwise compromise your system, what's your recourse? Rebuild your system."
What the article does not state is how one gains access to closed source code in the first place --
Not checksums, the original source code.
by arleenw
I've lost clients insisting that they have something that they didn't like for security's sake. I am the person they look to for recommendations of software that will work well in their environment. I need to be familiar and comfortable with what I am recommending.
I am also the first person they call when something isn't working right - not the software vendor. I'm the one that winds up making the phone calls to tech support or, in the case of open source, posting my question in the forums. By the way, I've yet to have a problem go unsolved using forums and newsgroups.
As a professional, it would be grossly negligent of me to download something onto a clients computer without first fully testing it and learning to configure the software properly. If a software I downloaded wreaks havoc in my test environment, I'm not going to turn around and recommend it to a client.
The fact is, I would be remiss in my duties if I did not explore all options for my clients - open source or proprietary. There is no "one size fits all" for everyone. Each client has a unique situation that requires a different approach. It is my job to know what's available and where it would be best implemented. If you're worried about downloads getting hacked, burn a copy of a known good download for installing on your clients computers.
by kaceyr
Even if I'm comfortable and confident that the Open Source solution is secure and can handle whatever they throw at it, if the clients perception of Open Source is that it's dangerous, it will never fly.
I've actually had a case where an Open Source solution was a near perfect fit, but the IT director heard the words Open Source and killed it then and there. They went instead with a commercial product that only met about 40% of their needs. On the flip side, I did make good money writing add-ons to the commercial software to make it fit their business.
by wmarkhall
You have no business discussing anything in a professional forum after what I just read.
In fact, this particular comment -- both in substance and style -- is a perfect example of why my visits to TR have are down to a few a year at most.
Someone let me know when the adults are once again in charge.
by apotheon
by dnsb
It seems rather funny that KaceyR picked a web browser as his example. Has he forgotten the sheer number of security holes found in Internet Explorer? Perhaps he has never read the EULA? Never had his system victimized? Has he ever tried to contact Microsoft for support when an IE exploit has toasted his system? Keep that credit card ready.
Eeyup, proprietary software is obviously going to be more secure and reliable -- not.
As for his comment that being able to review and understand the source code as somehow equating to the ability and/or desire to write that same source code yourself? Another fine example of "does not follow".
by kaceyr
If you're goal is to attack Microsoft, would you attack a product like MASM (Macro Assembler) that most people don't even know exists, or would you attack Windows XP? Obviously, you would attack Windows XP, because no one else would know what you're talking about.
In order to foster this discussion (and since it sparked this line of thought in the first place), I aimed for the current Open Source high profile software, Firefox 1.0.
I don't believe that this discussion would have had near the input if I hadn't had the luck of being able to post it just after the release of Firefox.
To answer your questions;
No, I haven't forgotten the security holes, but I have mitigated their risk.
Yes, I've read the Microsoft EULA (for Windows XP Pro) in it's entirety, and even paid for a copyright attorney to provide me with a legal review of it (that's what I pay a retainer for).
No, I've never had my system victimized. I keep an up to date hardware firewall, software firewall, virus scanner, and I regularly review my system access logs (I have a very nice logging firewall).
No, I've never contacted Microsoft about an IE exploit toasting my system, because it never has.
In fact, the only time my system has been toasted is when I do it all by myself. Shame on me, but that's what my backup is for.
The question of security and reliability are secondary in this discussion to trust. Most businesses tend to be more likely to trust a known company than an unknown (to them) group of people from around the globe. Take your average retail store owner. If you want to sell the owner a system that incorporates the cash register, inventory, ordering, and payroll processing, you can probably find all of the software you need in the Open Source community, but without a name like IBM or NCR on the hardware, the store owner will never buy it. Why? Trust. The IBM and NCR names have an implied level of trust because of the size and success of the companies. I hate to break it to you, but things like that matter. Does it matter to the store owner who wrote the software? Nope. As long as they can call the company who's logo appears on the hardware, they're happy.
On to the code review:
If I'm reviewing code that may contain, for example, an IP packet exploit, I had better be able to recognize it. If I can, there's a pretty darn good chance that I can write an IP packet manager. If I can't, what am I using to assist me in the code review? If I have nothing to assist me, then this is where I need to have a level of trust of whomever reviewed the code from the vendor (proprietary or Open Source).
by kaceyr
I started this discussion after reading the posts about the release of Firefox 1.0, where the original article was asking the community if they would switch from IE.
You should never fall into the trap of thinking that any software development model is beyond question. If a development model is never questioned, how can it be improved?
by apotheon
Technologies should always be tested and questioned. I'm more inclined to choose OSS, though, if only because I can test it, review it, read it, fold spindle and mutilate it, to my heart's content. I'm more inclined to choose OSS also because when I question it, I'll get answers based on technical realities rather than marketing and FUD.
If Microsoft comes up with a new product that I think is better than any OSS solution, I'll probably consider using it (at least until it's surpassed by an OSS solution, which it will eventually be).
I even use Win2k Pro occasionally. If nothing else, Windows OSes are useful for those who have to support clients with Windows systems.
by stubucks
by hmtattrie
Your posting reflects a complete and utter lack of understanding of how the open source community works.
You talk about "the author" as being one person who can inject whatever he likes - this simply doesn't happen (for all the reasons you have listed - and more). What happens in the real world is that hundreds of good programmers spend many hours writing pieces of a program which then are reviewed by hundreds of other good programmers for functionality, correctness and completeness before they are added to the main code-base. If a back-door or some other sort of malicious code were to be integrated into a piece of open source software, it would have to pass inspection by (and hence be a conspiracy of) several hundred people (it's about as likely as it happening at Microsoft). That's why open source development/deployment is a multi-layered approach - it works for everyone.
You talk about the availability of source code as being a security measure so that you can do a complete rebuild and be sure of the "cleanness" of the executable. Also not right. Source code is provided so that people can customize a system to their needs if the out of the box distribution doesn't. If this includes tweaks that break your systems, it's your own programmers fault and you need top find another one. Checksums are provided to validate an executable against the copy that an Open Source organization says is the real one - if it doesn't match, you downloaded ine installer from some questionable source. Stick to the real ones and you'll never get yourself into trouble.
You state that if you can understand it - you can write it yourself, which is ridiculous in itself. I can understand all of the source code that makes up Microsoft Word (the millions of lines of it). It would take the rest of my natural life to type it in - much less debug a rewrite of it. Great idea that doesn't work in the real world.
As far as culpability and legal recourse are concerned, how much has Microsoft paid in fines and damages for all of the flaws and buffer over-run hacks that have showed up in their software? The answer is $0.00. After you do a post-mordem on your system and find that someone got in and did some damage to your system due to one of the plethora of errors in just about any Microsoft product - you should sue them for it and let me know how it turns out. I'd be interested to see how far you got. My guess is you end up with a bunch of huge lawyer bills and your legal tail tucked between you legs - yelping all the way home from court. Lets face it - even if you're right - their lawyers can beat the crap outta your lawyers any day of the week. You'd be better off filing suit against Mozilla.org.
by vance9
Ahhh, if you only understood Open Source. Both apt and now yum for Fedora have built in security protection. They perform md5sum checks on the software, and you can obtain the software from multiple repositories. But the biggest and safest test is that the files are GPG signed by the repository site.
For someone to be able to oull off a shrade as you suggest many things would have to be comprimised. I'm not saying that this could not happen, but the likely hood of it happening is remote because there is so much involved.
by ra.kish
...of open source. Every time I ask this question, the answer comes back that someone in the user community will find an answer and give it to me [the novice user]. Great! Does that mean that I am now dependent on this user to give me the next version upgrade? Wjat will they supply -- a code snippet or a compiled program? What if there are multiple programmers supplying updates to the code? Where do I [the novice] get the version that I can use? As far as I can tell, I am now dependent on that developer (those developers) that gave me my fix in the first version. What if the change is wrong? Who answers for the change?
Right now there are three or four major vendors of Linux, with at least a dozen different variants. Each variant has its own flavors, strengths and weaknesses. This is causing more fragmentation in the marketplace then cohesion. When I buy a Linux software package, I also have to know which [current] versions of the OS it is compatible with. With Windows and Mac, there is only one version.
by enserfud
by paul.adams
This has got to be the stupidest argument I have ever heard. "Tweaked" by a "hack" from "whom" downloaded from "where"? There is a whole lot of "assuming" going on here.
Lets just "assume" that I download a hacked version of IE, and it blows up my system. Is M$ really going to buy me a new system?
Cmon! Get with the program, you mindless borg agents.
by apotheon
by dryden.cope
by fredpt
by kaceyr
Isn't it the purpose of any article published in a "Discussion Center" (you'll see that written near the top of the page you're viewing) to start a discussion?
Since you have both Open Source and proprietary software in-house, why don't you pose your question to them? I, for one, would be interested in their response.
by gryfon
There IS no safe computing anymore. Get used to it. You can be as secure and circumspect as you like, and all it takes is 5 minutes of a visisting relative surfing to trojan infested porn sites, and your efforts are for naught.
Also, software vendors DON'T always take responsibility for their software. My step-father went ahead and installed SP2 for XP on his laptop, and it's never worked right since. He tried to call Microsoft for help, and they wanted to charge him $30 an hour for tech support for a product THEY released and recommended.
It's up to the end user to verify that the site they are visiting is valid. Typing www.mozilla.org is pretty foolproof. Following a link out of a spam email is not.
If your clients can't understand that, take their computer away and give them a calculator. It'll be less frustrating for them in the long run. Or spend some time doing user education.
Pointing fingers never solves anything, unless you're a lawyer.
Regards,
Gryf
by kaceyr
by ra.kish
The fact that there are binary libraries available with every major Linux distro is great! But it still does not change my assertion. Someone has to put code together to read those libraries and get the information out of it and display it to the user [The application.] My father is not going to accept a code snippet or source from another user and be able to find where in the application that it should go, then recompile the program so that it works.
The impression that I get from OSS is that this is The Solution. Yes, it is good that you can get multiple answers from different people, and that you can pick and choose the answer that you want to deploy. However, the greater part of an application's audience is madeup of people that simply want to run the application and have it work. If it does not work, they want to know who to go to that is accountable.
I do not see this in OSS.
by apotheon
Open source software development isn't "The Solution". It's an effective way of finding and developing solutions that work.
If you don't see a solution that will Just Work with someone behind it that end users can complain to, you aren't paying attention. Try Red Hat, or SuSE/Novell, or Mandrake, for instance.
by bixbyru
KaceyR seems to forget that the license agreements on almost all software - MS or otherwise - promise nothing other than stiff penalties for violators.
These licenses specifically disclaim any waranties, and basically hamstring you even before you open the box.
Caveat emptor as a buisinedd model.
With GPG, MD5 sums et cetera, things are pretty good in the OS/FS world.
While they do not rule out malicious intent on the part of someone within a software house, neither does the MS production process.
Easter egg or back door - they're both easily dooable.
OS/FS is reasonably well audited, and any problems are quickly spotted and fixed. Further, while you may not get a waranty, you do get at least two other things:
1) a product you can customize, change and use in any way you wish at no cost;
2) the assurance that the author wrote it because they wanted to, rather than had to.
That last is significant. A paid programmer as often as not will drudge through but have their mind always on Miller time.
An OS/FS programmer has a sense of working for the greater good, and knocks off when needed. OS/FS isn't the product of tired people wanting to leave, but rather a labour of love.
Again, this helps ensure a decent product.
BTW, while I'm on a roll, as far as the whole patent thing, there's an important argument everyone seems to miss:
Software patents came about because copyrights didn't provide enough clout and some companies sought to abuse the patent process because the investigators typically don't know what they're at and will grant a patent for just about anything.
Further, patents can be incrememntal. The patent on the triangular loop on a cotter pin - and on the bent longer tine - are independent of the patent on the original cotter pin.
Try writing your own Harry Potter book and you'll soon see the difference between patents and copyrights.
However (pregnant pause) patents only ensure that noone can use an idea for profit without permission. For profit...
OS/FS are inherrently not for profgit. Certainly, there are commercial and shareware apps for OS, er, OSs, and services are for profit, but the OS/FS in not.
If I want to copy a GE turbine down to the last rivet for my own use - or to give away - I can, at least under U.S. law. I just can't sell it for more than I paid for the materials.
So, even were Linux, Mozilla, OOs et al to violate a slew of patents - which they don't - it wouldn't matter.
BTW, many of these patents 'bout which MS is whining include TCP/IP, UDP, NFS, FTP, POP, the double mouse click, using the tab key to switch betwen form elements... it's BS.
Hell, the tab key's been used for that since the first IBM System/360!
What about virii?
The typical argument from the MS Party Faithful runs thus:
> Windows is attacked so much more often than
> Linux is not because of its vulnerabilities
> but because of the size of the audience. If
> the numbers were reversed, we'd have a lot
> more viruses for Linux and Mac than Windows.
Spoken like a true neophyte.
Firstly, Linux is attacked far more frequently than Windows. You see, it's in a majority position with server systems attached to the internet.
'Course, very few of these attacks succeed - Windows succumbs with far greater regularity.
A great many bugs "attack" my windshield, too, but very few of those attacks are successful. Were I to install 1/4" wire mesh [Windows] instead of glass, the frequency of penetration would likely increase.
Were Linux so easily cracked, some black-hat or other would occasionally bring down the entire internet and gain instant super-stardom.
As it is, script-kiddies with no real programming ability regularly compromise the Windows *minority* in server-space.
As for home Windows boxes, they are about as secure as an unlocked convertible left in Queens in a lighted, deserted area at night with the keys in the ignition, the top down and the signed pink taped to the wheel.
Their argument is akin to stating that if as many folks drove Ferraris as had Ford Explorers, they'd be involved is as many roll-over accidents.
The fact is that they [Unix and work-alikes as compared to Windows] are very different beasts, but sheeple such as they will never understand why any more than Jerry Falwell will ever see any good in Hinduism.
So, use OS/FS with confidence. At least it's evolving by leaps and bounds, whather than being hidebound and stagnant.
Cheers,
Russ Bixby, geek of the plains
Power without wisdom is akin to an adze with a ruined edge, suited more to the vandal than the builder.
by apotheon
by bixbyru
Neither Red Hat nor Novell (a large patent holder, by the way) is creating open source software and selling it.
The stuff they sell is either proprietary management software - which may or may not involve TCP/IP, the double click or other "patented" software - and selling that.
Also, they sell services.
Going back to the turbine analogy, someone who builds generators for me to hook to my GE-copy turbine or another someone wrenching it for me is not liable to patent litigation.
Cheers,
Bix
by kaceyr
No, the software vendors don't always take responsibility for their software, and I agree that it's ludicrous for Microsoft to charge anything for helping someone get XP SP2 to work properly.
As for www.mozilla.org being pretty foolproof, one of the threads of this discussion talks about when a DNS server has been compromised allowing someone to fake a site such as www.mozilla.org. Is it likely? Probably not. Is it rare? Extrememly. Is it possible? Absolutely. That's why it's important to not only try to verify where you are, but what you're getting.
by gryfon
This was my point, although the tea had not kicked in completely when I wrote that.
There IS no safe computing, just as there is no privacy on the web. Many, many users don't realize this. Any data transmitted online has the capability of being intercepted or mis-directed. User education is the only way to effectively combat this problem and win this war (and it IS a war). Have you seen the DDoS attacks on the Spyware Removal sites/forums?
Heck, bank sites are being re-directed, and that's much more likely than someone making a whole new Firefox. Besides, why spend all that time going after 5% of the browsing population, when there's still that big ole 85% of Microsoft clients to go after.
I guess I just think you're chasing after ghosts with this. It's like that old 'international date line' problem... :-D
But all efforts to raise awareness are to the good, in my mind.
Cheers!
Gryf
by gryfon
Found this seconds after finished posting. Form wouldn't let me edit.
Banner Ad hijacking:
You have a point with your post. However...
- Only download products (commercial or open-source) from a trusted site. You would not download Internet Explorer from www.crackz.net.ru would you?
- Test your system first before going live. Do not blindly trust marketing blah-blah (this goes for commercial and non-commerical products).
- Do not rely too much on the software supplier liability. I know trials and laywers are in big demand but you may have problem convincing people that a specific piece of software is solely responsible for the problem. Therefore you may have problem pointing your finger at someone.
- Last but not least. In practice Open Source software are as safe if not safer than commercial product. And this is a fact.
At the end of the day, what determines if a product is good or not is the employees who designed/produced it. A Microsoft employee may not be as enthusiastic and thorough in his/her work as an open-source coder who is fully dedicated to his/her project...
by mike
by kaceyr
A point that applies equally to both Open Source and proprietary software.
It doesn't matter how many sets of eyes are looking at it, if someone is clever enough, they can (this does not imply that they will) build something that will slip past scrutiny whether their working for Microsoft or a project in the Open Source Community.
by bixbyru
...and all us oldsters know 'bout it.
BTW, as someone who started designing and building his first computer - the processor itself, instruction set and all - one transistor at a time starting in '72 when he was ten and first getting it to work two years later, I qualify as an oldster.
The following has actually been done for SELinux, by the way.
One uses "Tiny C" to build the C compiler and standard libraries from trusted source, then re-compiles the C compiler and libraries with the compiler they just built.
One then compiles everything else with this freshly built-by-itself compiler.
The Tiny C is in turn written in macro assembler, and the assembler is written simple assembler.
The simple assembler is written is straight machine code.
This provides a one hundred percent secure code tree, assuming one has properly audited the relevant sources.
While this does not account for the possibility of a hacked BIOS on the mainboard, a SCSI host adapter or some such, these are rare indeed, although not unheard of.
There was the case of a miscreant altering the operating software to an aftermarket keyboard, causing it to type out "Welcome Datacomp" (whatever in Hell that means) at random intervals.
It took me quite some time to discover that the root of that evil - this was on my own computer - was not a virus, trojan et cetera.
In other words, anything is possible, but things are not so dire as the FUD-meisters would have us believe.
Narf,
Bix
by jim
"Can" is a dangerous word. Any site can be compromised. A more informed set of questions might be.
1. How hard is the site to crack.
2. How likely are the administrators to catch and rectify the intrusion.
3. If the site in question is hacked how likely are you to hear about it.
IMHO Most commercial software vendors (MS especially) lack the credibility of say Sourceforge.
by kaceyr
by kimdouglas
Notice the Open Source software didn't come from the production version of the code automatically giving the person nowhere to go for support. Why would the developers of firefox help if the executables didn't match the prod version.
And then, the proprietary code did match the original. And the nice friendly software manufacturer was ready, willing, and able to help. Yea right, try and call Microsoft with this type of problem if you don't have one of their high-end support contracts. And even then!
I wonder how much this author was bribed to publish this type of non-sense from the proprietary software manufacturers?
by kaceyr
I don't accept bribes. If I did I would have made my fortunes years ago compromising systems and retired to a non-extradition country.
Instead, I continue to build my client base by writing software and being a consultant that they can come to with a question even if I'm not on contract to them at the moment.
by zaferus
Is there really any better recourse for most commercial software? What if browsing the Internet with IE you automatically install some spyware and worms with the current iframe vulnerability. And through this your system is slows down and crashes, data is corrupted or deleted and your network and business is disrupted? Will Microsoft accept responsibility and "make it right"?
Don't hold your breath...
If you've ever seen Microsoft's legal agreement it basically states "no matter what - we're always right, your always wrong".
This analogy for firefox is really no different than the inherent problems with commercial software. While I agree in house support can be increased with open source, I think that there can be a balance in a network using open source in many places to augment a businesses security and functionality.
And I think firefox is definitely a step in the right direction.
by sd_bert
by jim
by tony_moey
What happens if i ask u this: is corporate greed worse than personal greed?
You see, in OSS, there is a possibility of one or two bad apples injecting malicious code...however, in proprietary software, there is the possibility of one company with hundreds of programmers "forced" to inject malicious code which then cannot even be revealed !...or it could be quietly covered up or even modified before being opened to scrutiny!
by kaceyr
by no one
OSS vs. proprietary software is not the argument that should be made in my opinion. They are not mutually exclusive. For instance a small company desiring a low initial cost of ownership may be very happy to spend a few more man hours working with an OSS product. As the number of users and supported infrastructure grows, a larger company may see significant benefits (such as a reduction in administrative overhead) by being able to automate and manage servers, workstations and software at an enterprise level with the click of a button. Not to say that OSS cannot also perform that function, but many are not there yet. This might be because companies such as Microsoft have money to spend on focus groups to help determine the optimal design of their user interface, or the features which users desire.
MS as a single unit is only an illusion. For instance a support call under an SLA is actually routed to a call center, which could actually be a third party vendor. This is no different than hiring a consulting firm who specializes in a particular OSS, with an SLA.
Everyone would like to tell you that they have the most secure software. Certainly more eyes looking at code helps to find bugs and improve the design. However, with OSS _you_ can audit the source code if you desire. More than audit you can make changes where necessary. Certainly many people would judge this as impractical, but the ability is there. This further enables corporate software design policies to accept only maintainable code, which is less likely to have bugs that are often introduced with spaghetti like code.(and of course you have no idea what pre compiled code looks like in source form)
Many OSS projects have no product lifecycle announcements and may just disappear. But this is not unlike the .com's. But unlike the .com's, the code is there for you to develop if you desire. Further it may even be possible to find old OSS for a specific problem, even if it hasn't been developed in a long long time.
This is certainly not to say the there is one correct application or operating system or that OSS is superior. You need the right tool for the right project. Unixish OS's aren't the best for everything, but neither is Windows. Sometimes you don't get to choose, such as when a client or application requires something specific.
In my experience people would like to simplify things and form stereotypes. Free or low cost seems to imply a toy or a lack of professionalism. The same thing applies to security. People would like to have a construct that enables them to say that a product is provably secure. This is not possible. With an unlimited number of possibilities (possible input), we can only prove that software will react in a way which we have tested for. Thus a well designed OSS product is no more secure than a commercial product. (except that external input and review _might_ be from a larger or more diverse group). Thus the people using the software, wheather OSS or not, face the same security and development challenges.
Last but not least is the end user. They are possibly the weakest link in the chain, but often the source of profit for a company. Not only must users be trained how to use software (and OSS may have a different look or feel), but the proper procedures must also be in place to ensure that it is configured correctly and used per a company policy. It doesn't matter how great your product, OSS or otherwise, is if no one can use it.
by bixbyru
The OS/FS community tends to be pretty good about taking our lumps when due.
We don't deny the problem, force customers to sign NDAs or utilize gag orders to keep our foibles out of the public eye.
We just pay our debts, fix the bugs and press on.
Bix
by jkevinm80
by apotheon
by ohir
First: Digital signing of software packages is
long known to open source community and
IS/WAS USED for years. On many contemporary
distributions check is mandatory and you have
to knowingly say "yes-install-anyway" if signature
on software is incorrect. MS only recently with
XPSP2 gave similar funcionality to its userland.
Before XPSP2, checkin' signatures was only for
activeX downloads and kernel level modules
(drivers). Usually turned off by users anyway.
More details: man your-package-manager.
If you dare to at last install Linux and see.
Second: Last time I saw licence agreement with
partial responsibility of sw vendor 20 years ago.
None vendors are responsible.
Third: as digital signature checking is default for
most open source distros/OSes, even in case of
compromise of sw package distibutor the time
gap to find it is very short. Ones I recall were
accordingly 6, 3 and 5 hours.
Fourth: even in case that compromised is the
very source of software, the developer himself,
anyone can and will find and _prove_ it. Why -
because anyone _has_source. Last time of such
happening was with a comm package. Found
by the OS community within a week. You never
will know whether your properly workin' digitally
signed, heavily paid onscreen dildo has or has
not a backdoor.
This post is worsest FUD I saw since 'TCO
campaign'.
ohir.
by kaceyr
You seem to be quick to disregard the discussion as a whole, but you've clearly not read all of the posts.
First: There are posts dealing with the possibility of faked binaries, complete with their own digital signatures.
Second: Pretty much everyone agrees that the license agreements do nothing more than provide fodder for laywers.
Third: See first above.
Fourth: No one has contended that the problem would not be discovered or fixed. In fact, the contention is that the Open Source Community would find the problem and provide a fix faster than a proprietary vendor.
"worsest" ????
by ohir
First: if the signature is intact and is done with
vendor's private key, binary - whether
backdoored or not - comes from vendor.
Regardless of source openess or price of the
software. That's how cryptography signature
works.
Second: omitted. this point laughed by all, You
have understood.
Third: original post alluded that open source
software can not be trusted due to lack of
knowledge of origin; alluded that _only_ vendor
XYZ software can be checked cryptographically.
Excuse me, but I don't believe that such a logical
flaw as seen in your post was unintentional. So I
called it real name. Truth is, that linux users has
had, had understood and were using digital
signatures on software packages long before
XYZ userland.
Fourth: You did. In original post.
ohir
by apotheon
I'm afraid I don't buy the MS claim that Server 2k3 is their most secure OS. Many of its exploits haven't been identified yet. It solves a lot of exploits that existed in earlier Windows OSes, but I'm sure it creates a lot more that nobody has (publicly) identified yet. I rather suspect that Windows 2000 Server makes a more-secure OS than Windows Server 2003.
I could be wrong, though. You might be right. Judging by the fact that XP looks like Swiss cheese beside Win2k, though, and it's the intermediate step between 2k and 2k3, that doesn't really bode well for 2k3's security.
by kaceyr
by apotheon
That's a point that I've been trying to make for some time ? that you can have the corporate backing you want, even with OSS. You're not left twisting in the wind just because the software is open source, if you don't want to be.
The difference is that you also know exactly what the software contains because it's open source, and it gets more peer-review, not to mention that Unix is just a better platform for most purposes.
by apotheon
by apotheon
It's not entirely true that the chief motive of a corporation is profit. Corporations are actually promarily after market dominance. Pure profit is a close second. The reason for that is that the people in the boardroom have a harder time wrapping their brains around objective numbers, and like to see their investments compare favorably with competitors. That means that profit isn't enough: the competition also has to fail.
The result is that corporate boards want to maintain market dominance. They want their corporations to pretty much own the industries in which they operate.
In any case, your main point stands: corporations are first and foremost motivated by market dominance (which includes a profit element). The important complement to that is that creators of open source software are first and foremost motivated by the desire to create good software.
I'd rather support the creation of good software than the creation of market dominance, especially since market dominance produces industry stagnation. More to the point, I'd rather reap the rewards of the development of good software. As such, I standardize on open source software here, using the best development platform available: an open-source Unix-like OS.
by poomba1
Every time someone wants the Gov't to handle MS, I just shake my head. I can think of an equal amount of poor management decisions that has helped MS. Novell and Word Perfect come to mind, what a screw up that was. If you haven't been around long enough to remember, it was the constant crashing of WP 6.x (yes even in DR DOS) that was it's demise, it sure wasn't MS Word.
What concerns me more, is this mantra of free with open source and then no one can understand why all the I.T. good paying jobs are heading over the border. Gee, I wouldn't want to R&D anything with my resources either if there was no reward to it. Nothing in the world is free, I wish people would stop making I.T. a "free service".
by apotheon
You can also, of course, get software directly from Linux retailers, if you really want to have corporate assurance that your software is not compromised. In addition, because it's open source, the corporate backers will A: have to keep prices reasonable to stay competitive (less than $100 for an OS, as compared to the $300ish that MS is charging these days) and B: find it very difficult to lie convincingly about the software they provide.
While we're at it, download servers run by Microsoft use MS OSes, and download servers run by open source software companies and projects use open source OSes. Meanwhile, proxy and firewall security for open source software companies and projects is on open source OSes, and the proxy and firewall security for Microsoft is handled by a third-party service provider that uses open-source OSes.
When Microsoft bought Hotmail, they tried to switch the system from, er, BSD I think it was, to a Windows OS. They failed. No Windows server OS yet developed can handle the resource management needs, particularly as applies to remote management procedures (effectively what you're using when you visit the Hotmail site to manage your account) because of the bandwidth waste in Windows OSes.
by apotheon
Actually, you can get far better help from OSS community efforts than you can from Microsoft. Join a local LUG mailing list. They're everywhere, and they're full of knowledgeable, friendly people willing to share their Linux expertise for free.
That's tough to beat.
by apotheon
by skipc
From the email newsletter topic:
FEATURED DISCUSSION: OPEN SOURCE SOFTWARE VS. PROPRIETARY SOFTWARE
I won't quote the rest, but in reply to the points offered:
- You downloaded Firefox off an unknown third party site most likely AND you didn't check the signatures first? That takes LESS time than what you go through for purchasing proprietary s/w, yet you didn't do it... Consider it your punishment!
- If this happens with your proprietary s/w, do you REALLY think you will get anything but denial from the manufacturer?? You've obviously never tried this before ;-) It will take lawyers to get attention, and more $$ than you probably lost.
- AND, you should read the license agreement. I haven't found one in which you don't agree to hold them harmless and you agree that they are not responsible for any loss or damages. The MOST you should be entitled to is a REFUND of your purchase price according to your agreement.
Now, if you're savvy enough, AND this is a legitimate problem with the open source program, you can check it. However, the initial premise is apples and oranges. In one case, it's a distribution channel issue, which is not entirely open source related, and the other is a programming error. I think it's interesting that in this scenario, the open software wasn't flawed, but the other was.
Skip
by adamrosshill
First of if you were to download the file that was *hacked* then you would know where the server you got it from was. Or at least you should. If you knew who provided the file and was distrubiting the file that person is held responsible for file re-distrubution. Even under the GNU/GPL. If you lose data due to someones mal-content you have legal grounds for a privacy case against them. It's not that open source is flawed it that's people are flawed in intention. If your worried and don't know what you are doing then don't install the files if you trust the code.
I think it's a beautiful concept that we are able to view and modify the source code to programs. Then we know exactly what they are doing to their system. You also have the option to fix that bug in that release or remove the software. It is highly unlikely that i browser hijack would install a trojan using fire fox.
It doesn't support active x controls which a majority of torjans are installed through. And the web browser it self does act as a file server to the system. It's a client, Microsoft I.E. doesn't support file server or directly connecting through the web browser etheir. I.E. security flaws are obviously tied to the operating system itself. And Windows SP2 has taken great strides to warn you that you are running a file. I check it asked me three times before i wanted to run an executable downloaded. And one more when i rebooted and it was added to the *run* key in the registry.
I think it's safe to say that you really need to trust the software that you use. and the Mozilla organization is a reputable company. Download from their servers or REGISTERED mirrros.
As for a hacked version, if you can pin-point the person who altered the code in a malicious intent. You will have legal grounds for invasion of privacy. At least here in Canada. I'm sure that the U.S. has similar laws.
i'm not trying to scare you away from open source. Like viruses and piracy education is Key. There are many people willing to help you learn the product you wish to use in the open source community. For free.
cheers.. and happy computing.
Adam
by apotheon
by tr
That's the problem, you show us a scenario in which you are clearly at fault then try to find a way to shift the blame to someone else. Sorry, you're in the frame. Please clear your desk and leave your security pass at the desk on the way out.
Your scenario might have been of more value if you compared like with like. What happens when you download a "closed source" product and later found that its checksums did not match those of a file from the manufacturer's site.
by apotheon
The Internet didn't start on Unix. It moved to Unix (all Unix-like OSes, as opposed to the trademarked, named OS known as UNIX) because that was the best tool for the job. The Internet started on the PDP-10 with OSes like TOPS-10, TOPS-20, MULTICS, ITS, and SAIL.
Your entire point falls apart. This has nothing to do with legacy compatibility and everything to do with using the right tool for the job. Even Windows systems approach POSIX compliance, and have the feature set necessary to act as servers for the Internet. They'll support BIND (developed in open source, by the way), DNS, and web services. The reason Unix is used in an overwhelming majority of cases is two-fold: total cost of ownership, and system security and stability characteristics.
In fact, the reason that Unix ended up being the backbone of the Internet is that DARPA specifically chose BSD Unix as the successor to the PDP-10 OSes. The reasons for that choice might surprise you. One had to do with the clean, solid OS architecture. The other had to do with the fact that the source code for the OS was open.
by apotheon
. . . and "the only way to ensure that your executable is as it should be" for closed-source, proprietary software is to, err, um.
Well. I guess you can't. You'll just have to take someone's word for it.
by apotheon
by kaceyr
by schimeck
Commercial vendors wouldn't release patches if all software weren't subject to human error and to the requirements posed by the enormously varied platforms on which software is expected to run. Your contention that companies' concerns about intrusion and espionage should lead them in the direction of commercial and proprietary software flies in the face of the fact that it is precisely such software which is the source or conduit of most intrustions and malicious acts which occur in the modern computing environment.
Having said that, I take issue with a number of the other points you raise. First, a bug (intentional or otherwise) which causes the user substantial damage will result in no better assistance from commercial software vendors than from open source. Have you checked out the vendors' liabilities in any commercial software licenses lately? If most corporate lawyers took their jobs seriously, or were asked for their opinions, very little commercial software would be purchased. Second, bugs are far more likely to be found and corrected when a large number of really motivated developers and users are involved than when a commercial entity is solely responsible for a quick response to a problem.
Not all users of open source pore over the source code; many, like myself, are happy to get their hands on high-quality, useful software which works and is FREE!!.
Finally, the risk of downloading a corrupted version of freeware is directly proportional to the professionalism of the IT staff in an organization. Just as most competent staffs have developed appropriate use policies for office computers (e.g. no games, no unauthorized software, no browsing of inappropriate web sites), a competent IT staff will download open source applications only from trusted sources. Why go anywhere else but Mozilla's site to download Firefox? If you choose to visit unfamiliar sites to obtain software, the resulting carnage is solely due to your carelessness, not to an inherent flaw in open source software.
by partley
Or, anyways, hold someone responsible for a breach of your system through their browser?
Have you had a situation where a breach of your network was caused by IE, and you were able to secure restitution from M$? I'd be willing to wager this is not as easy as you make it sound. Sure you have a legal recourse, but just you try taking advantage of it. Most business owners would rather rebuild their network than take M$ on in court. Unless you were referring only to other Really Big Companies? In which case i would agree with you that they should only use IE, or other "closed source" software. That would act as a check on M$ to help make sure they put out a good product. Small businesses should be able to use open source without any worries though.
You make an excellent suggestion to the makers of open-source software. Not that they should provide a compiler with their downloads, but that they need to demonstrate that their software can be relied upon to be "safe." I don't think it's too far a stretch of the imagination to think that organizations like the Mozilla Foundation are capable of demonstrating self regulation. Lately, i tend to think that this is more likely than expecting any corporation to do it, muchless M$.
by carlsf1
I tend to shy away form open source for this very reason you never know who's been playing with the code.
At least with MS XP PRO they are continually fixing the problems, but when you have every man and his dog trying to find a hole then it is a bit unfair.
I do admit that I find MS prices a bit steep and would suggest if they want to step out piracy then they need to review the prices they charge.
by rojackson
Probably the most naive part of your complaint against Open Source is your assumption that commercial vendors don't have their own "hooks." At least you can compile from the source and see everything with Open Source if you want to. You can't tell Big Bill, or Uncle Larry that you want to see under the covers.
As a matter of fact, MS has gotten caught with its hadn in the cookie jar more than once with special "features."
Give me Open Source ANY day.
by kaceyr
I would submit that you make the naive assumption that just because you can review the source code yourself, that you would be able to recognize every possible form of system "hook".
Yes, Microsoft got caught (a lot) through the diligent use of firewalls and the occasional packet sniffer. I would utilize both in my environment regardless of the source of the software.
This does nothing to mitigate any vendor trust issue on either side.
by bixbyru
...use those firewalls and packet sniffers with MS products now.
Doing so violates the DMCA, and you could get your nittle nubbies burned.
Bix
by mikefromco
I don't think you can say the original post is naive, then go on to say you can see everything in open source without being naive yourself.
You can actually review ten's of thousands of lines of code before you compile it? It's not even a challenge to bury 'hooks' in something the size of say, openoffice.
The original question was contamination which is inherently more possible in open source downloads on a variety of 'mirrors' than it is from a trusted site. But using trusted sources (for any download) minimizes that risk.
Far as liability goes, pfft, you best have deep pockets to sue software companies for O&E.
by bixbyru
Quoth MikeFromCO:
> You can actually review ten's of thousands of
> lines of code before you compile it? It's not even
> a challenge to bury 'hooks' in something the size
> of say, openoffice.
However, there's one salient fact you overlook: parallel policing goes hand-in-hand with parallel development.
One typically does not walk up and rob someone in the middle of a crowd unless they are very fleet of foot.
Why? There are a lot of witnesses, potential interlopers et cetera.
One needn't read every line of source for every line to be read, regularly.
While there is a vague and slight possibility for trouble of the sort KaceyR sugests, this is far more likely on the proprietary side of the fence.
Simply put, the only cases on record involve closed-source software. A ratio of 1:0 is pretty hard to ignore.
Bix
by ttg
Seems to me this is an issue of the honest and reliability of the download site. Nothing else.
The issue is getting an executable that does not match the released executable. A proprietary software company or distributor could as easily put in the same hooks in the posted executable just as an open source company or distributor might.
Here is another case where I'm inclined to disagree with the author of the original post, but after reading some of the replies, I am left feeling that most of the respondents don't appreciate how right he is. Open source has a cost model that is definitely not right for certain businesses because they can't protect themselves well enough in the case of unmet expectations. It's about whether the software does the required job at a desired level of cost. The risk associated with possible deficiency has a big impact on that cost.
One weakness of the open source model when it comes to business applications is that you need expert knowledge to make it work reliably. If something goes wrong, someone in the organization needs to be an expert or to navigate the labyrinthine world of open source to find one. You either need highly knowledgeable and experienced employees (and prepare to jump off a roof if they are lured away), or rely on a consultant. In effect, the service level agreement is not with the software manufacturer but with the expert services provider that does the install and management (be that an outside firm or internal employee or department).
This is the perfect arrangement for certain situations and not others. For businesses who would prefer to buy basic, shrink-wrapped software that interoperates well with software from other businesses but has no special features, the higher price and questionable stability are overshadowed by the lower maintenance costs. In some cases, open source is not only not the best option, it is a terrible strategy.
However, having an expert services provider accountable for software performance, instead of the manufacturer, could be a huge opportunity for cost savings, particularly if you needed an expert services provider anyway. That is where open source is and will remain a toolkit for quality, reliability, and innovation of terrific potential value.
by apotheon
"you need expert knowledge to make it work reliably"
You need expert knowledge to make any software, proprietary or not, work reliably in a production environment. If you don't have experts tending to the reliability of your software, you're asking for trouble. Without going into the inherent instabilities of many proprietary, closed-source solutions, regardless of how much you know about the platform when you use it, your statement is unsupportable in any meaningful manner.
I am a consultant, working with a professional consultancy in Florida. We provide on-site service to business clients regularly. Among those using heterogenous networks, with both Linux and Windows systems, we see how unapplicable your misunderstanding of the matter really is. When a Windows system breaks down, they have to call us to get it fixed. When a Linux system, er, well. If the Linux systems ever broke down, they would likewise have to call us to get them fixed.
The fact that many people think, as you seem to, that you don't have to know anything to make use of a Windows system is one of the major reasons that security hasn't been the sort of top priority in the eyes of the public that it should have been for the last twenty years. As a result, closed-source software companies have designed for bells and whistles rather than for security and stability. When people fail to be properly knowledgeable about system security, software tends to get designed more for eye candy than security when market dominance is the designer's goal. Open source developers have other goals than that, like the desire to produce the best software they can. After all, most open source developers work on a project because they want to use the resulting software, not because they have been told to by a pointy-haired boss.
I have no idea how you figure that buying closed-source software in any way provides more software interoperability and lower maintenance costs. For one thing, you don't explain it, and for another, my experience is the opposite.
by kaceyr
by dean0
"The only way to ensure that your executable is as it should be is to perform a comprehensive review the source code and to recompile it yourself."
Not true. Certainly if you want to review the code to see if and how it does what you want it to do then you will want to review the source code. Otherwise, you can download executables and checksums from a reputable source and do the sane thing and check the checksum. To use your example, if you are downloading Firefox from a site that is not recognized or sanctioned by the Mozilla team then you are being foolish for no good reason.
"I can, very easily, set up a distribution web site . . ."
For what? If you have an open source project and you try to pull the stunt you described then the open source community will take care of you pretty quickly. News of a deception of this type would spread more quickly than any virus, worm, or Trojan you might create.
"In addition, if you have the time and intellect to review and completely understand the source code, why are you wasting your time downloading someone else's product when you can make your own with the same level of effort?"
Just a second, I'm going to write your info down just to make sure no one I know will hire you if you apply for a developer's position. The level of effort required to read and understand well written source code is nowhere near the level required to create well written source code. Your assertion flies in the face of good development practices, specifically the concept of reuse.
"The signature of the executable doesn't match ANYTHING the original developers have ever released."
Then you didn't download and install Firefox, did you? You downloaded something that claimed to be Firefox from somewhere else.
". . . ABC product from XYZ company. The file signatures are compared and, sure enough, they match."
Unfortunately, this scenario is far more likely to occur than the open source scenario you described. You bought or received a flawed product from a company. The "file signatures" prove the product was flawed. Unfortunately, the product is proprietary, so neither you nor anyone else you know that doesn't work for XYZ company can fix it. Now you're stuck with a flawed product, lost and damaged data, and an End User License Agreement (EULA) that almost certainly says that the product was sold to you AS IS and that XYZ company cannot be held liable for any damage that results from the use of their software.
"Companies today are very paranoid (and rightly so) about system intruders and industrial espionage. With this in mind, why would you turn to Open Source software?"
I think I answered this already. ;-)
by bixbyru
Quoth KaceyR:
>> In addition, if you have the time and intellect
>> to review and completely understand the source
>> code, why are you wasting your time downloading
>> someone else's product when you can make your
>> own with the same level of effort?"
Thus spake Dean0:
> Just a second, I'm going to write your info down
> just to make sure no one I know will hire you if
> you apply for a developer's position. The level
> of effort required to read and understand well
> written source code is nowhere near the level
> required to create well written source code.
> Your assertion flies in the face of good
> development practices, specifically the concept
> of reuse.
The specification for COBOL was created at a time when the world was quite paranoid and very few of these paranoid people trusted "those long-haired, bnearded, sliderule-carrying, scientific computer types."
A requirement was that a programme written in COBOL had to be understandable to a non-programmer.
That way you could get a trustworthy, short-haired, cleanshaven, all American Joe to verify that your system wasn't passing your hard-earned buckaroos to the Ruskies.
That's why it's so verbose and clunky, although for form-stuffing, accounting and database stuff it's great.
Bix
by bixbyru
Many of the arguments in this forum have to do with whether OS/FS is ready for prime time.
Concerning "enterprise ready," I believe Unix et al (including Linux) is ready for the enterprise and that Windows is not.
Somewhere we've lost touch with what the enterprise is.
That a Linux infrastructure requires skilled management and some customization is no barrier to its being "enterprise ready."
The enterprise isn't Joe consumer who buys a computer, takes it home and expects it to unpack itself, waddle over to the 'phone line, jack itself in and dial up AOL.
Enterprise computing was built on Unix, VMS, IBM mainframe systems and their kin, not the relative ignorance of the modern consumer.
BTW, "consumer" is in and of itself an evil word. We lost an important facet of this culture with the growing disuse of the word "customer" as in Microsoft-customer relations.
A retail store will spend thousands of dollars on custom counters and fixtures.
A larger company might spend a quarter of a million dollars per floor on buildout when they move into a building.
The enterprise needs a reliable, flexible IT infrastructure and that requires a substantial investment. Only recently has this been poorly understood.
The advantage gained by using comodity hardware and avoiding the costs of proprietary systems is lost when companies stop using comodity operating systems and infrastructure software in favour of a broken, proprietary operating envirnment.
Many pointy hairs bought the MS Party Line about "easy to install and manage" and their bald faced lies about security and reliability.
It never entered their empty little heads that inexpensive hardware breaks more often than do server grade systems and that the "network operating system" Microsoft hawks breaks more often than a Yugo. A mumbled "That's the fault of the administrators" is the usual riff when things go horribly awry.
'Course, when the "administrator" is untrained because "MS is easy to administer," they really are in part to blame, but it is more the fault of marketroids, ignorant, "consumer grade" managers and the designers of the dysfunctional "NOS."
In reality, the enterprise needs Mack trucks, IBM or comparable servers, Snap On tools, decent shelving, durable carpet et cetera.
Cheap doesn't cut it. There are many nasty prhases such as "the easy way out" and "the path of least resistance." There's a reason for that, and MS is the "easy way out."
People expect to expend no effort, and indeed do expend very little effort up front.
Then come SQLSlammer, MSBlast et cetera. Then comes a clogged registry and "old Windows disease." Then come weekly patches which frequently break things. Then comes Windows Hell.
The enterprise needs to get off its collective duff and remember that it gets what it pays for, and that to get things done right it needs to do them itself.
Read the above as "a real IT infrastructure and the expertise to make it work," rather than so-called "easy to use" crapware and toweringly ignorant "engineers."
Being a EE I can say that. Software "engineers" and MCSEs frequently operate in an environment free of accountability.
I operate in an environment of accountability. If I screw up, a building might burn down and a thousand people die.
That's what being an engineer is.
Reliability is not optional, and those who would sacrifice security and reliability in favour of a little temporary convenience deserve none of the above.
Cheers,
Bix
by bixbyru
Many of the arguments in this forum have to do with whether OS/FS is ready for prime time.
Concerning "enterprise ready," I believe Unix et al (including Linux) is ready for the enterprise and that Windows is not.
Somewhere we've lost touch with what the enterprise is.
That a Linux infrastructure requires skilled management and some customization is no barrier to its being "enterprise ready."
The enterprise isn't Joe consumer who buys a computer, takes it home and expects it to unpack itself, waddle over to the 'phone line, jack itself in and dial up AOL.
Enterprise computing was built on Unix, VMS, IBM mainframe systems and their kin, not the relative ignorance of the modern consumer.
BTW, "consumer" is in and of itself an evil word. We lost an important facet of this culture with the growing disuse of the word "customer" as in Microsoft-customer relations.
A retail store will spend thousands of dollars on custom counters and fixtures.
A larger company might spend a quarter of a million dollars per floor on buildout when they move into a building.
The enterprise needs a reliable, flexible IT infrastructure and that requires a substantial investment. Only recently has this been poorly understood.
The advantage gained by using comodity hardware and avoiding the costs of proprietary systems is lost when companies stop using comodity operating systems and infrastructure software in favour of a broken, proprietary operating envirnment.
Many pointy hairs bought the MS Party Line about "easy to install and manage" and their bald faced lies about security and reliability.
It never entered their empty little heads that inexpensive hardware breaks more often than do server grade systems and that the "network operating system" Microsoft hawks breaks more often than a Yugo. A mumbled "That's the fault of the administrators" is the usual riff when things go horribly awry.
'Course, when the "administrator" is untrained because "MS is easy to administer," they really are in part to blame, but it is more the fault of marketroids, ignorant, "consumer grade" managers and the designers of the dysfunctional "NOS."
In reality, the enterprise needs Mack trucks, IBM or comparable servers, Snap On tools, decent shelving, durable carpet et cetera.
Cheap doesn't cut it. There are many nasty prhases such as "the easy way out" and "the path of least resistance." There's a reason for that, and MS is the "easy way out."
People expect to expend no effort, and indeed do expend very little effort up front.
Then come SQLSlammer, MSBlast et cetera. Then comes a clogged registry and "old Windows disease." Then come weekly patches which frequently break things. Then comes Windows Hell.
The enterprise needs to get off its collective duff and remember that it gets what it pays for, and that to get things done right it needs to do them itself.
Read the above as "a real IT infrastructure and the expertise to make it work," rather than so-called "easy to use" crapware and toweringly ignorant "engineers."
Being a EE I can say that. Software "engineers" and MCSEs frequently operate in an environment free of accountability.
I operate in an environment of accountability. If I screw up, a building might burn down and a thousand people die.
That's what being an engineer is.
Reliability is not optional, and those who would sacrifice security and reliability in favour of a little temporary convenience deserve none of the above.
Cheers,
Bix
by doyle.jack
I think you are worrying about something not worth worrying about.
Even if you don't examine the code, plenty of people do. If the author were being shady and it's a popular enough piece of software that more than a handful of people are using it... it wouldn't stay a secret for long.
by doyle.jack
by bixbyru
Australia has a system which is open source, has paper backup and is one hundred percent reliable.
Many attempts to hack it both as tests and by bad people - have failed.
As far a poker machines, the code is required to pass a peer-review process and is actually quite "real"
A pseudo-random number is generated from noise on the power-line, user input et cetera - it's very random - and then used to "shuffle" the "cards."
This shuffled deck is then played, both by you and by the expert-system which is the poker machine.
It's all quite honest, except for how well the machine plays.
It'll play less well to hook you, then turn into a shark.
Still, the deal's fair and forthright.
Bix
by kaceyr
by calson
If it is assurance you are looking for, get a red hat enterprise system with support. You are guaranteed to get a stable system with code that is not downloaded.
That's the great thing about open source, it gives you options.
by kaceyr
by kaceyr
but your point about parallel policing is one of the stronger arguments favoring Open Source software.
If you really don't think people get robbed in the middle of a crowd, you haven't lived in New York, Chicago, or Los Angeles!
by kaceyr
First: "... and is done with vendor's private key...". This is NOT always the case. There are MANY Open Source packages available that provide nothing more than an MD5 hash signature. Further, if the individual creating the problem happens to be someone who works for the vendor and is responsible for packaging, they will already be signing the tainted package with the vendor's own private key.
Second: Okay, it does give us a chuckle.
Third: The original post only alluded to the possibility of a single person being able to "sneak" in a piece of malicious code, or to falsify the download site.
Fourth: I certainly did not. I questioned the responsibility factor of the vendor.
by ohir
First: "There are MANY Open Source packages
available that provide nothing more than an MD5
hash signature...".
There are only a bunch of XYZ packages
carrying digital signature. Rest of XYZ world
provides neither source nor signature on binary.
On the opposite, there are tens of thousands OS
software packages with both source and binary
signed. To name a few, RH or Mandrake Linux
distributions. Each and any package signed.
"...happens to be someone who works for the
vendor..." If this was maintainer, such tamper will
soon be discovered by author. If it was an
author himself - such case will be discovered as
soon as competing distro vendor will do a diff
over sources to see what competitor tweaked.
Such diffs are done routinely. Because there are
many vendors, because all have the code.
Fourth. Since years there is no responsibility (in
legal terms) of the vendor. But in buisness terms
responsibility in Open Source world is perfect.
One such a case may drive distro vendor out of
business. Today I am using Konqueror,
tomorrow I can switch to Firefox. Todays'
RedHat can be painlessly and with almost no
cost switched to SuSe, Mandrake or - with more
spending to next fifty different distros.
Being trojaned by XYZ emploee intails that you
may switch to.. hm.. to what vendor?.. Ah! XYZ
vendor.
ohir
by pickleman
For goodness sakes, let it go already.
How many times have you ever heard that a legitimate site was "overtaken" by hackers, and then the site was flooded with fake software with built-in backdoors, and then nobody ever caught it?
The answer is simple: it has never happened.
In the unlikely event that a legitimate site gets hacked, the worst that usually happens is a couple hours of downtime while they sort it out. In 99% of all "site hacks" it's nothing more than a DoS attack.
Have you ever heard of a single case where a company's site was taken over and then infused with a bunch of fake software?
I know I haven't, and I'm willing to bet nobody else has either.
As many people have already told you, the answer to your "problem" is very simple: check your signatures before and after you download.
by piedad
There is so much claims of an opperating system or software
being less secure simply because a trojan was created for it,
similar to the argument of this topic's author. Come on.
Anyone can create a trojan software for any system, no matter
how secure, simply because it works on the principle of fooling
the less knowledgeable into a false sense of security. You can
create a trojan program which erases all the files in a directory
and call it chkdsk.exe, post in on the internet, and surely
someone will download it and use it. Does it mean that DOS or
Windows is the culprit? Off course not - it is that person's
ignorance and poor security practice. When someone knocks on
your door claiming to be the police, do you open it and let him
in without checking his identification?
Open source software is not anymore prone to trojan attacks
than closed-source software, as I can easily virus-infect a
windows software and distribute it on the internet.
The point has already been said in another reply - that it is plain
common sense that you only download software, whether open
or closed source, from trustworthy sites.
To the topic author, please, do not spread FUD about Open
Source when it is obvious that you are just trying to put down
something you do not know much about. Open source software
is driving a lot of innovation that we do not see in proprietary
software, and is also providing the market competition that is
bringing software pricing to a more reasonable level.
by kaceyr
Trojan software is never a flaw. It's carefully cultivated, and the trojan code will probably work as well, if not better, than the host software.
We're not, necessarily, talking about a system utility, but a trojan stuck into the core of the product itself.
As for the downloading of software only from trustworthy sites, trust of the source is primary to the discussion.
by andrew.dyer
Kacey,
I fail to see how if "trust of the source [origin] is primary to the discussion" how this applies only to open source. Does not trust apply equally well to both closed and open source applications?
In fact, you bemoaned that you have to eyeball open source code for any backdoor/trojans contained therein. I can understand that would be a pain if you felt the need. But at least you can. How are you going to do that with closed source exactly?
by bixbyru
The article stated that the archives were *not* compromised.
So someone broke into a handful of boxes there - it's rare, but not unthinkable.
Noone ever said that Linux et al was impossible to hack, just that it's rather difficult.
Windows, on the other hand, spreads 'em for any Thom, Dick or Harry.
Bix
by apotheon
I'd dispute the claim that no corporations are creating open source software and selling it. RHEL and SuSE Linux are OS-and-software bundles that are (at least primarily) open-source, and both Red Hat and Novell are indeed selling these solutions. Much of the software these companies create and/or modify for use in their OS bundles is sown back into the OSS community, generally as GPL software. If you've heard of the RPM, you've heard of software that was created by Red Hat and made open source. The RPM is the single most commonly used software package format in use today in Linux systems. Even SuSE uses it.
That aside, however, I wasn't even talking about them creating and selling software. I was talking about the fact that they profit from distribution of open source software (like the Linux kernel itself, as well as window managers, services, applications, and numerous utilites) that may become a target of later patent suits.
by bixbyru
not as in lunch. A concept the Moral Majority and the Busheviks disparage but have yet to kill.
The savings with OS/FS can be huge so long as you have the expertise to make things work.
So can the savings to a company which maintains its own fleet rather than going to the dealership for service.
If, on the other hand, you throw untrained fools at your infrastructure, you get what you deserve - whatever OS and applications are involved.
Bix
by madgeorge
KaceyR, you guys in the Micro$oft FUD Department miss 2 points:
It's about managing complexity. Either you pay someone - like Micro$oft - to take care of all your problems for you, and accept what you get, or you pay some attention to things like checksums, and automake, and take charge of your life. Hit a reputable site and look at LibraNet to see how painless this can be.
And it just doesn't happen. For all you Linux-will-fail doomsayers, when did a large segment of THAT Open Source society ever get hit? Even with 3 times the web server presence of Micro$oft IIS, it's Micro$oft that makes the news.
Sort by Trending