MESSAGE
| DATE | 2015-11-08 |
| FROM | Ruben Safir
|
| SUBJECT | Re: [Hangout-NYLXS] Fun with FUD in the largest Washington Post
|
On 11/08/2015 10:47 AM, Rick Moen wrote:
> Quoting Ruben Safir (ruben-at-mrbrklyn.com):
>
>> Linux sucks... hat is he short version
>
> Extremely useful. Thanks!
>
> _______________________________________________
> hangout mailing list
> hangout-at-nylxs.com
> http://www.nylxs.com/
>
http://www.itwire.com/opinion-and-analysis/open-sauce/70263-linux-security-circling-the-wagons
Linux security: circling the wagons
09 November 2015
By Sam Varghese
Published in Open Sauce
Linux security: circling the wagons
People who belong to the free and open source software community have
one trait in common: they are extremely sensitive to criticism of any
kind of the software that belongs to this genre.
Nothing else can account for the reaction that has been forthcoming
after the Washington Post published an article on Linux a few days back,
a fairly long and detailed account that in the main cast doubts on the
security afforded by the kernel.
The article is the fifth in a series looking at the security of the
internet broadly, and the first article was published back in May. The
five pieces are being sold as an e-book for US$2.99. Yet many FOSS
people did not even bother to note this and assumed the worst.
Leading the way was Jonathan Corbet, editor of a website called Linux
Weekly News, that advertises itself as "a reader-supported news site
dedicated to producing the best coverage from within the Linux and free
software development communities".
Corbet wrote a lengthy piece about the Washington Post article, failing
to even notice that it was one of five. "It is not often that Linux
kernel development attracts the attention of a mainstream newspaper like
The Washington Post; lengthy features on the kernel community's approach
to security are even more uncommon. So when just such a feature hit the
net, it attracted a lot of attention," Corbet wrote, before making the
most ridiculous comparison that one can.
He likened it to a report issued by a company called Mindcraft in 1999
which claimed that Windows NT was a much better server option than Red
Hat Linux 5.2 and the Apache web server. In the end it emerged, that
this pure Microsoft-funded FUD, with the Linux server used for the
report having been badly configured and the hardware chosen not well
supported by Linux.
But the Post article was far from this category and the comparison was
ludicrous. That it should come from Corbet of all people, a kernel
developer and one who claims to be punctilious about his writing,
illustrates the characterisation I have made at the start.
As to the Washington Post article itself, there were many bloopers, but
that is not surprising. It happens in the mainstream media all the time.
The author, Craig Timberg, has as his thesis the claim that the kernel
is lacking in security and that Linus Torvalds does not accord it as
much priority as he should. A number of security "experts" are quoted to
buttress this claim.
Corbet did take this criticism on board and suggested that this was the
kick up the pants that Linux developers needed to devote more emphasis
to security.
But Timberg did not bother to check what may be motivating some of the
critics. He had a negative quote from former kernel developer Matthew
Garrett who now works for CoreOS as principal security engineer; the
company produces an operating system based on Linux.
Garrett has no great security credentials and has had a number of spats
with Torvalds, the most recent being when he tried to get some code,
that would allow Microsoft's secure boot technology to work smoothly
with Linux distributions, into the kernel. Garrett did not clue Timberg
in about his issues with Torvalds; he appears to have been happy to get
the publicity and, in fact, in publicising the article on his own blog
did not even mention that he had been quoted therein. Intellectual
dishonesty is a mild description.
The exchanges that took place with Torvalds are enumerated here and they
were not pretty. More recently, Garrett forked the kernel and created
his own branch in which he included some features that he had once
proposed be added, but which Torvalds did not approve of. Thus, to ask
him to evaluate the approach Torvalds takes to security was a mistake.
That Timberg did not ascertain the background to everyone he quoted is
rather lazy. Some of the others who were quoted, like Dave Aitel of
Immunity, have much more credibility as security industry professionals.
There are plenty of others in the US like Bruce Schneier, Richard Forno,
Oded Horowitz, Chris Eng, Kevin Dunn, Neel Mehta, Mark Dowd and Marc
Maiffret, to name just a few.
Some of the examples that Timberg listed as showing bad security in
Linux are laughable. He mentions the Heartbleed bug which affected
OpenSSL, certainly not a part of the kernel. He also cited a security
issue with bash, a shell program that again has nothing to do with the
kernel. And to top it off, he threw in a reference to the hacking of
Ashley.Madison.com, which has as much to do with the kernel as a bowl of
curry does.
It is rather surprising that when considering security on the internet,
Timberg did not devote at least one article to the cascade of security
issues that the billion-plus computers running Windows pose. While there
are many improvements in the latest version of Windows, the default
settings are rather liberal. The lack of any discussion of the company
that has been described as the Typhoid Mary of the Internet does tend to
undermine the credibility of the Washington Post's Net of Insecurity series.
But then if one did mention Windows as a security risk, perhaps all
those new shiny Surface Pro 4 ads that are seen everywhere these days
would not eventuate.
_______________________________________________
hangout mailing list
hangout-at-nylxs.com
http://www.nylxs.com/
|
|
