- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
OSS attacks will grow with adoption
|
|
|
Comments (17)
ouch!
Man, reading that is like getting whipsawed. They kept trying to say OSS (notice the glaring absence of the F) presents just as juicy a target as MS-ware, except that it doesn't, so OSS adoption should be very careful and scary, except that proprietary software has a much worse security record, so you better watch out for that bad OSS. Except for it being better.
That pretty much sums it up. The Microsofties FUD tactics have always included the idea that Linux (or UNIX or MacOS) really isn't more secure. Since nobody uses Linux nobody bothers to attack it. They have all their (oft debunked) numbers to prove that nobody uses Linux and that somehow proves their case that Linux really isn't all that secure after all. The completely ignore the fact that servers, especially big iron, are much juicier targets than home PCs both because they are more powerful and because taking the right ones down would be truly disruptive.
Doesn't Linux have about a 26% marketshare in the server market, # 2 to Windows 36% or so.
Windows and Linux market share are the same order of magnitude.
Doesn't Apache have the #1 spot in webserving market share? Double IIS's market share. Yet IIS has many more vulnerabilities.
Most people fail to realize how big FOSS is. FOSS resources dwarf any single proprietary companies resources.
Remember Itanium? One of the big reasons it flopped was that Microsoft could not get out of Beta with their Itanium port of Windows. Intel customers wanted Windows (at that time). Microsoft did not have the resources to get the job done and deliver the product. Linux was ported to Itanium before the first Itanium chips rolled off the assembly line!
However, at the time, corporations thought of Linux as the 'cheap OS' you used for file servers on old cast off equipment. Yes national laboratories and research institutions were using Linux in super computing, but corporations don't hang with that crowd. The tech press told them Linux was for Geeks in basements and for cheap print servers on already depreciated cast off equipment. End of story.
How many of the new billionaires have based their tech start ups on Windows? Google? Amazon? YouTube?
Granted that Linux and FOSS has vulnerabilities, but they are fewer and the fixes come faster.
Security (natch) Savings (Uh, Free?) Speed (no drm, no anti - virus, no anti - spyware) Simplicity (just read a EULA)
Linux and FOSS give you all of these
Doesn't Apache have the #1 spot in webserving market share? Double IIS's market share. Yet IIS has many more vulnerabilities.
Most people fail to realize how big FOSS is. FOSS resources dwarf any single proprietary companies resources.
Remember Itanium? One of the big reasons it flopped was that Microsoft could not get out of Beta with their Itanium port of Windows. Intel customers wanted Windows (at that time). Microsoft did not have the resources to get the job done and deliver the product. Linux was ported to Itanium before the first Itanium chips rolled off the assembly line!
However, at the time, corporations thought of Linux as the 'cheap OS' you used for file servers on old cast off equipment. Yes national laboratories and research institutions were using Linux in super computing, but corporations don't hang with that crowd. The tech press told them Linux was for Geeks in basements and for cheap print servers on already depreciated cast off equipment. End of story.
How many of the new billionaires have based their tech start ups on Windows? Google? Amazon? YouTube?
Granted that Linux and FOSS has vulnerabilities, but they are fewer and the fixes come faster.
Security (natch) Savings (Uh, Free?) Speed (no drm, no anti - virus, no anti - spyware) Simplicity (just read a EULA)
Linux and FOSS give you all of these
Itanium isn't quite the flop you'd imagine. Instead of ending up in cheap commodity servers and desktops it ended up in HP servers higher up the food chain. HP still uses Itanium chips AFAIK.
Linux is given the credit for saving Itanium, since both SUSE and Red Hat had enterprise-worthy 64-bit releases long before Windoze.
The Itanic not a flop? Projected revenue was nearly 40 billion a year. They achieved less than 10% of that about 5 years later than planned. IDC says about 184.000 Itanium systems sold. That's total, not per year. Against what? 8-10 million x86 servers per year? I'd call that quite a big flop for an architecture that was supposed to grab majority market share in pretty much everything but the home desktop market.
Quoting:Low added that OSS may not necessarily be more secure compared to closed source choices, because of ownership. The vendor selling proprietary software is directly responsible for product quality and hence has a vested interest in ensuring timely product fixes, he said.
Which begs the question, "So how come their fixes are neither timely and, often, not effective?"
ta -
Because their warranties disclaim the living hell out of liability. I once took a contracts class from the guy who wrote the Lotus 1-2-3 license. He told us that it was written in a way that completely let Lotus off the hook for miscalculations, essentially requiring users to manually verify calculations.
Because their warranties disclaim the living hell out of liability. I once took a contracts class from the guy who wrote the Lotus 1-2-3 license. He told us that it was written in a way that completely let Lotus off the hook for miscalculations, essentially requiring users to manually verify calculations.
Quoting:He told us that it was written in a way that completely let Lotus off the hook for miscalculations, essentially requiring users to manually verify calculations.
Believe it or not, but even engineers do this. For example in 'piping designs' for industrial plants you would find the notices that lengths have to be checked. Meaning even if all the dimensions on the drawing are wrong and the pipes don't fit or end up ending in the middle of the desert, still nobody could blame the drawer. That's why I'm still looking for such a job - however if I wanted to blame others for my mistakes I'd better become a <TOS violation goes here>, don't you think?
The Old Argument From Market Share
The cognitive dissonance in this article is almost palpable. But what else can a propaganda agency do? Linux is free, and easy to download and install these days. So, they have to counter actual experience with smoke and mirrors. Not an easy task. Ask Ben Bagdikian.
Anyway, what alternative do they have? Windows software is plagued with malware of all sorts, that much we know (or do we? What role do the "anti-virus" companies play in all this fearmongering?). Yet we have to accept that MSFT is bursting with the Best and the Brightest, as they have Made the Most Money, and that's how we track the Winner these days.
It just wouldn't do to point out that Windows APIs are far larger than they have to be, very poorly organized, and badly designed. I can't find it right now, but "Solar Designer" used to have a web page that pointed out that almost all Win32 calls involved passing in pointers, and that meant the NT kernel had to deal with potential page faults on each and every entrance to the kernel. Instead, we have to castigate the C programming language, ban specific function calls, spackle over bad designs with more hardware, and put out crapaganda like the Argument From Market Share.
Put simply, "MSFT has more vulnerabilities because it has more market share" is just a form of special pleading, and it rests on an untruth: that every piece of software is fractally buggy (see http://www.andyozment.com/papers/Ozment_and_Schechter-Milk_O... for proof that it's not). Linux and Apache and etc have exactly the same infinity of bugs that NT and IIS and etc have, they just haven't been discovered by Those Evil Hackers yet.
Anyway, what alternative do they have? Windows software is plagued with malware of all sorts, that much we know (or do we? What role do the "anti-virus" companies play in all this fearmongering?). Yet we have to accept that MSFT is bursting with the Best and the Brightest, as they have Made the Most Money, and that's how we track the Winner these days.
It just wouldn't do to point out that Windows APIs are far larger than they have to be, very poorly organized, and badly designed. I can't find it right now, but "Solar Designer" used to have a web page that pointed out that almost all Win32 calls involved passing in pointers, and that meant the NT kernel had to deal with potential page faults on each and every entrance to the kernel. Instead, we have to castigate the C programming language, ban specific function calls, spackle over bad designs with more hardware, and put out crapaganda like the Argument From Market Share.
Put simply, "MSFT has more vulnerabilities because it has more market share" is just a form of special pleading, and it rests on an untruth: that every piece of software is fractally buggy (see http://www.andyozment.com/papers/Ozment_and_Schechter-Milk_O... for proof that it's not). Linux and Apache and etc have exactly the same infinity of bugs that NT and IIS and etc have, they just haven't been discovered by Those Evil Hackers yet.
Quoting: Linux and Apache and etc have exactly the same infinity of bugs that NT and IIS and etc have, they just haven't been discovered by Those Evil Hackers yet.
Your whole comment is great. As for that last bit, I thought open code meant Those Evil Hackers could find weaknesses more easily?
;)
Well, I'm afraid the name of the writer of the article says it all.
The weird part of the argument is that it somehow spills into servers, where OSS market share is much higher, thank you very much. In the case of Web Servers, IIS is a minority, not majority presence.
But -- who wants to let facts into the argument?
But -- who wants to let facts into the argument?
My comment in reply to that article.
Quoting:First that's FOSS, as in Free and Open Source Software. Second FOSS is already highly adopted, the Internet runs on Free and Open Source Software, from Apache to GNU/Linux, so attacks should already have grown. The things is they aren't particularly effective, unlike attacks on certain Proprietary Software. Given it's already high adoption rate, and low failure rate, much as this article attempts to spin it the other way, FOSS has already shown itself to be the safer bet.
ta: You're right of course but your comment will probably fall on deaf ears. Articles like this are usually all about the agenda and not about facts.
Of course caitlyn, but it doesn't hurt to point out that the agenda and the facts are separated by an uncrossable chasm.
Nope, it can't hurt. You just have to hope someone reads through the article and the comments and is still open to another viewpoint. I've seen articles like this one quoted ad infinitum to prove to me that Linux is inferior to Windows.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post