ALERT: A Software Security Transparency Breach Warning

(Image credit:  Wikipedia.org)

We've witnessed what happens when changes in source code to intentionally insert rogue code go unnoticed.

The example of how the NSA intentionally inserted weakened string constants into Elliptic Curve Cryptography lay hidden for several years, in fact, and was only exposed by a languishing open Red Hat trouble ticket.  What was odd was how given the potential seriousness of the incident, no action was being taken to look at the source code and change it.  As more comments appended to the ticket, the level of suspicion grew to the point of where NIST was forced to open up an investigation.

It was a potential public relations disaster in the making for them, as they pleaded being unaware of what the NSA had done.  Immediately, the code base was opened up for public comment.  The code has since received a thorough going over, particularly those merged diffs that sourced from the NSA and corrective action was taken.

But, this was a roadside billboard that should have alerted everyone in the FOSS Community to the realization that every corner of FOSS should be revisited for a thorough security review and vetting.

Code obfuscation should be a 'red flag' to anyone who has seen it.  The first concern should be:  Why is this code obfuscated?  If there isn't good documentation giving a reason for doing so, then, it's time to dig in and find out what the code is or isn't doing, at the very least.

It is believed, however, relative to all FOSS code, little obfuscated code exists.

It would be most difficult to secret rogue code otherwise, as it must pass several levels of code review to reach final merge.

This is why it is an imperative that the FOSS Community become rigid and not deviate on the issue of Security Transparency.

Security Transparency assurance can only be guaranteed if and only if ALL source code is vetted independently by more than one project maintainer.  Oversight must be maintained and all Linux Distribution binaries which don't provide accompanying Gnu General Public Licensed (GPL) source code should be rejected out of hand as not just a license violation but also a breach of Security Transparency.

That being the case, Linux Advocates is taking a position against the following software vendor sources of 'semi-open' code bases.  They are:

• Google ChromeOS
• Google Chrome Browser
• Opera Browser

Linux Advocates categorically does not support using the above-listed products which include a mix of open source and proprietary code.  There is an attendant heightened risk of exposure to cyber attack and exploitation when using any non-FOSS proprietary stack implementation on your computing device.

Enforce Security Transparency by insisting on using Linux with GPL open source code only.  -- Dietrich

Related articles

• Lions, Tigers, Bears, and FBI Warnings, Oh My!

Read More

Lions, Tigers, Bears, and FBI Warnings, Oh My!

Wizard of Oz Movie (Image credit: prairiecloudware.com)

Seriously, do you tire of seeing major news plastered with warnings about cyber attacks, malware and viruses?

It really has grown to a fever pitch lately.

What stuck in my craw today was a Bloomberg report Exclusive: FBI warns of 'destructive' malware attack in the wake of the SONY attack.

Like, I should be mortified maybe?  Do these 'brainiacs' remember StuxNet?

Would it help to revisit the topic?  I'd rather not, thank you very much.  Please feel free to read the Wikipedia link on the subject.

It was the perfect road-side billboard if there ever was for why Microsoft Legacy (x86) Windows should be abandoned on grounds of National Security.

Sadly, the software industry hasn't changed and quite frankly isn't going to as long as 'big business' is married to a security-flawed 'by design' operating system.

What do I mean by 'by design'?  Microsoft provides undocumented APIs through their Trusted Platform to domestic and foreign governmental agencies (the FBI included) to have unfettered access to any Windows PC without the user's expressed permission.  (Insert sound of crickets here.)

That seems to me to be a major violation of public privacy.  And that's what the public get using proprietary software.  Transparency is non-existent.

Could writing code that facilitates having 'back doors' on to computers exist in the Open Source World?  I should think not!

Well, so far, we haven't seen any.

Of course there have been recent documented attempts by the NSA to weaken string constants in Elliptic Curve Cryptography used by Secure Sockets Layer, but it is a different kettle of fish to write a bank of code, spanning perhaps thousands of lines, dedicated to the specific purpose of providing 'backdoors' without going noticed under the Gnu General Public License for Open Source.  That kind of exploitative code cannot exist in FOSS projects.  Transparency is in full force with 'many eyes' providing the much-needed oversight.  As it should be.

Edward Snowden is correct:

“Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on." 

Unlike Open Source, the Proprietary Software Anti-Virus Business gets a boost every time one of these 'sensational' stories comes out.  It's a stimulus to obtain a desired result: the masses run out to buy AV Tools which get immediately installed.  End users fire up their AV tools, then passively watch a pretty widget on screen scanning, despite for foregoing 'backdoor' api.  The asthetic is dispensed  as the user receives a 'false sense of security'.   AV software vendors make billions of dollars in sales annually.  The partnership between Microsoft and AV Vendors is entrenched and the myth lives on.

None of this would have been mentioned if I didn't know better -- it insults my intelligence.

I know full well that if every Windows PC were to switch to Fedora Linux, all of the security issues would be gone.  Zero.  None.

So, please.  Spare me the FUD.  -- Dietrich

Related articles

• 5 Sony Pictures films leak online after massive hack

Read More

Xfce-terminal Drop-Down Guake-like Feature How-to

by Dietrich Schmitz

A nice addition to Xfce 4.10.1 was added giving the ability to have Xfce-terminal behave as a 'Guake style' drop-down terminal.

It just so happens that Fedora 19 Xfce Spin includes this build so let me show you how to configure it.

First be sure you are running this version of Xfce by opening a terminal and typing "xfwm4 -V" (leave off quotes):

[dietrich@localhost ~]$ xfwm4 -V
 This is xfwm4 version 4.10.1 (revision 3918e6b) for Xfce 4.10
 Released under the terms of the GNU General Public License.
 Compiled against GTK+-2.24.17, using GTK+-2.24.18.

 Build configuration and supported features:
 - Startup notification support:                 Yes
 - XSync support:                                Yes
 - Render support:                               Yes
 - Xrandr support:                               Yes
 - Embedded compositor:                          Yes
 - KDE systray proxy (deprecated):               No
[dietrich@localhost ~]$ 

With that confirmation in hand, we can now go into Menu->Settings->Keyboard->Add

Add a keyboard shortcut to Xfce-terminal

Next, click the '+ Add' button to create a shortcut command of "xfce-terminal --drop-down" and click the OK button to save:

Add shortcut command: xfce-terminal --drop-down

This will create the shortcut.  To add the shorcut key or change it, click the row of the shortcut which you just added to give it focus and type the key(s) which you wish to use to open the terminal--in my case, I chose "<alt>backslash" which won't conflict with most applications.

Test the shortcut.  It should now open in 'drop-down' mode and add an icon to your system tray.  If you right-click the system tray icon and go to preferences, you'll find a new "Drop-down" tab in Terminal Preferences; experiment with the settings to suit your situation:

Adjust Drop-down settings to your tastes

Use your shorcut to open, ctrl-d to close, or click the system tray icon to minimize to the tray leaving the terminal session active.  

Fedora 19 Xfce Spin Desktop with Xfce-terminal running in 'Drop-down' mode

And there you have it.  Guake? We don' need no stinkin' Guake! :)

 -- Dietrich

Related articles

• Add Alacarte Menu Editor to Fedora 18 Xfce
• Pimp Out Your Fedora 18 Xfce Desktop
• Improve Your Xfce Desktop with the Zen Suite 0.11.2 Theme
• Fedora Got Game: Leading Edge Technology, Stability and Standards

Read More

The Fourth Open Source Incline?

By Guest Writer +Dana Blankenhorn

I recently wrote a piece for TheStreet.com which likely drew little notice, because it was really aimed at y'all.

I've covered open source software since 2005, and spent a lot of time tracking how companies manipulate the rules of open source to suit themselves. While I was pushed out of ZDNet at the end of 2010 and now find myself doing financial journalist at TheStreet, SeekingAlpha and MotleyFool (with more offers coming in), I am still at heart a reporter, and still devoted to the technology beat, peering around each corner to see what might happen next. (Credit image right: Wikipedia.org)

Anyway, about the open source inclines.

One of my earliest pieces for ZDNet theorized the existence of such an incline--the idea being that the more even-handed the license, the more likely it was people would contribute code and other help to a project. You might call this the Open Source License Incline.

I wrote it because I was friendly at the time with the folks at  Appcelerator, who started in Atlanta but quickly moved to Silicon Valley. They had decided to license their mobile app code under the General Public License, or GPL, in order to draw contributors, and it seemed to be working, since the GPL is more “even-handed” than more “permissive” licenses like Apache, requiring that all contributors get access to all contributions.

A few years later, I returned to the subject and wrote the Open Source Development Incline, the idea being that a project's development model can impact how code contributors react to it.

This was just at the time when OpenStack, the open source cloud infrastructure, was starting up. Rackspace was then its corporate sponsor, but it was feeling pressure, to which it later succumbed, and placed the code into a separate foundation other companies could join. Off that, I believe, I was asked to keynote an Apache Foundation development conference, one of the great honors of my life. Can't say I did great, but I learned a lot.

In 2010 I completed my ZDNet trilogy with the Open Source Copyright incline--the idea being that where copyright is assigned also matters to contributors.

This was around the time Oracle tried to use copyright to seize control of open source projects it bought with Sun Microsystems. How open is any code, even GPL code, if a company can assert proprietary rights to what others wrote for it through copyright? Fortunately, courts have not seen fit to make open source a dead letter over this claim.

Thus, we come to my fourth revelation about open source inclines, the Open Source Access Incline.  Even if a project is open source, even if it's established, it can collapse if corporate contributors simply decide not to support it, or to restrict support of it by outside developers.

The news peg here is Google's decision to not only close out Google Reader, but, as CNET notes, all support for the Real Simple Syndication or RSS standard it uses. The aim, as Felix Salmon writes at Reuters, seems to be to keep users from regularly accessing data outside the Google walled garden.

I made this into a business story, as is the nature of my current work, but this was really a technical point: 

When a corporate sponsor controls a code base, when they're the ones making a market in it, they may as Google did try to kill the code base by withdrawing their support. Investors may see this as strength, but technical folks like y'all may also see it as weakness.

Which brings me to what Microsoft has done with its Kinect interface--as Fast Company writes, making code supporting the interface open source under the Apache License.

Microsoft's move, in a business sense, is weakness. But is it, in an open source sense, strength?

When I first wrote about the Open Source Incline, you may note that I illustrated the story with a right triangle–the whole thing was very Euclidean. With this latest piece, it seems like it's more like quantum mechanics, that there are at least four dimensions under which the rules of open source can be tweaked by companies hoping to seize its value and get some coder love for themselves.

And now that I've given you some of my time, perhaps you might offer some of yours in return and reflect on what drives open source contributions, what corporations can do to increase or decrease adoption, and where you see the state of play in the game of contributor vs. corporation.

-- Dana Blankenhorn

Related articles

• Open source culture: Do you vote with your code or participation?
• More Microsoft Employees as ZDNet 'Writers', Microsoft Bribes Bloggers for AstroTurfing
• Open source vs. Microsoft: Automotive battlefield
• OpenStack, CloudStack, Eucalyptus and OpenNebula: Which Cloud Platform is the Most Open?
• Open-source and free software: Free, as in beer

Read More

Guest Writer Jeremy Allison on Deck

As part of a regular weekly series, +Katherine Noyes and I will be having Guest Writer appearances on Linux Advocates.

We are pleased to announce that +Jeremy Allison,  has kindly and graciously accepted an invitation to write and will be making a 'Guest Writer' appearance this coming week.

Jeremy Allison

From his Wikipedia bio:

"Jeremy Allison is a computer programmer known for his contributions to the free software community, notably to Samba, a re-implementation of SMB/CIFS networking protocol, released under the GNU General Public License.

Other contributions include the early versions of the pwdump password cracking utility."

Jeremy is Linux Evangelist for Google and worked previously for Hewlett Packard on The Samba Team.  He is a member of the Software Freedom Conservancy.

On behalf of Katherine Noyes, myself, and staff, I would like to extend a special thank you to Jeremy for donating his time to Linux Advocates.  

--Dietrich

Related articles

• Guest Writer Benjamin Kerensa on Deck
• Guest Writer Mladen Mijatov on Deck
• Guest Writer C. Anthony Esposito II on Deck
• Samba: Less Important Because Windows Is Less Important

Read More

There's an Elephant in the Room

Elephant Eyes (Photo credit: ricklibrarian)

By Dietrich T. Schmitz

That metaphorical expression comes to mind--you know--the Elephant in the Room that nobody will admit is there?

He's getting really hard not to notice, and as he grows, the room gets smaller.  Every day, there is yet more technology news which validates the strong presence and pervasiveness of Linux that simply cannot be ignored.

Read More

Why Linux?

Credit: Jens Reuterberg

By +Katherine Noyes 

As a blog focused on Linux, it seems a pretty safe bet that Linux Advocates will see its fair share of debate over the coming weeks, months and years.  After all, Linux is a complex topic, and it inspires strong feelings in both its advocates and its opponents.

Those strong feelings are of course a big part of what motivated the creation of this blog, but before we start getting into the nuts and bolts, the nitty gritty, and the countless smaller issues surrounding Linux, we thought now would be a good time to address one key point underlying it all.

Specifically, Why Linux? What is it about this operating system that makes it such an important part of the computing landscape, and such a passionate issue for so many of us?

Read More