Public Computer Security Misperceptions Abound

Gmail Google Phishing Message

Generally, I try to avoid giving out unsolicited advice, but, sometimes, will reflexively do so, especially for a friend who I know encountered some kind of "Windows" security issue.

Well, a friend posted up a gmail message they had received with concern to make their circle of friends aware of.

It is of the email 'click-bait' variety.  They all work the same on legacy Windows (x86) from present 8.1 back to Windows 2000.  The commonality is that all versions share the same core WinNT design that Microsoft cannot change as it will 'break' Enterprise software badly.

No, it's more what I call "shooting fish in a barrel" or "taking candy from a baby".  The email sent to the unwary Windows user is 'socially engineered' to steer them to opening the email and/or attachment, either of which (on Windows) will spawn Javascript to download and inject DLL code and run all silently unbeknownst to the user -- until, of course, it's too late when suddenly a rogue fake security warning comes up or the dreaded CryptoLocker virus has just finished locking (encrypting hard drive) the user out of their system and very professionally offers up a screen of payment credit card options for making payment, which will unlock said PC.  CryptoLocker is becoming endemic.

So, my weak moment was to offer unsolicited advice to the poster of Drive-by threats inherent in the use of Windows.  This kind of advice was coupled to my 'standard' recommendation to the poster to consider switching to Linux which I have used since 2005.

I've been in the IT business for 20 years and ought to know something at this point in my life about issues regarding computer security, one would think.  Yet, despite offering up this kind of friendly advice, there is always the random respondent who turns up and shows his/her ignorance with great facile, I might add.  Here are their remarks:

"I hate this kind "commercial" attitude some people have. I dont like Linux. It may be the safest whatever OS and good for servers. But I don't like it. How can someone possibly even think Linux is safer when its open source for God's sake the only reason Linux is safe is  because is not as popular as windows yet. Maybe it might become that much popular and be used almost everywhere but as far as I'm concerned almost all companies and 90 % of the users worldwide are still on windows. That is why its the most vulnerable because if I was a criminal who would I attack?  A bigger area of effect obviously. 

How little people think nowadays really. Thank you for your kind offer but I'm not going to an open source program. Keep your eyes open for "these kind of threats" and alert others.
No operating system that is on the internet is safe. Not even Linux. Linux has one of the biggest issues if anything for being open source. If anything attacking the Linux website one day for example and their downloads and all other server connections they have would  compromise absolutely every single user and you do not need to be a computer tech to realize that. 

Thank you, but no. Have a wonderful day. :)"

Okay, instead of responding in my friends post, I chose to submit to her woeful ignorance and put things into perspective here point by point:

1) "I hate this kind "commercial" attitude some people have."

Commercial?  This was posted to a 'friend' for her benefit and so wasn't a commercial or if she meant an endeavor to profit, Linux is FREE.  It wasn't motivated by money.

2) "How can someone possibly even think Linux is safer when its open source for God's sake."

Huh?  The user presumably associates the word 'open' with some form of security vulnerability like 'leaving the door open'?  One of the cornerstones of Linux is its Gnu Public License for sharing the entire source code base and making changes to it freely.   Because of this, user of Linux enjoy true "Transparency", which means many eyes (more so than what Microsoft has in employee headcount), around the globe are looking at and vetting source code to ensure no rogue code insertion occurs.  Unlike Linux, Windows is proprietary and the end-user cannot see their source code, cannot copy it, and thus have NO idea whatsoever what the employees of legacy Windows did or did not do to the code base.  Being proprietary means effectively, Microsoft can write the operating system and applications however they wish, and, that includes code insertion of functionality like 'back doors'.

Yep, back doors exist in Windows for both Microsoft's use and for their partnering governmental agencies which wish to access your PC.  They come and go silently with impunity.  After you've thought about that for a minute, go find some black electric tape and place it over your Laptop's camera, mmmkay?

This doesn't even speak to the unfixed zero-day exploits present and hidden because Microsoft's code base is not viewable by anyone other than their privileged but shrinking staff of programmers most of whom didn't write the original code and might not have a clue as to how to go about changing it.  Those programmers left 5-10-15 years ago.  So, Zero-Day exploits are rampant, and, the hackers that have discovered them sell their exploits on the black market to people on the other side of the globe who want access to you, usually for money.

Microsoft code doesn't get continually refactored like Linux and vetted for safety.  It gets written and then forgotten.  Their maintainers will fix what they can if they can do so without breaking the system, but their resources are limited.

3) "Linux is safe is because is not as popular as windows yet."

Oh right.  The security by obscurity argument.  Alright let me explain the central security issue with Windows:

If an exploit (drive-by, email attachment same difference) on Windows is 'successful' in running, it will make its own SYSTEM call() to perform an 'Administrative' function.  It is at this point that Windows should stop to check on what that 'action' is and by what process id (parent) is making the call.  It doesn't.  Nope.  Once the exploit gets a toe hold, it proceeds to run administratively with no other cross-check security mechanism.  Got that?  Your PC is officially owned.

With Fedora Linux, you have what is called sandboxing technology.  SELinux, a Linux Security Module (LSM), binds to the kernel at bootstrap and maintains a 'hook' api in the SYSTEM kernel.  This 'hook' gets called on each granular system administrative process invoked on Linux.  SELinux (the Sandbox or Mandatory Access Control), cross-checks each discrete action against its policy group for the calling app  and if it isn't an allowed action, it on returning from the hook sends a 'deny' to the kernel.  The rogue code, exploit, is stopped cold.

It doesn't matter from whenst it came, the sandbox blocks it from getting a toe hold in Fedora Linux.

Windows Legacy users?  To you I say: Go with God.

Fedora Linux: The safest operating system on the Planet.
I stake my reputation on it.  -- Dietrich

Related articles

• Sandbox? What Sandbox? -- Fedora Has You Covered
• Microsoft Windows 8.1 Legacy (x86) - UNSAFE FOR GENERAL USE
• Microsoft Windows 8 Legacy: An Unacceptable Level of Risk

Read More

The Linux Distro Repository System Safety Assurance

(Image credit: ablogabouthistory.com)

THE LINUX DISTRIBUTION REPOSITORY CONCEPT

Most people don't give a thought to this subject.  In fact, with Legacy Windows (x86), including Windows 8.1, there is no such concept as a 'repository'.

Every Linux Distribution (call it a 'flavor' if that helps), provides its own repository.  What is a repository?  Imagine a Castle (Library of Applications) with a moat around it and a draw bridge.  Only keyholders can get in and get out.

The keyholder conceptually is provided by a technology used extensively with Linux, called GNU Privacy Guard (GnuPG or GPG for short).  The idea is to guard all software in the library to assure that no 'tampering' can ever occur.  Tampering scenarios include adding rogue software (applications with hidden trojan viruses), unauthorized code edits which have negative repurcussions and usually include software exploits, such as the kind that politely advises the user that their drive is now officially encrypted/locked and cannot be used unless a monetary consideration (extortion) is provided that will cause the encryption to be unlocked (CryptoLocker being one such application aka Ransomware targets Windows, not Linux).

This GPG technology allows each piece of software in the Library to be linked to your Linux on the Desktop GPG-keyring and will not install, per se, unless it can be unlocked by your Desktop keyring (Fedora is my Distribution of choice).

The advantage is clear.  The maintainers of the repository for your Distribution are thus able to  maintain strict control over who can contribute code, vetting of software and the author's background, all done to assure that the program being considered for acceptance into the Library is safe for general use, devoid of any rogue code.

The absence of a repository of protected software applications has been an historic security problem of endemic proportions for Microsoft who must continually apply Zero-Day security patches to the operating system once a month to thwart introduction of rogue software onto the operating system.  It is a hopeless, unending situation and the fact that such software as CryptoLocker and Stuxnet exist should be a flashing neon roadside billboard to the average user, but, sadly isn't.  The public is bamboozled and has bought into the accepted practice  of running third-party Anti-Virus software, lulled by its false sense of security and done by the user at their additional out-of-pocket expense for purchasing said software, time and effort.  

Indeed, the Windows Legacy security software business produces multi-billion annual sales all of which does nothing to deflect a Drive-by Download, for example.  The user won't see it, but their machine is infected and there isn't anything they or Microsoft can do about it, short of a complete redesign effort which has gone into their ARM processor based product which has suffered languishing sales.

Below is my system running an update download from the GPG keyring-protected repository at Fedora.  If you run automated updates, this will occur daily with Linux, not monthly as Microsoft does on Patch Tuesday.

Fedora Linux:  The safest operating system on the Planet

Users of Windows Legacy must therefore 'fend for themselves' and go into the 'wild' so to speak in search of software, whatever that may be, with no assurance that it isn't laden with trojans ready to deploy silently, unbeknownst to the victim user, who believes they have found a nice game program, for example.

You may think things are safe with Windows.  They are not.

Fedora Linux: The safest operating system on the Planet.

I stake my reputation on it.  -- Dietrich

Related articles

• "Official" Fedora Linux Remix for Raspberry Pi arrives
• notes on gpg4win
• Using GnuPG with QubesOS

Read More

Patch as Patch Can

(Image credit:  theregister.co.uk)

What happens when you use proprietary code?  This story from The Register is quite representative.

Yes.  Google Chrome is proprietary.  Chromium is Open Source.

Open Source Chromium gets looked at by 'many eyes' and that is by Contributors across the Globe Folks.

Bugs get fixed quickly.

With any piece of proprietary code, including Chrome, only the employees who work as developers can make fixes to source code, no one else.  Unlike Open Source, Proprietary source code is not made accessible to the general public.  Only the binary executables get distributed.

It's a classic problem and has lent to a perpetual tread-mill of security issues for Microsoft Windows Legacy (x86) and the litany continues unabated to such an extent that Microsoft now wants to change the name of Internet Explorer to remove some of the legitimate stigma involved with user market perception.  It ain't gonna work.  The horse is out the barn door.

No, in fact, I made a policy decision some time ago not to use proprietary software whatsoever and wrote specifically about Google Chrome.

So, I strongly urge the readers to avoid Chrome like the plague and stick with Open Source developed software only, such as Chromium.

As for myself, I have Open Source dwb and Chromium installed, but use dwb 95% of the time.  dwb is written in pure C with gtk2/3 bindings and a webkit back-end on steroids.  It is understated, spartan, greased-lightning fast, and super lightweight with a 75MB startup RAM footprint.  Highly recommended.  Chromium is the easier of the two to install and use and will gobble up as much ram as it can find but, then, it has all the bells and whistles going for it.  -- Dietrich

Related articles

• dwb - A Webkit Browser, Highly Understated, Lightweight and FAST
• Advocating for Security through Transparency

Read More

Linux Desktop Application Development Flounders

You know, I have been trying to remain objective on this topic and have debated whether or not it would be constructive to write a post for going on several months now. (Image credit: illustrationsource.com)

Each day I survey the news pan-handling for those 'nuggets' that would indicate someone out there is 'thinking' and actually innovating on the Linux Desktop.  When I sort through the chaff of daily trumpeting of the newest Distro cookie cutter 'me too!' clone, I come up with scant information on new software development for specifically the Linux Desktop market.

Okay, you are grumbling.  You see, being an Advocate doesn't mean I will feed you platitudes and say 'nice things' all the time.  Quite the opposite.  I take a critical eye to what is, or in case of this story, isn't going on with Linux.

I don't get as excited about Linux on the Desktop (LoD).  Where are the killer apps?

Close your eyes and what do you see?  Heh.  Yep.  Nothing.  This is saying something but I am not sure what it means.

Are Developers too busy doing other things in their lives?

Are the global economic conditions putting pressure on LoD software development in general?

Companies with a bankroll and capability to pay Developers to do their work allow them a decent livelihood.  So, consequently companies like Microsoft and Apple have traditionally done well.

Yet, even now, Microsoft just announced a major lay-off of 18,000 employees.

Along with the effects of a recession, which I prefer to call a depression, come the attendant 'side-effects':

Business contraction, job loss, increased unemployment are all symptoms of what is not just regional, but encompassing the global economy as it were.

Thus, if you are one of those committers who volunteers their service in writing Open Source code in your spare time, and you find yourself out of a day job, that will most undoubtedly put a crimp on your ability, willingness to volunteer services when you cannot put dinner on the table.

We see ongoing development continues with Apple, Microsoft, Red Hat Linux and their orbiting software vendors in the commercial arena, but on the community side of Linux, I see few interesting new software applications in the offing.

Does this fit with what you see?  What are your thoughts?  -- Dietrich

Related articles

• Cookie Cutter Distros Don't Cut It
• Emmabuntus: Yet More Recycled Bits?
• Where Will Your Linux Distro Be in Five Years?

Read More

It's Love All Over Again With New Improved Mozilla Firefox 29

Firefox logo (Photo credit: Titanas)

by Dietrich Schmitz

I go back to a time when in Linux Firefox didn't exist.  Then, I used Mozilla.  For me, Mozilla Application Suite, a fork of Netscape's Communicator, was the best browser available in Linux Distro-Land and when it came out with 'Tabbed-browsing' I thought that was the greatest thing since sliced bread.

It was 'love at first sight'.  My infatuation with Mozilla grew and I became a loyal user overnight.

Enter Mozilla Firefox.  The genesis of Firefox was born out of many of Mozilla's features and overnight it became a hit.

Naturally, I switched away from Mozilla to Open Source Firefox and remain a loyal user.

Today, when I think about Open Source, I cannot stress its importance enough.  The need for Transparency in today's world has become magnified by world events and the increased public awareness that software can be exploited for nefarious purposes has become all the more clear.

How can we overcome such exploitation?  I believe that Open Source is vital to ensuring that rogue software exploit code becomes a thing of the past.  Proprietary code, that which cannot be seen, vetted with oversight by the general public, has the increased potential to become exploited on various levels.

Take for example something as simple as your average Microsoft Windows license.  Most people never read it.  And nobody other than Microsoft's programmers know what is specifically in their code base on an intimate level.  

How did Stuxnet happen?  

I am inclined to believe, it could not have happened if Windows was Open Source and I am also inclined to believe that it could not have happened without Microsoft's participation on some level.  There are 'back doors' into Windows legacy (x86) software, of that I am sure.

These 'back doors' are undocumented APIs which facilitate various control levels and, depending on the need, Microsoft shares those APIs with law enforcement and governmental agencies who request their assistance, unbeknownst to the general public.

This is only possible if the code base is proprietary and thus the programming APIs remain hidden.  And, proprietary being what it is, the ability to not disclose the full extent of how software governs itself is always an option and that is why I believe Proprietary Software = Exploitation.

Recently, I wrote WARNING: Google Chrome UNSAFE FOR GENERAL USE.
In that story, I disclosed my decision to stop using Chrome was based on its not being Open Source.

With world events in mind, Stuxnet, North Korean satellite launch systems (Windows) disabled, Flight 370 Boeing 777 'fly by wire' remote control software being undocumented and alleged to have been used for controlling and diverting said flight, I remain a staunch Advocate of Open Source and Transparency.

Just the other day Mozilla released their newest version of Firefox, version 29.

My good Friend Igor has scorned the design decisions made by Mozilla.  Okay, let's get it out of the way -- it 'looks' (to a degree) like Chrome.  But, if you really stop to think -- so what?  These are critical usability design considerations which I feel, on net, make Firefox all the more usable and at the same time extend its feature set with new much-welcomed rich functionality.

Firefox 29: A big win for Mozilla.  

When you combine the open source features of Firefox with the vast repository of plugins at users' disposal, the result is a powerhouse web browser.  There is no equivocating on that!

In fact, I'll go as far to say, I am in love all over again with Firefox and would like to thank the Mozilla Firefox Developer Team for all the innovative work done to date.  

Thank you.  Thank you.  -- Dietrich

Related articles

• Firefox turns 29, gets a new look
• Mozilla Introduces the Most Customizable Firefox Ever with an Elegant New Design
• Now is the time to switch back to Firefox

Read More

Step off Microsoft's Cost-Prohibitive License Treadmill to FOSS Linux

by Dietrich Schmitz

Step off Microsoft's Cost-Prohibitive License Treadmill to FOSS Linux.  Linux Advocate Dietrich Schmitz explains why.

These are critical times when many CIOs are budget planning and need to make across the Enterprise costly hardware refreshes -- especially now, given that Microsoft is officially ending support for the aged Windows XP on April 8, 2014.

Naturally, Microsoft licensing doesn't allow license transfer to new hardware. That's too bad. Because, it means, if your concern insists on staying with proprietary Microsoft Windows (x86 Legacy), it must be in full compliance with their licensing terms and so, not buying new hardware with ancillary licensing for software application upgrades is unavoidable.

It's good for Microsoft -- they recoup dollars on the operating system upgrade, and they also garner additional revenue for any Microsoft software applications your concern may need on each Desktop.  But that adds up quickly in terms of multiple machines across the Enterprise and puts pressure to bear on already tight IT budgets.  Now the remainder of those 'hold outs' XP Desktops must be dealt with.  Yet another round of costly refreshes to avoid the April 8, 2014 end of support deadline.  Ughhhh.

That refresh scenario has been a given for many years and Microsoft naturally while providing a service reaps the benefits of making the licensee pay for what I prefer to call 'recycled bits' of software.  Much of it is the same bits recompiled with a new face, or gui.  Sure there are software feature enhancements but I would submit that most offices won't use more than 20% of Office's features.

CIOs are effectively 'married' to Microsoft and being 'coerced' to refresh their hardware when they logically know full well that Windows XP would have been 'good enough' easily for another five years.

Forego the deadline?  Nope.  Can't risk it.  Enterprise systems must be available 24x7 and your job is on the line.  You have no choice.  Or, do you?

Step off Microsoft's cost-prohibitive License treadmill today. That XP Desktop system may be ten years old, but it still remains a 'fact' that it is a perfectly viable piece of hardware.

Fedora 20 LXDE Linux running LibreOffice 4.2.2

It can be 'repurposed' and given a 'new lease' on life by simply installing Free and Open Source Software (FOSS) Linux (Fedora is my recommendation) along with a vast repository of free software and support.

It's a 'no brainer' really. 

So, how many XP Desktops did you say are ready for the dumpster in your organization? The CFO should be happy to learn that you are effectively zeroeing out thousands of dollars of additional expense by switching to Linux.

Please.  Don't throw that XP Desktop away.  Be frugal.  Most of all, be smart. Reprovision it with FOSS Linux.  It will run like new.

-- Dietrich

Related articles

• OPINION: Life after Windows XP - migration options with another approach
• The Fedora Project is the Best FOSS Community-Driven Linux Distribution
• News Flash from Redmond: FOSS Causes Dissatisfaction!

Read More

Microsoft Windows 8.1 Legacy (x86) - UNSAFE FOR GENERAL USE

by Dietrich Schmitz

You are reading this wondering what that means. Google Engineers have, in earnest, attempted to bolster Chrome for Windows by placing it in their own crafted (Not Microsoft -- they don't have one) security sandbox.

Despite their best efforts, they have posted to their Chromium developer website that they cannot guarantee your security if you use Microsoft Windows.

Here is their disclaimer:

Other caveats

The operating system might have bugs. Of interest are bugs in the Windows API that allow the bypass of the regular security checks. If such a bug exists, malware will be able to bypass the sandbox restrictions and broker policy and possibly compromise the computer. Under Windows, there is no practical way to prevent code in the sandbox from calling a system service.

In addition, third party software, particularly anti-malware solutions, can create new attack vectors. The most troublesome are applications that inject dlls in order to enable some (usually unwanted) capability. These dlls will also get injected in the sandbox process. In the best case they will malfunction, and in the worst case can create backdoors to other processes or to the file system itself, enabling specially crafted malware to escape the sandbox.

That's quite troublesome when you think about it. Google Engineers post up a 'caveat' -- their legal disclaimer, if you will.

Simply put, Windows 8.1 legacy (x86) uses a legacy code base going all the way back to the Windows 2000 WinNT kernel.

Microsoft cannot fix the security issues which are under eternal attack unless they completely rewrite the operating system from the ground up. Enterprise is 'married' to the operating system with applications which must run 24x7. Microsoft cannot rewrite the code which is heavily depended upon. They have a dilemma and they really don't want you to know about it. They just keep diverting your attention to 'the attackers' away from themselves as though they have no responsibility.

This is the cost of using proprietary software. Unlike Open Source Linux, no one can see the code of Microsoft Windows, review it, inspect it for defects -- FOR MICROSOFT EMPLOYEE EYES ONLY.

This is the disadvantage that one accepts when agreeing to the Microsoft software licensing terms. Microsoft own the code -- the Licensee does not.

So, why not consider making a switch today to Gnu Public Licensed Linux and own the code? It's yours for free and it is so secure, I'll even say Fedora 20 Linux is the safest operating system on the Planet.

Fedora 20 Linux running LXDE

Be safe with Fedora Linux.

I stake my reputation on it.

-- Dietrich

Related articles

• Debian, Ubuntu Cave In: Standardize on Systemd
• Sandbox? What Sandbox? -- Fedora Has You Covered
• Microsoft Windows 8 Legacy: An Unacceptable Level of Risk

Read More

Google: Don't try to change the law. ENCRYPT GMAIL/DRIVE!

by Dietrich Schmitz

Okay so Google are pushing today for changes to be made to Internet request for access to their data infrastructure by third party entities, namely, our Government.

I think this is the wrong way to go about it, and I won't sign their petition (below). (Image credit: zeroknowledgeprivacy.org)

If Google can encrypt their 'Google Cloud' product, then they should apply the same standard for the general consumer (public) of their Gmail/Drive services.

If software vendors like SpiderOak, Wuala, and now Microsoft and Yahoo can muster the requisite technology to facilitate encrypting all of consumers' private data, there is no excuse for Google not following suit.

Do the right thing Google.  ENCRYPT GMAIL/DRIVE with Zero Knowledge Encryption technology.  -- Dietrich

Related articles

• Microsoft Strikes Back at Spying, Will Encrypt All Cloud Activities
• Yahoo vows to encrypt all its users' personal data
• Which Companies Are Encrypting Your Data Properly?

Read More

FOSS Doesn't Care if You are a Capitalist

by Dietrich Schmitz

Venture Capitalists and Start-Ups

We see new announcements on Indiegogo daily seeking funding to seed a new software widget, platform, or idea which has potential for development but lacks financial resources to undertake full-scale development.  Being in FOSS development isn't always what it is cracked up to be, especially if you expect to make a living at it.

While Venture Capital (VC) is to be had, it comes at a cost -- VCs usually won't part with their money without some kind of 'consideration'.  That's where the VC takes control of your project and wants majority stock in the company they underwrite and they want direct input into how a concept should be developed into the ultimate product or service.  There is where FOSS can take a U-turn as many projects depend on upstream code and the terms of licensing dictate how the code can or cannot be used and/or changed.

To that end, prospective entrepreneurs employ various business strategies including proprietary licensing schemes so as to protect their 'return on investment' to recover research and development expense, by enforcing company-owned software copyrights and patents.

Software as a Service

Schemes to protect investment also include marketing a software application as an on-line service where prospective customers subscribe to use such services.  SaaS has become popular because vendors can provide the service without exposing the source code (at least key parts of it) which would give away their technology advantage to competing vendors.

Black Holes

The biggest of all software vendors today is Google.  As they grow, they routinely buy up small start-up companies, absorbing them like a black hole, and fold the technology into their expanding universe of software offerings.  We've seen this repeat over and over, Android, Blogger, QuickOffice, all have been absorbed and now are part of the Google software landscape, to name just a few start-ups.

FOSS not Beholding to Anybody

So where does FOSS fit in?  It would seem that community developed software isn't even beholding to corporate interests.  It isn't.

No, FOSS is only beholding to the interests of its developers who voluntarily nuture and cultivate it like a devoted gardener would to their plants.  And, in the absence of that nurturing spirit, FOSS can and often does die off if not maintained.  This is an inherent risk of giving away source code under the software licensing terms of GPLv2.  It becomes very usable, very shareable, only if there is incentive to actively maintain the code base.

Often, young enthusiastic developers devote their time for a year or so and then for various reasons move on.  At that point, if there isn't another maintainer, the FOSS code will whither and die if not maintained.

On the other hand, paid developers on the Capitalist side are typically hired as employees of corporations who develop proprietary code and in some cases open source software but the primary force at work is either a subscription service or licensing cost model to use said software.  Profit seeking is what drives Capitalism.

Because there isn't a broad enough interest by Venture Capitalists to develop FOSS, the majority of development today is dominated by proprietary software created by Microsoft and Apple and their third-party partnering software vendors.  And, many start-ups which begin with the seed of an an idea eventually become absorbed into the proprietary world as a requirement for VC investment.

It's simple enough to develop code and not provide source code to ensure that the technology investment cost is protected by recurring revenue on licensing of software.  VCs understand and adopt a proprietary model of code development most often still, despite the disadvantages that it places on users who cannot enjoy the inherent security benefits of transparency.  Faith must be placed in the software vendor's reputation, abilities and perceived value of purchasing a proprietary software license.  The restrictions placed on use of software vary but the benefits of FOSS do not apply and most often one must purchase another software license to use the same software on another computer, unlike FOSS.

It's Still a Proprietary World

So, while the attraction to FOSS by virtue of its transparency, ability to freely share and change source code are important, large scale deployment of PC software still hasn't spread to the scale of the Microsoft Windows and Apple OSX business world installed base.

True, Red Hat have extended their presence into the Enterprise, but that process hasn't moved along quickly enough as many software development concerns still rely on the proprietary model to drive sales and profits verses the subscription-based model used by Red Hat.

The above notwithstanding, FOSS continues to grow, slowly, pragmatically and spread in popularity. Take it, use it, as you wish, but you must put back changes to the source code you plan to use in any commercial endeavor so that future users can benefit from it.

If that's a problem for you Venture Capitalists, well, FOSS doesn't really much care.

-- Dietrich

Related articles

• What's FOSS all about?
• Stallman, FOSS and the Adobe Nightmare
• Let's audit Truecrypt!
• Goodbye, Encryption; Hello, FOSS

Read More

To Whose Advantage Does Windows Genuine Advantage Accrue?

by Dietrich Schmitz

To whose advantage does Windows Genuine Advantage accrue?

Certainly, not yours. Windows users have become accustomed to Windows Genuine Advantage (WGA) for some time and may or may not have seen the below message.


On the face of it, one would assume this is normal and part of a campaign to ensure that pirated software is not being used, yes?

Well, yes, that's true. But what else is going on?

Encrypted Channels, Back Doors

The fact is, if you've ever taken the trouble to watch what is happening 'behind the scenes' using TCP/IP sniffing tools like Wireshark, you'd plainly see that Microsoft, in their infinite wisdom are shuttling 'encrypted' data 'to and fro', 'fro and to' your PC, all unbeknownst to you over http encrypted tunnels -- all day long.

If that troubles you as much as it does me, then maybe it's time you considered doing business elsewhere?

Those http encrypted 'channels', if you will, can be for legitimate purposes, but as we have seen with the reckless abandonment of the recent disclosure of the NSA Prism program, they conceivably could be used as 'pre-built' backdoor channels into which the NSA or Microsoft, acting on their behalf, can gather information about your 'activities'. All this can be done with impunity and you've got no way to prove otherwise, because, as mentioned these are encrypted tunnels.

A Leap of Faith

If one takes the 'leap of faith' to trust and use Windows as millions do, then 'all your data belong to us' is a real possibility one must accept as well.

Without 'transparency', one accepts the terms of Microsoft licensing and because it is not Free and Open Source (FOSS), one has no way of checking how the Windows programs are written.

This should be a valid and legitimate concern of any Windows user.

FOSS Begets Transparency

Unlike Windows, Linux is FOSS and in accordance with the GPLv2 licensing is free for the respective user to run and operate, including full unfettered access to the original 'source code'.

That last part there, 'the source code', is what makes Linux truly transparent.

You see, there are 'many eyes', thousands up thousands of caring programmers around the World who collectively work on Developer Teams on various Linux projects coding the software. The virtue of this is that there is little or no possibility of any 'malicious' code being intentionally merged to a given project as the process for vetting source code by project managers, coders, all keeps that from happening.

Proprietary is Subject to Exploitation

On the other hand, one cannot account for what is or isn't being coded with respect to proprietary software such as Microsoft Windows. Only Microsoft internal staff know the intimate details of how their software operates.

That leaves much to be desired in terms of achieving transparency, would you agree? I'd say there is zero transparency with Windows.

Linux is Transparent, the Right Choice

Now that you've been armed with this knowledge, what will you do? Do you still entrust Microsoft to do what is right for you?

Switching to Linux right about now might be on many readers' minds.

Linux is virus-free and for good reasons it is truly the safest operating system on the Planet.

I stake my reputation on it.
Be safe. --Dietrich

Related articles

• Goodbye, Encryption; Hello, FOSS
• Stallman, FOSS and the Adobe Nightmare
• Microsoft's Christmas Present To MS Office Users Retiring Office Genuine Advantage

Read More

Wanna Get Your Point Across...? Show 'Em The "Magic"

My Uncle Ernie was a jokester and a magician.

When he and my cousins would make the drive down from Wisconsin, I waited patiently at the kitchen table, hoping he'd show me some of his tricks before we ate dinner.



Uncle Ernie rarely disappointed us.

Simple magic really...misdirection to make stuff disappear, card tricks, quarters found in your ear.  It's all stuff we roll our eyes at as adults, but to a 10 year old kid...

My Uncle Ernie was Merlin Incarnate.

Of course, to the magician, it's an ability...just like driving a car or riding a bicycle.  You are able to do it better, directly proportional to the amount of practice you put into it.

A few years back, I was active on the forums of a particular Linux distro.  I also spend a good deal of time advocating for said distro so of course I wanted it to succeed.

At this particular time, there was a fairly well known bug that caused evolution to open upon an email field, even if Thunderbird was your default email client.  There was a fairly complex set of instructions to correct the problem but a lot of new users were put off by having to hand edit obscure configuration files to fix it.

I don't think it took me more than 15 minutes to write a script to fix the broken system call and implement it.  It was a dirty little hack...code most any self-respecting geek wouldn't let see the light of day, but it did the job and that's all I really cared about.  I messaged the forum poster and told him how to make the script active.  With the click of a mouse, his problem, and this problem in general was relegated to "Problems that used to be".

When this new user asked me how I had fixed it, I hesitated for a moment or two...thinking that any explanation would be wasted on the uninitiated...pearls before swine as it were.

But I did indeed explain to him how a dirty little script hack had corrected the problem.  He was not only amazed...it opened his eyes to the real beauty of Linux and Open Source Software.

He now understood that if this problem had been a Windows issue, he would have had to wait until someone at Microsoft corrected the problem.  It might have been fixed, or it might not have been fixed...

With Linux, all he had to do was mention it on a forum and it was fixed on the spot.

I will let him reveal himself if he wishes...he is well-known in his distro circles and does a lot of good work both in the kernel and in the user space.  Not everyone has the opportunity to show others the magic trick.  Most people don't care...they just want the problem gone.

Like a funny noise in the motor of their car.

Like the squeaky door that doesn't respond to oil or lubricant.

Like the computer that won't open the right program when you click the trigger link.....

But every now and then, you show someone how the magic trick works and it intrigues them.

And that, in turn...

It can change history.

Related articles

• Valve Announces SteamOS Linux Distro, Download Soon and Free Forever

Read More