ALERT: A Software Security Transparency Breach Warning

(Image credit:  Wikipedia.org)

We've witnessed what happens when changes in source code to intentionally insert rogue code go unnoticed.

The example of how the NSA intentionally inserted weakened string constants into Elliptic Curve Cryptography lay hidden for several years, in fact, and was only exposed by a languishing open Red Hat trouble ticket.  What was odd was how given the potential seriousness of the incident, no action was being taken to look at the source code and change it.  As more comments appended to the ticket, the level of suspicion grew to the point of where NIST was forced to open up an investigation.

It was a potential public relations disaster in the making for them, as they pleaded being unaware of what the NSA had done.  Immediately, the code base was opened up for public comment.  The code has since received a thorough going over, particularly those merged diffs that sourced from the NSA and corrective action was taken.

But, this was a roadside billboard that should have alerted everyone in the FOSS Community to the realization that every corner of FOSS should be revisited for a thorough security review and vetting.

Code obfuscation should be a 'red flag' to anyone who has seen it.  The first concern should be:  Why is this code obfuscated?  If there isn't good documentation giving a reason for doing so, then, it's time to dig in and find out what the code is or isn't doing, at the very least.

It is believed, however, relative to all FOSS code, little obfuscated code exists.

It would be most difficult to secret rogue code otherwise, as it must pass several levels of code review to reach final merge.

This is why it is an imperative that the FOSS Community become rigid and not deviate on the issue of Security Transparency.

Security Transparency assurance can only be guaranteed if and only if ALL source code is vetted independently by more than one project maintainer.  Oversight must be maintained and all Linux Distribution binaries which don't provide accompanying Gnu General Public Licensed (GPL) source code should be rejected out of hand as not just a license violation but also a breach of Security Transparency.

That being the case, Linux Advocates is taking a position against the following software vendor sources of 'semi-open' code bases.  They are:

• Google ChromeOS
• Google Chrome Browser
• Opera Browser

Linux Advocates categorically does not support using the above-listed products which include a mix of open source and proprietary code.  There is an attendant heightened risk of exposure to cyber attack and exploitation when using any non-FOSS proprietary stack implementation on your computing device.

Enforce Security Transparency by insisting on using Linux with GPL open source code only.  -- Dietrich

Related articles

• Lions, Tigers, Bears, and FBI Warnings, Oh My!

Read More

Patch as Patch Can

(Image credit:  theregister.co.uk)

What happens when you use proprietary code?  This story from The Register is quite representative.

Yes.  Google Chrome is proprietary.  Chromium is Open Source.

Open Source Chromium gets looked at by 'many eyes' and that is by Contributors across the Globe Folks.

Bugs get fixed quickly.

With any piece of proprietary code, including Chrome, only the employees who work as developers can make fixes to source code, no one else.  Unlike Open Source, Proprietary source code is not made accessible to the general public.  Only the binary executables get distributed.

It's a classic problem and has lent to a perpetual tread-mill of security issues for Microsoft Windows Legacy (x86) and the litany continues unabated to such an extent that Microsoft now wants to change the name of Internet Explorer to remove some of the legitimate stigma involved with user market perception.  It ain't gonna work.  The horse is out the barn door.

No, in fact, I made a policy decision some time ago not to use proprietary software whatsoever and wrote specifically about Google Chrome.

So, I strongly urge the readers to avoid Chrome like the plague and stick with Open Source developed software only, such as Chromium.

As for myself, I have Open Source dwb and Chromium installed, but use dwb 95% of the time.  dwb is written in pure C with gtk2/3 bindings and a webkit back-end on steroids.  It is understated, spartan, greased-lightning fast, and super lightweight with a 75MB startup RAM footprint.  Highly recommended.  Chromium is the easier of the two to install and use and will gobble up as much ram as it can find but, then, it has all the bells and whistles going for it.  -- Dietrich

Related articles

• dwb - A Webkit Browser, Highly Understated, Lightweight and FAST
• Advocating for Security through Transparency

Read More

Advocating for Security through Transparency

by Dietrich Schmitz

That's a screen shot (below) of the BitBucket repository for commits to ongoing development of dwb (dynamic web browser).

Oh, that's nice.  What's my point?

dwb is 100% pure Gnu Public Licensed code. That means, you, anyone, developers, users, the world, can see it, change it, for free. That has always been the basis for GPLv2 and the primary reason for why I opt to use dwb. Want to know what's going on with their code? Help yourself -- look around. Only, don't forget to turn the lights out when you leave. ;)

dwb (dynamic web browser) BitBucket repository commits page

You don't get that with Google's Chrome. Nope. Sorry. They won't let you see their code base. Of course, they are within their legal rights to do so, but, that doesn't mean I have to use their browser if I cannot know what it is doing, do I?

Ask yourself this question: Notice lately how Google Plus will periodically 'freeze' with the cpu utilization at 100%? 

What are they doing exactly?  (Shrugs)

That's Chrome doing whatever it does. :/ Whatever has a big question mark hanging over it for me.  My confidence in Google to 'Do No Evil' has fallen dramatically in the past 9 months since the Edward Snowden NSA Prism and other revelations.

You see, 'proprietary code' (not open source) often leads to some level of exploitation for commercial or 'other' purposes. Because Chrome is 'closed source', we cannot know for certain 'if' Google cooperates in some capacity with governmental information collection and sharing. That's because there is no public access for review of their code base, unlike dwb.

Taking the overt step to use dwb is my personal choice.  Yours may be different, but, if you truly believe in the power we (Humanity) hold over the "n'er-do-wells" of the world by embracing Open Source, then I urge you to make it your policy to not use proprietary software.  Take a stand and fight back. Set an example for others to follow and use open source applications only such as dwb, Mozilla Firefox, for the sake of security through transparency.

-- Dietrich

Related articles

• Moving Away from Google's Proprietary Ways
• Microsoft Windows 8.1 Legacy (x86) - UNSAFE FOR GENERAL USE
• dwb - A Webkit Browser, Highly Understated, Lightweight and FAST

Read More

FOSS Doesn't Care if You are a Capitalist

by Dietrich Schmitz

Venture Capitalists and Start-Ups

We see new announcements on Indiegogo daily seeking funding to seed a new software widget, platform, or idea which has potential for development but lacks financial resources to undertake full-scale development.  Being in FOSS development isn't always what it is cracked up to be, especially if you expect to make a living at it.

While Venture Capital (VC) is to be had, it comes at a cost -- VCs usually won't part with their money without some kind of 'consideration'.  That's where the VC takes control of your project and wants majority stock in the company they underwrite and they want direct input into how a concept should be developed into the ultimate product or service.  There is where FOSS can take a U-turn as many projects depend on upstream code and the terms of licensing dictate how the code can or cannot be used and/or changed.

To that end, prospective entrepreneurs employ various business strategies including proprietary licensing schemes so as to protect their 'return on investment' to recover research and development expense, by enforcing company-owned software copyrights and patents.

Software as a Service

Schemes to protect investment also include marketing a software application as an on-line service where prospective customers subscribe to use such services.  SaaS has become popular because vendors can provide the service without exposing the source code (at least key parts of it) which would give away their technology advantage to competing vendors.

Black Holes

The biggest of all software vendors today is Google.  As they grow, they routinely buy up small start-up companies, absorbing them like a black hole, and fold the technology into their expanding universe of software offerings.  We've seen this repeat over and over, Android, Blogger, QuickOffice, all have been absorbed and now are part of the Google software landscape, to name just a few start-ups.

FOSS not Beholding to Anybody

So where does FOSS fit in?  It would seem that community developed software isn't even beholding to corporate interests.  It isn't.

No, FOSS is only beholding to the interests of its developers who voluntarily nuture and cultivate it like a devoted gardener would to their plants.  And, in the absence of that nurturing spirit, FOSS can and often does die off if not maintained.  This is an inherent risk of giving away source code under the software licensing terms of GPLv2.  It becomes very usable, very shareable, only if there is incentive to actively maintain the code base.

Often, young enthusiastic developers devote their time for a year or so and then for various reasons move on.  At that point, if there isn't another maintainer, the FOSS code will whither and die if not maintained.

On the other hand, paid developers on the Capitalist side are typically hired as employees of corporations who develop proprietary code and in some cases open source software but the primary force at work is either a subscription service or licensing cost model to use said software.  Profit seeking is what drives Capitalism.

Because there isn't a broad enough interest by Venture Capitalists to develop FOSS, the majority of development today is dominated by proprietary software created by Microsoft and Apple and their third-party partnering software vendors.  And, many start-ups which begin with the seed of an an idea eventually become absorbed into the proprietary world as a requirement for VC investment.

It's simple enough to develop code and not provide source code to ensure that the technology investment cost is protected by recurring revenue on licensing of software.  VCs understand and adopt a proprietary model of code development most often still, despite the disadvantages that it places on users who cannot enjoy the inherent security benefits of transparency.  Faith must be placed in the software vendor's reputation, abilities and perceived value of purchasing a proprietary software license.  The restrictions placed on use of software vary but the benefits of FOSS do not apply and most often one must purchase another software license to use the same software on another computer, unlike FOSS.

It's Still a Proprietary World

So, while the attraction to FOSS by virtue of its transparency, ability to freely share and change source code are important, large scale deployment of PC software still hasn't spread to the scale of the Microsoft Windows and Apple OSX business world installed base.

True, Red Hat have extended their presence into the Enterprise, but that process hasn't moved along quickly enough as many software development concerns still rely on the proprietary model to drive sales and profits verses the subscription-based model used by Red Hat.

The above notwithstanding, FOSS continues to grow, slowly, pragmatically and spread in popularity. Take it, use it, as you wish, but you must put back changes to the source code you plan to use in any commercial endeavor so that future users can benefit from it.

If that's a problem for you Venture Capitalists, well, FOSS doesn't really much care.

-- Dietrich

Related articles

• What's FOSS all about?
• Stallman, FOSS and the Adobe Nightmare
• Let's audit Truecrypt!
• Goodbye, Encryption; Hello, FOSS

Read More