Re: Security breach at multiple Federal agencies via SolarWinds

[Rick Moen <rick@linuxmafia.com>]

Quoting Alan Davis (alan3davis@gmail.com):

> My naive perspective runs something like this: 
> the human brain evolved to
> solve problems, not so much for engineering  air-tight systems, despite our
> self-portrayal as a species apart.  Consequently, any system created by
> humans will suffer from our inability to perceive all possible aspects and
> vulnerabilities....

Yeah, that's really not what you generally find.  You find people /
organisations who mess up very fundamental things, and then major
collapses follow logically, and then the people / organisations point
fingers energetically in every _other_ direction.

> With regard to cyber-security, vis a vis breaches such as this---beside
> issues about proprietary software being inherently untrustworthy because it
> cannot be brainstormed, but seeks profit and/or security through
> obfuscation

The proprietary software legal model doesn't necessitate obfuscation.
Although most proprietary software happens to be binary-only for various
business and practical reasons, it's perfectly feasible to sell licences
to proprietary software with full source code visibility and build
instructions/tools granted to customers, or even to everyone.

For example, quite a bit of proprietary software implementations of
crypto are published with source code visibility, so outside experts can
audit it, making it more trustworthy to skeptical customers.

The central problem of proprietary code is actually _futureproofing_.
In a nutshell, it's about everyone, not just someone, having the right
to keep developing the code and using it for any purpose.

Let me give you an example:  John Bradley's neat little tool 'xv' for
displaying and modifying graphics files on X11 Unixes was brilliant.
It probably still is.  In early days of Linux (90s), there was nothing
better.  It was small, fast, intuitive, robust, scripting-friendly (so 
you could use it to, say, generate thumbnails from a directory of
thousands of files) -- and it came with full (small) C source code,
which anyone is permitted to distribute in unmodified form.

However: (1) John wants you to send him $35 if you use it and find it
useful, on the honour system.  For personal use, this is merely 
requested.  For commercial/government/institutional use, it's required. 
(2) Nobody else is granted the legal right to distribute modified
versions of xv.

John's most recent release was v. 3.10a, a quarter-century ago:  It's
been abandonware since then.  About two dozen people have sent John
fixes, which he's kind enough to make publicly available as source code
patches, but he isn't producing new versions.  And, because he never
gave other people the legal right to distribute modified versions of xv,
nobody else can step in and release v. 3.11, no matter how many people
still love the program.

That's what I mean by no futureproofing.  One guy had veto power over
whether the program ever got a new release, and all he had to do was 
stop doing anything, and the program died.  End of story.



> I am reminded of the advice that a computer system is only
> secure when it is locked with a meat-space lock and key.

This sounds plausible if you don't know much about computer/network
security, and it leads to low standards and tolerance for massive
screw-ups -- worse, to not even bothering to figure out the substance of
what happened in a security incident.  I politely disagree.


> We should not be surprised when breaches occur.

OK, here's a thing:  Do any of your doors have locks?  Your bicycles?
Your other vehicles?

Would you be surprised if all of those locks suddenly ceased to work and
everything you own got stolen?

> Finger pointing is futile.

Suppose the above happened, except it was just your Kryptonite brand
locks that suddenly ceased to work, all your other locks worked just
fine, and your family's bicycles and motorcycles got stolen.  Would you
think it 'futile' to learn from experience and be dubious of that
company's competence?


> This morning I stumbled upon a podcast on Weekday Radio about a serious
> nuclear accident at Humboldt power station.  The HBO series _Chernobyl_: is
> it pertinent to the (in)actions of SolarWinds?

Does Betteridge's Law apply here?  ;->
http://betteridgeslaw.com/

-- 
You received this message because you are subscribed to the Google Groups "BerkeleyLUG" group.
To unsubscribe from this group and stop receiving emails from it, send an email to berkeleylug+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/berkeleylug/20201218023514.GM28791%40linuxmafia.com.