Re: [PLUG] download from WHERE?

[Rich Freeman via plug <plug@lists.phillylinux.org>]

On Wed, May 13, 2020 at 9:05 AM Fred Stluka <fred@bristle.com> wrote:
>
> On 5/8/20 4:46 PM, Rich Freeman via plug wrote:
>
> > Uh, have you seen what those same 20 year olds are doing with FOSS
> > today?
>
> Yes, I have.  As I said, I don't trust them.  Do you?

That was my point.  This isn't an MS vs FOSS thing.  This is more of a
change in paradigms in software development which is relatively
universal.

> > Half of the newer programming languages are almost impossible
> > to package because their build systems just download random
> > dependencies online, are statically linked, and so on.
>
> What do you suggest?  Stop using yum, apt, pip?  Do you prefer
> running .EXE and .MSI files over Unix shell scripts for installing
> things?

No, my point is that these paradigms are problematic wherever they occur.

>
>
> > You're not going to avoid these problems by avoiding Microsoft.
>
> True.  Not any more.  Microsoft has lowered the bar so much,
> and put out so much low quality inexpensive software that
> other companies have had to cut corners to compete on price.

Honestly, I don't think this is really an MS thing.  I think it is
more of a Facebook and general internet-speed thing.

A perfect solution delivered in two years is going to end up with zero
market share when faced with a cobbled-together solution delivered in
six months.

In the early days there was a lot of talk about Facebook facing
architecture problems.  They were growing so fast that their initial
design just couldn't scale.  They had to throw TONS of money at
keeping the old system on life support while basically having to
refactor the whole thing.

This was touted by many as evidence that Facebook did things the wrong
way.  In reality, it was evidence that they did things the right way.
Yes, doing it over probably cost 10x what doing it "right" the first
time cost.  However, the first time out they were paying for the whole
thing with very scarce capital while their staff was living like
college students.  When they had to redo everything they had money
flooding in from every direction, and thus their biggest problem
wasn't coming up with the money, but spending it fast enough to keep
growing.  If they hadn't been in the market at the right time they
might never have succeeded at all.  It is better to spend $10M to make
$1B than to spend $100k and lose it all.  It is better still to spend
that $10M in installments of $25k before you're making money and
$9.975M when you're making $10M per month.

> Also, most programmers with under 20 years experience have
> never seen a computer with real security.  Have not used a
> mainframe, VAX, Unix or Linux system.  Or even a Mac (OSX is
> BSD Unix).  Only Windows PCs.

So, I have a few concerns with this.

First, modern windows is MUCH more secure than what people were using
in the 90s.

Second, you're comparing multi-user setups with single-user setups.
Unless you're using a linux desktop with SELinux/etc and a LOT of
tailoring those operating systems are not actually all that secure in
a single-user paradigm, and could arguably be less secure than windows
against remote intrusion in some ways.

This has already been argued to death so I'll be brief.  Suppose you
are hit by a zero-day on Windows vs Linux in your browser, which is
probably any desktop user's single biggest vulnerability window (that
and their MUA I guess).  Now some remote code has the ability to
execute arbitrary commands using your UID.  Unless you're
containerizing your browser/etc that code can already read all your
personal info in both scenarios - the only thing it can't do on either
platform is modify the core of the OS.  I'd argue that on Windows it
can probably tamper with fewer of your settings/etc due to the whole
UAC mechanism, while on linux pretty-much anything in
.config/.whateverrc and so on is editable without priv escalation.

Now, I will concede that Linux has more tools available to lock this
stuff down like containerizing applications, or SELinux with
fine-grained permissions so that random processes can't just go
editing your .bashrc or whatever.  However, most of this stuff is not
configured in a typical desktop environment, and even distros that use
SELinux by default probably don't lock it down to that degree - it
would require a lot more conventions around what goes where in a
user's home directory and so on.

Now, one thing users do have a lot of exposure to is mobile operating
systems, and this is an environment where these sorts of controls
actually are fairly routine.  Perhaps they're still not as extensive
as might be desirable, but something like Android or iOS does a LOT
more to sandbox application and user configuration data than your
typical desktop Linux distro or windows.

Finally, you also have to consider physical security.  VAX and
Mainframe systems typically store all their data in secured
facilities.  Modern desktop users keep a ton of personal data on
phones/laptops/etc.  Now, Android runs Linux and is generally
configured to have a pretty high level of physical security, and I
suspect that in practice iOS is more secure.  Windows is often not so
secure by default but it actually has a number of tools for full-disk
encryption and so on available, often with check-box-level
configurability assuming you have the right version of Windows.  Most
Linux distros lag in this area.  Many do offer home directory
encryption these days, but none that I'm aware of back it with a TPM
so that it is impossible to break if the drive is separated from the
computer.  Almost no distros do any kind of verification of the OS
itself to prevent tampering.  Windows does most of that out of the
box, as do most mobile operating systems.

So, I think on the security front you have a fairly complex situation,
with various options offering various security protections out of the
box, and with others available if an administrator deploys them.

> So, they've accepted the lower bar and learned a lot of bad
> habits.  And now they write mission critical systems in hospitals,
> medical devices, military, air traffic control, nuclear power plants,
> etc.  Scary!

So, having seen some of the stuff in at least one area of healthcare I
do have concerns, but you also have to consider that the controls go
way beyond the software.

Typically these sorts of processes and systems have tiers of
procedures and processes around them that together make it relatively
difficult for an attacker to have a serious impact on life/etc.

Now, for stuff that is of obvious strategic significance that is
likely to be targeted by a state actor I completely support the idea
that we probably need to be doing a lot more.  These sorts of systems
need multiple lines of defense from the applications to the OSes to
the networks to the processes and so on.

I will note though that these sorts of areas are the one place you
won't see many of the modern programming paradigms we were talking
about at the start of this email.  It is almost always
highly-waterfalled development paradigms with layers of change and
configuration management moving at a glacial pace.

> > Also,
> > it seems like half of this whole discussion is as dated as the 1991
> > post on that website...
>
> Rich, I have to say that I'm a little disappointed at the dismissive
> and inaccurate nature of that comment.  You usually seem to to
> pay more attention to detail than that.  And I usually find that
> you have something to say that's worth listening to.

So, I'll agree that this may have come across a bit personally when it
was more directed at the general MS pile-on attitude that is prevalent
in this thread.  It has always been fashionable to bash MS, but IMO a
lot of the issues they had in the 90s are not the same issues they or
other vendors have today.

I don't think that you personally should be called out on that - it is
actually a fairly prevalent attitude in the community.  My words may
have been a bit harsh in that regard.

>
> The article is my current opinion of Microsoft after
> observing their behavior, working around their bugs, hacking
> easily into their systems, and warning people of their weak
> security since I was first forced to use Microsoft software at a
> job 19 years ago.

And that is my point.  I didn't say the information was incorrect.  I
said it was DATED.

You can't really assign a reputation to anything that lasts 20 years,
but that is especially true of a company.  People can change over
time.  Companies change people ALL the time.  Change the CEO and
suddenly the company can have a completely different personality.
Obviously there is some inertia but you have to be careful about
applying judgements 20 years later.

> 1. Do you claim they did NOT intentionally install DLLs on my
>      computer to sabotage Netscape?
>
> 2. Do you claim they did NOT extort $40,000 from my father?

Of course not.  Hence the reason I used the word "dated."  I don't
think you're making things up - they were different back then.  Maybe
if they had more market power they'd be still doing that stuff today.
Maybe if RedHat had that kind of market power today they'd be doing
that stuff too.

>
> 3. Do you claim they did NOT lower the bar in software quality
>      compared to their Unix and mainframe predecessors, as I
>      described?  Or that Linux and FOSS are NOT better and
>      safer alternatives?

So, I already shared my thoughts on that above.  And MS software in
the 90s was very different from what it is today.

Obviously I'm a fan of Linux in general and prefer it for a lot of
solutions for a lot of reasons, and security can be one of them.
However, I don't think that you're automatically more secure because
you're using an Ubuntu desktop running Firefox instead of a Windows
desktop running Firefox.

> 4. Do you claim that most of the world's bugs and security
>      problems are NOT on Windows systems?  That Windows PCs
>      are NOT the majority of machines in malicious botnets?

So, I think that is more a result of who operates those machines and
their level of network access.  I've heard tales from family members
who got scammed into giving somebody remote access to their Windows
boxes and paying them for the privilege.  I'm not sure that they'd
have been any more secure if they were using most conventional Linux
distros.  Specialized ones like Android/ChromeOS/etc can be more
secure because they basically aim to protect the user from themselves
with almost no way to override that which doesn't involve flipping
switches, attaching USB cables to other computers, and wiping the
device in the process and getting hit with security nag screens on
every boot.

Even then I'd think we'd see a LOT more old mobile phones targeted for
botnets if it wasn't for the fact that mobile networks are fairly
locked down.  You can't get a worm spreading between mobile phones
because they're all completely firewalled from incoming connections,
often behind a NAT as well.

> 5. Do you claim they are NOT dishonorable people in general?

No moreso than anybody really.  You're talking about a company with
tens of thousands of employees.  Most of them are going to be just
like you or I.  Often you get some really scummy ones at all levels.
The ones at the bottom usually are leaches on the company, and the
ones at the top tend to be leaches on all of society, but often are
leaches on the company too.

> If not, what exactly ARE you saying?

I just think that a bit of nuance is necessary.  When evaluating
security you need to look at the entire ecosystem, especially the
user.  When you look at companies you need to look at what they're
DOING today, and not really go too much on reputation one way or
another.

One big advantage of FOSS is that you're less beholden to any
company's reputation, because you get the source, and you can see for
yourself what is going on, and pay anybody you choose to do so as well
and to maintain it if your relationship with the original vendor
sours.  Now, that isn't always a reasonably-priced option, but it is
still an option.

However, with the lower barrier to entry you don't have to be
thoroughly indoctrinated in the ways of change management in order to
get access to the COBOL interpreter.  That creates both opportunity
and danger, and it is important to use the right programming paradigms
in the right places.

-- 
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug