08.08.08

Another Reason to Avoid Mono: Security

Posted in GNU/Linux, Microsoft, Mono, Novell, Security, Windows at 5:27 pm by Dr. Roy Schestowitz

“At Microsoft I learned the truth about ActiveX and COM and I got very interested in it inmediately [sic].”

Miguel de Icaza

For reasons and factors that make OOXML not secure, Mono is a security hazard as well. For those who are not yet convinced, there is this brand-new article which highlights the architectural failures of .NET and their impact on security. Read it.

Two security researchers have developed a new technique that essentially bypasses all of the memory protection safeguards in the Windows Vista operating system, an advance that many in the security community say will have far-reaching implications not only for Microsoft, but also on how the entire technology industry thinks about attacks.

Also in the news today is this alarming issue of 7 “critical” flaws (the highest level of severity) in Microsoft software.

Does anyone want GNU/Linux to inherit this nightmare? Is this something which belongs in the operating system which NASA, the NSA and the Department of Defense use? What about the cost implications? Beyond the issue of acquisition cost also exist the costs of maintenance, repair, and damage control. Losses incurred by leaks (espionage) and data loss are sometimes invaluable.

A few hours ago, one reader sent us the following message regarding the consequences of poor security.


Note that the bad engineering promoted by Bill Gates and his movement is probably costing Joe Sixpack upwards of 8 hours lost effort per week from malware, instability and poor interoperability. With the US in the economic situation it is in, that may be enough to knock the floor out of the recession. The failure that is Microsoft Vista may be the last straw and take down what’s left of the economy.

“The failure that is Microsoft Vista may be the last straw and take down what’s left of the economy.”Until recently, Microsoft people have been able to stifle security information. However, the EFF’s recent win paves the way forward for better technology to become more visible.

I look forward to the seeing Back-To-School Security Packets in Walmart, Best Buy, and others consisting of Xubuntu CDs.

The last 10 years have shown us nothing if not that FOSS helps make your business more recession-proof.

What we have here is an old and odd spin trotted out yet another time. The spin tries to be negative, but at the end of the day, use of FOSS has boosted the economy there by some $60 billion on unnecessary sunk costs.

Further, since were FOSS tends to lead, it leads due to better performance, quality, interoperability and maintenance, not just cost. So that leads to secondary and tertiary savings. After all, if the IT team is not having to spend all its time chasing fires, it can be far more than $60 billion in savings once the total cost of ownership is settled.

Sure a small wedge of the software sellers might have lost, but the large part of the pie consists of software users. We win here.

____
1) “EFF Wins Protection for Security Researchers” (2007)

2) “Vista’s Security Rendered Completely Useless by New Exploit” (2008)
“… a technique that can be used to bypass all memory
protection safeguards that Microsoft built into Windows
Vista…”
“… the work is a major breakthrough and there is very little
that Microsoft can do to fix the problems…”

3) “This Bug Man Is a Pest” (2008)
“…His syllabus is partly a veiled attack on McAfee,
Symantec and their ilk, whose $100 consumer products he
sees as mostly useless. If college students can beat
these antivirus programs, he argues, what good are they
for the people and businesses spending nearly $5 billion
a year on them? …”

4) “USENIX WOOT07, Exploiting Concurrency Vulnerabilities in System Call Wrappers, and the Evil Genius” (2007)


For those wondering about highly-restrained criticism of Microsoft/Windows security, a mandatory background would be the smear campaigns against security researchers. Smear campaigns are something that Microsoft is intimately familiar with [1, 2, 3, 4, 5, 6, 7, 8, 9]. Remember the Geer saga, too [1, 2] (little more in [1, 2, 3]). He lost his job for saying the truth about Microsoft’s security shortcomings and the horrific state of the Web, caused largely by Microsoft and its back doors.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

This post is also available in Gemini over at:

gemini://gemini.techrights.org/2008/08/08/avoid-mono-due-to-security/

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. [Meme] Bundestagate Series Spoiler

    The chain of command/s at the EPO typically leads to major tragedy



  2. Breaking News: Campinos to Appear Before the Legals Affairs Committee of the European Parliament on Monday 12 April

    "Some MEPs have been briefed about ongoing governance deficits at the EPO, in particular the lack of GDPR compliance and the sell-out of "digital sovereignty" to Microsoft, but it remains to be seen whether or not they will dare to bring these issues up during the hearing."



  3. Pro-FSF Petition (“An Open Letter in Support of Richard Matthew Stallman Being Reinstated by the Free Software Foundation”) Tops 6,200 Signatures

    Monopolies and their media, along with their NGOs, have spoken and incited based on falsehoods; people now respond so the hate letter has a real crisis



  4. Links 10/4/2021: osbuild 28, KDE Frameworks 5.81.0

    Links for the day



  5. EPOLeaks on Misleading the Bundestag -- Part 12: A Worthy Successor to His Mentor?

    We examine the role of Christoph Ernst in EPO management, both in the Benoît Battistelli era and the António Campinos era (plenty to hide)



  6. USPTO for Monopolies, Keeping GNU/Linux in the Dark

    Growing evidence of gross discrimination against GNU/Linux (or Free software, even BSD/UNIX) users at the USPTO is too hard to ignore; some people out there challenge the Office over this travesty



  7. Accessibility and Availability First

    To make Techrights more widely accessible and more difficult to block/censor we've been making further changes, including self-hosting where possible



  8. Self-Hosting Videos With Free Formats and Animated Previews, Watermarks/Logos and Translucency

    We examine the power of video editing with ffmpeg, chained with command-line scripting and HTML5 features



  9. Links 10/4/2021: Linux on M1, Wine 6.6, ClamAV 0.103.2

    Links for the day



  10. Lunduke: On Mob Justice in the Tech Industry

    A new video from the former Microsofter who fears the phenomenon that’s adopted by companies like IBM



  11. IRC Proceedings: Friday, April 09, 2021

    IRC logs for Friday, April 09, 2021



  12. EPOLeaks on Misleading the Bundestag — Appendix (Benoît Battistelli's Vichy Syndrome): Georges Henri Léon Battistelli and Charles Robert Battistelli

    Local copies with evidence of or something concrete about Benoît Battistelli’s connection to unsavoury — and by today’s standards outright fascistic — politics



  13. IBM Doubles Down on Masters Being an Acceptable Word in the Context of Technology

    3 days after this post which disproves IBM's stance or shows its double standards it once again says “Masters” in its official blog (won’t that offend and alienate some people as they insist?)



  14. Hate Letter Against Richard Matthew Stallman (RMS) Backfired So Spectacularly That Signers Asked to Revoke Their Own Signatures and the List Was Then Frozen Permanently (Updated)

    "An open letter in support of Richard Matthew Stallman being reinstated by the Free Software Foundation" tops 6,100 signatures (graph generated just moments ago)



  15. EPOLeaks on Misleading the Bundestag -- Part 11: The BMJV's Tweedledee: Dr Christoph Ernst

    The right-hand man of António Campinos plays a role similar to that of Herr Lutz before him



  16. Links 9/4/2021: Tanglet 1.6.0 and HPVM 1.0

    Links for the day



  17. The Libel Against Richard Stallman Did Not Age Well

    Almost 2 years down the line libel about the founder of the FSF remains online, uncorrected (in sites funded by Microsoft and IBM)



  18. The Letter in Support of the FSF and Richard Stallman is Backed by the International Community, Not American Monopolies and Nationalistic Elements

    Free software is for everybody to use, internationally, it is not the asset of a bunch of current and old monopolists (connected to the US military) that also control the media; the nature of the signatures says that out loud



  19. Gemini Over IPFS (Decentralised Web, Accessed Over Gemini Protocol)

    The Gemini protocol (gemini://) can already be used to fetch (at the back end) and present objects from a P2P-like network; we're currently exploring practical use cases and possibilities



  20. News Sites That Talk About Patents Have Become Shameless Self-Promotion 'Plugs' by Law Firms (and Sometimes Outright 'Spam' for Litigation)

    The sources of news about patent affairs have dried up; sites that actually used to investigate and report facts have since then shut down or defected to the Public Relations/marketing industry



  21. Links 9/4/2021: Kubernetes 1.21 and FFmpeg 4.4 Released

    Links for the day



  22. IRC Proceedings: Thursday, April 08, 2021

    IRC logs for Thursday, April 08, 2021



  23. [Meme] Self-styled Judges

    To suit a recurring theme at the EPO we hereby present Roland Lutz, a self-styled judge



  24. EPOLeaks on Misleading the Bundestag -- Part 10: A Faithful Lapdog Despised and Reviled by EPO Staff

    "In any event, the "Nazi" jibes directed against Lutz seem to have triggered Battistelli who decided to take revenge on his perceived enemies inside the EPO by smearing them as “Nazis”."



  25. Links 8/4/2021: GnuPG 2.3.0, Xen 4.15, Xfdashboard 0.9.2

    Links for the day



  26. The Hate Letter Which Backfired

    The FSF is more closely aligned with its founder's vision, his antagonists have left or are leaving, and that old hate letter turned out to be a loud minority (made to appear louder by biased media) emboldened by a gish gallop of lies



  27. IRC Proceedings: Wednesday, April 07, 2021

    IRC logs for Wednesday, April 07, 2021



  28. IBM: We Can Say It... You Cannot

    Blog posts such as this new one help show the hypocrisy or the double standards of IBM, looking to control speech while attacking people's (software) freedom/civil liberties and profiting from atomic bombs



  29. The Collapse of Microsoft Windows

    Although the corporate media keeps insisting that Microsoft is doing well, government (or military) bailouts keep the company afloat while its desperate attempts to remain relevant (as the common carrier languishes) merit a debate



  30. Links 8/4/2021: Mesa 21.0.2, GNU Releases, and Stable Kernels

    Links for the day


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts