04.02.11
Red Hat’s Obfuscated Patches Harm Small GNU/Linux Players and Help Microsoft/Novell
Summary: Suggestions to Red Hat, whose commitment to transparency has eroded somewhat and needs prodding for
TECHRIGHTS runs on top of CentOS, which relies on Red Hat for its updates. Earlier this week at work I was told that CentOS had not released patches since December, whereas RHEL patches are released at a pace of several per week. This may make one wonder about the new Scientific Linux, which might one day outpace CentOS and replace it as the de facto RHEL clone.
“Red Hat can improve its bottom line by sticking a cork in CentOS and preventing access to RHEL-targeted patches.”Red Hat defends its dubiously obfuscated patches by pointing the finger at Oracle, but let’s face it; it is often said that the most widely used distribution of GNU/Linux is the quiet giant, CentOS. Many Web hosts run it and they are not alone, sector-wise. Nobody knows just how many servers run CentOS, but it’s probably many millions. Red Hat can improve its bottom line by sticking a cork in CentOS and preventing access to RHEL-targeted patches. Oracle would be a convenient Goliath to blame, but is it really as dangerous as Red Hat wants us to believe while Red Hat’s financial numbers keep hitting new record highs? The subject of transparency at Red Hat was addressed here quite recently and Techrights will continue to pressure Red Hat to rectify these issues, both by explaining the Acacia settlement [1, 2, 3] and by providing GPL-friendly patches to those who require them. The GPL is designed to avoid exclusion, even if that means allowing Oracle to embrace other people’s work.
As we pointed out this morning, Novell is trying to take advantage of Red Hat’s practices, hoping to sell Microsoft-taxed SLE* at the expense of/instead of RHEL (there is also a peripheral article about it now). Who would that benefit? █
David Gerard said,
April 2, 2011 at 6:34 pm
Well, now. This is anecdotal, but … I work for a company that has various web-based applications. These are written in Java. (Yes, we saw the Oracle-Google suit and several people had a good hard think about their career path.) They were running on Solaris, but Oracle is insane and on crack, so I strongly advised my boss and boss’s boss to ignore all our years of Solaris experience and move to Linux post-haste.
We’re going to VM-based hosting. Oracle want £300 to run Solaris on non-Oracle hardware for a year. So we’re going Linux.
The hosting company offered RHEL or … Ubuntu server. We went Ubuntu ‘cos we like Debian and it’s close enough for our purposes. (IT’S JUST RUNNING JAVA.)
Supporting all the hardware ever is a big plus for RHEL … but not so much if people are hosting in VMs. And you know, Ubuntu is free as in beer too. (And you don’t have to put up with the hideous Unity interface on a server.)
Dr. Roy Schestowitz Reply:
April 2nd, 2011 at 7:10 pm
Well, Ubuntu servers that I deploy are X-less. It should not be a problem. Debian is a safe bet, too.
BenderBendingRodriguez Reply:
April 3rd, 2011 at 4:20 am
Roy, do you realize that debian is at it’s default the least safe Linux distro out there?
http://labs.mwrinfosecurity.com/notices/security_mechanisms_in_linux_environment__part_1___userspace_memory_protection/
http://labs.mwrinfosecurity.com/notices/assessing_the_tux_strength_part_2_into_the_kernel/
Granted it has been written on september but i really doubt that debian changed security wise
twitter Reply:
April 4th, 2011 at 1:03 pm
Calling Debian the “least safe Linux distro” is sort of like calling flint the most toxic of metamorphic rocks and glasses. I’m particularly wary of articles that complain that free software does not have tools that non free software inevitably needs to make up for mono cultural flaws and code staleness. Olympic athletes can use crutches too but generally don’t rate themselves on their ability to use them. Until we see successful attacks in the wild, most of these security articles are an academic exercise at best and FUD at worst.
There’s a lot to recommend Debian. Complexity is itself a flaw that leads to exploitation and Debian sensibly avoids this unless forced. Debian also is one of the most package rich and platform diverse distributions, diversity that is both useful and protective. When and if there’s a problem, the Debian community can and will deploy these alternate tools.
Dr. Roy Schestowitz Reply:
April 4th, 2011 at 1:14 pm
If one depends on Debian’s well-tested patches, then there might be a delay between ‘real’ patch and Debian patch. But otherwise, people can always patch using whatever comes from the original source. I had this discussion in London some days ago. Calling Debian “the least safe Linux distro” is odd to me too.