EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

11.27.13

NSA Shows Why We Should Abandon All Proprietary Software and Verify Trust

Posted in Free/Libre Software, Security at 11:19 am by Dr. Roy Schestowitz

Without source code of all levels/layers of the software trust just cannot be established

Compiler

Summary: Proprietary software can never be secure and back doors inside of it can be assumed (unless proven otherwise), based on some of the latest NSA leaks

THE NSA is a criminal operation, so we expect it to work with other criminal operations. Microsoft and the NSA collude to make the world a less secure place, enabling espionage with Windows (Stuxnet for example) and providing video/audio surveillance in people’s own homes without any warrants. Microsoft is about lawlessness is the same way the NSA is. The law of “rule” supersedes the rule of law.

Some say that the Windows-centric Stuxnet is the “world’s first true cyber-weapon”, but that is not true. History aside, to put it as IDG put it: “Stuxnet’s creators recognized they had built the world’s first true cyber-weapon and were more interested in pushing the envelope of this new type of digital warfare than causing large-scale destruction within targeted Iranian nuclear facilities, a study shows.

“In an analysis released last week, Ralph Langner, head of The Langner Group and a renowned expert in industrial control systems (ICS), also refuted arguments that only a nation-state had the resources to launch a Stuxnet-like attack. Assailants with less ambition could take the lessons learned and apply them to civilian critical infrastructure, he said.”

This was an example of overreach and violation of the law, enabled of course by Microsoft and Windows. GNU/Linux does not sell its users down the river the way Windows does.

Sadly, firms like White Source make a comeback with their FUD and they single out FOSS for security issues (here is the press release). This is not acceptable because they totally ignore the much bigger threats, as above (where security issues are there by design).

The White House is at war against FOSS geeks and other phantom enemies [1,2], where the logic is something along the lines of, if we don’t control it (we as in the government), then it’s a threat to national security. While it seems clear that a brute force attack is the Achilles Heel of FOSS [3,4,5] and Google keeps improving security of FOSS projects like Android [6,7,8,9.10] and others [11,12], the logic followed by the likes of White Source and White House is that if something proprietary keeps its flaws (or back doors) secret, then it’s secure and we should not pay attention to real security. Again, this is simply not acceptable.

The head of the Linux Foundation recently said that FOSS is safer, and Linux is more secure than any other OS [13]. Mikko Hypponen seems to agree with him [14] and despite some new known flaws in Red Hat software [15,16] (transparency makes weaknesses visible) we should remember that lack of knowledge about something does not mean it’s not there. Just because we cannot easily see back doors in proprietary software doesn’t mean they’re not there (some groups of people know they’re there and they exploit them silently). If Europe is serious about cyber security [17], then it should dump all proprietary software (back doors-friendly software) as soon as possible. Given everything we now know about the NSA, ignorance and uncertainty are no longer an excuse. A Dutch source has just revealed that the NSA cracked 50,000 computer networks. The evidence is overwhelming. Stuxnet is peanuts next to that.

Related/contextual items from the news:

  1. How Antisec Died

    Depending on when one asked, Antisec was generally between 8-10 people, with a solid core of about six. Not all of them were comfortable with talking to me, and certain ones were designated to communicate with press. I was never entirely sure who was in or out at any particular time — it was a fluid group. I never knew all the nicks. I talked repeatedly with five of them, including Sabu.

  2. Bizarre Online Gambling Movie-Plot Threat

    This article argues that online gambling is a strategic national threat because terrorists could use it to launder money.

  3. Huge horde of droids whacks code box GitHub in password-guess attack
  4. GitHub resets user passwords following rash of account hijack attacks

    GitHub is experiencing an increase in user account hijackings that’s being fueled by a rash of automated login attempts from as many as 40,000 unique Internet addresses.

  5. Google extends its proactive Patch Reward Program to include Android Open Source Project, Web servers, and more
  6. Google adds Android Open Source Project to Patch Rewards program
  7. Google expands Patch Rewards Program
  8. Google extends open source bug bounty programme to Android and Apache
  9. Android now part of Google’s Patch Reward Program
  10. Google adds Android and Apache to open source security rewards programme

    Google has extended its Patch Reward Program to include a raft of new platforms and technologies including its own Android system as it looks to improve the securiry of open source software.

    The firm announced an overhaul to its security patch policies last month, offering white hats up to $3,133 for fixes.

  11. Experts applaud Google completion of SSL certificate upgrade

    Step up to 2048-bit keys optimizes balance between protection of company services and maintaining performance

  12. Pinkie Pie and His Google Exploits: The Legend Grows

    Pinkie Pie returned in 2013 for the desktop Pwn2Own event operated by Hewlett-Packard’s Zero Day Initiative (ZDI), taking aim once again at Google. This time, it was Google’s Chrome browser running on Chrome OS. Pinkie Pie’s effort landed him another $40,000 in award money for the discovery and reporting of what turned out to be a trio of flaws, including one buried deep within the Linux kernel. Chrome OS is a Linux-based operating system that Google uses on its Chromebook notebooks.

    But wait. There is still more.

    Just this week in Japan at HP’s Mobile Pwn2Own event, the legend of Pinkie Pie grew as the My Little Pony-loving security researcher once again demonstrated previously unknown zero-day flaws in Google’s Chrome. Pinkie Pie was able to pwn Chrome on both a Nexus 4 as well as a Samsung Galaxy S 4 smartphone. This time, Pinkie Pie pocketed $50,000 for his efforts.

  13. Linux chief: ‘Open source is safer, and Linux is more secure than any other OS’ (exclusive)
  14. Mikko Hypponen: Open Source Software Will Make the World More Secure

    Open source software can be one answer to combating the global surveillance of innocent citizens, said security expert Mikko Hypponen in his keynote last week at LinuxCon and CloudOpen Europe in Edinburgh.

  15. Hackers actively exploiting JBoss vulnerability to compromise servers, researchers say

    Attackers are actively exploiting a known vulnerability to compromise JBoss Java EE application servers that expose the HTTP Invoker service to the Internet in an insecure manner.

  16. Red Hat: 2013:1521-01: python-django: Moderate Advisory
  17. European businesses urged implement anti-cyber security systems

    The European Cyber Security Directive, which proposes that European businesses have a legal obligation to ensure they have suitable IT security mechanisms in place, is soon to be enforced in the UK.

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. Links 23/8/2016: GNOME 3.22 Beta, Android 7.0 Nougat

    Links for the day



  2. The Linux Foundation Gives Microsoft (Paid-for) Keynote Position While Microsoft Extorts (With Patents) Lenovo and Motorola Over Linux Use

    This morning's reminder that Nadella is just another Ballmer (with a different face); Motorola and Lenovo surrender to Microsoft's patent demands and will soon put Microsoft spyware/malware on their Linux-powered products to avert costly legal battles



  3. Not Just President Battistelli: EPO Vice-Presidents Are Still Intentionally Misrepresenting EPO Staff

    Evidence serving to show that EPO Vice-Presidents are still intentionally misrepresenting EPO staff representatives and misleading everyone in order to defend Battistelli



  4. Battistelli the Liar Causes a Climate of Confrontation in French Politics, Lies About Patent Quality (Among Many Other Things)

    Battistelli's lies are coming under increased scrutiny inside and outside the European Patent Office (EPO), where patent quality has been abandoned in order to artificially elevate figures



  5. The Collapse of Software Patents and Patent Law Firms Trying to “Overcome” Alice

    The United States continues its gradual crackdown on software patents (which are viewed as abstract and thus unpatentable), whereas in Europe things are murkier than ever



  6. Apple's Patent Wars Against Android/Linux Make Patent Trolls Stronger

    Apple's insistence that designs should be patentable could prove to be collectively expensive, as patent trolls would then use a possible SCOTUS nod to launch litigation campaigns



  7. Links 22/8/2016: Linux 4.8 RC3, Linux Mint 18 “Sarah” KDE Beta

    Links for the day



  8. Links 21/8/2016: Apple and Microsoft Down, Systemd Spreading to Mount

    Links for the day



  9. Links 20/8/2016: Android Domination, FSFE summit 2016

    Links for the day



  10. Patents Roundup: Trolls Dominate Litigation, PTAB Crushes Patents, Patent Box Regime Persists, and OIN Explains Itself

    Another roundup of patent news from around the Web with special focus on software patenting



  11. The Cost/Toll of the 'New' EPO and Where All That Money Goes or Comes From

    The European Patent Office has become a servant of the rich and powerful (including large foreign corporations) and even its own employees now pay the price associated with misguided new policies (or 'reforms' as Battistelli habitually refers to these)



  12. Links 19/8/2016: Linux Mint With KDE, Linux Foundation's PNDA

    Links for the day



  13. The End of an Era at the USPTO as Battistelli-Like (EPO) Granting Policies Are Over

    The United States is seeing the potency of patents -- especially software patents (which make up much of the country's troll cases) -- challenged by courts and by the Patent Trial and Appeal Board (PTAB)



  14. Battistelli's European Patent Office Goes to the United States to Speak About the UPC and Software Patents

    The European Patent Office is showing its utter contempt -- not just disregard -- for the very fundamental rules that put it in its place and brought it into existence



  15. Turkey Subjected to the European Patent Convention (EPC) But Benoît Battistelli is Not?

    The ‘constitutional crisis’ at the European Patent Office in the context of Turkey, which has signed "the EPC and as such recognises the competence and the decisions of the institutions which have been introduced in the convention."



  16. Links 18/8/2016: EFF Slams Vista 10, Linux Foundation Makes PNDA

    Links for the day



  17. Links 17/8/2016: GNOME and Debian Anniversaries

    Links for the day



  18. Personal Audio LLC and Patent Troll Jim Logan Demonstrate the Harms of Software Patents and Why They Must Never Spread to Europe

    Jim Logan of Personal Audio (a notorious Texas-based patent troll) is still fighting with his bogus patent, having already caused enormous damage with a single software patent that should never have been granted in the first place (due to prior art, not just Alice)



  19. The Patent Microcosm Hopes That the Originators of Software Patents Will Undermine the Patent Trial and Appeal Board

    Now that the actions of the Patent Trial and Appeal Board (PTAB), which have been consistently upheld by the CAFC in precedential decisions, are suddenly being questioned the patent microcosm gets all giddy and tries to undermine PTAB (again)



  20. That Time When the Administrative Council Helped Battistelli Crush Oversight (Audit Committee) and What ILO Said About It a Month Ago

    Things are becoming ever more troublesome at the EPO as the Administrative Council enjoys inaction from the International Labour Organization (ILO), in spite of its role in destroying much-needed oversight at the behest of Battistelli



  21. The EPO's Administrative Council Keeps Postponing Debate About Grounds for Firing the President

    A recollection of events prior to the latest Administrative Council meeting, where Benoît Battistelli's failings and accountability for failing to correct them never even came up



  22. A Surge of Staff Complaints About the European Patent Office Drowns the System, Disservice to Justice Noted

    Self-explanatory graphs about the state of the justice [sic] system which is prejudiced towards/against EPO workers, based on internal reports



  23. Links 16/8/2016: White House Urged by EFF on FOSS, Go 1.7 Released

    Links for the day



  24. Links 15/8/2016: Linux 4.8 RC2, Glimpses at OpenMandriva Lx 3.0

    Links for the day



  25. Clawing Back the Staff Benefits at the European Patent Office (EPO)

    Staff of the EPO is leaving (or retiring) in droves as abusive management continues to be the norm and staff benefits are being taken away or gradually revoked



  26. The Patent Microcosm is Panicking and Spinning Alice/§ 101 Because US Software Patents Are Still Dying

    A look at recent developments in the software patents scene in the United States, with increased focus on (or fear of) the Patent Trial and Appeal Board



  27. 21,000 Posts in Techrights in Less Than a Decade

    This post is the 21,000th post and the next one will make it more than twenty-one thousand posts in total. We are turning 10 in November.



  28. Patent Microcosm Shuts Out the Poor: Unified Patent Court (UPC) Promotion by Practising Law Institute (PLI) Only for the Wealthy

    The people who are profiting from patent feuds, disputes, lawsuits etc. are still trying to muscle their will into European law and they keep the general public out of it by locking down (or pricing out of reach) their meetings where they influence/lobby decision-making officials



  29. The United States Has a Growing Patent Trolls Epidemic as Very High Proportion of Lawsuits Filed by Them

    A look at the high proportion of patent lawsuits that are filed by entities that make nothing at all and thus serve no role whatsoever in innovation



  30. Pushers of Software Patents Outside the United States (Which is Belatedly Squashing These Patents)

    How patent law firms are distorting the debate about software patents in hope of attracting business from gullible people who misunderstand the harsh (and worsening) reality of software patenting


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts