04.27.15
The Unethical Business of Selling Fear of Free/Libre Software Bugs (Black Duck, Sonatype, and Symantec)
Summary: The spreading of fear of Free/Open Source software (FOSS) is now a growth industry, so proprietary opportunists are eager to capitalise on it, even if by distorting the truth
EARLIER THIS month some Black Duck publicity stunt fooled some journalists into promotion of Black Duck FUD. We saw that persisting until April 20th (one week ago), even in pro-FOSS sites (blogs) that did this days later. IDG made a slideshow out of it. Well, sadly, it cites Black Duck, which tries to sell proprietary software under the guise of Free software promotion.
In reality, Black Duck is not just selling fear of GPL violations — the original 'product' which was 'sold' by this firm. It’s a two-faced firm masquerading as pro-FOSS whilst attacking FOSS. Black Duck and Duck Duck Go both give a bad name to ducks. They pretend to be FOSS or at least openwash themselves (a lie) and they pretend to defend users (also a lie, they merely exploit or monetise users).
In other news, Sonatype reportedly compared FOSS to “Public Health Hazard”. To quote one report: “That’s the assessment of Joshua Corman, CTO at Sonatype, who took to the stage at RSA 2015 to characterize insecure software as a kind of “cyber-asbestos,” widely deployed, inherently dangerous, and eventually carrying an astronomical cost in terms of human suffering and cost to clean up because …we just didn’t know how dangerous it was at the time when we embraced it.”
So Sonatype is again on an anti-Free software binge. It is not the first time (see examples in [1, 2, 3, 4]) and it is easy to see why it is doing this. It’s trying to sell its products, which are nothing to do with Free software. Sonatype’s track record of FOSS FUD is expanding and may one day rival the Microsoft-connected Symantec, which continues its FUD campaign against Android, generating misleading headlines such as “One in Five Android Apps Is Malware” in this case. When people install software from Google Play, then there is virtually no risk, but don’t expect Symantec to properly analyse this. Symantec sells insecurity. To quote the misleading article: “According to Symantec’s latest Internet Security Threat Report, “17 percent of all Android apps (nearly one million total) were actually malware in disguise.” In 2013, Symantec uncovered roughly 700,000 virus-laden apps.”
But where are they found? Are any accessible to most Android users? No, so Symantec is defining it wrongly and framing the issue by saying that many applications’ “primary purpose is to bombard you with ads.” That’s not malware, but they made up a new word.
Google has already responded mostly by removing apps with too many ads (that’s not malware) and saying that Android “antivirus” is snake oil, as Google said before (responding to the likes of Symantec several years ago).
Android now has an industry of snake oil around it because there is a lot of market share there. The same can be said about FOSS, which is why Black Duck and Sonatype are busy badmouthing security aspects of it. They’re all just looking for a quick buck; FUD and reputation damage to FOSS are “collateral damage”. █
Content is available under CC-BY-SA