10.08.22

Gemini version available ♊︎

Beware the Distortion of Terms Like ‘Supply Chain’, ‘Zero Day’, and ‘Back Door’ (New FUD Patterns Against Free Software, a Distraction From the Real Culprits)

Posted in Deception, Free/Libre Software, FUD, Microsoft, Security at 11:45 am by Dr. Roy Schestowitz

Proprietary software is being protected by ‘googlebombing’ tactics; the biggest weaknesses of proprietary software are being spun as a key problem with “Open Source” and proprietary software's shortcomings are being blamed on the alternative to it

Linux Foundation: repeat what Microsoft says

Summary: Microsofters spread misinformation/disinformation about Free software and security thereof; the corruption (bribery) of organisations such as the so-called ‘Linux’ Foundation means that Microsoft’s misinformation/disinformation now comes out of the mouths of the supposed opposition, too

THE Daily Links in this site habitually add some “Ed”(itorial) comments to highlight FUD (Fear, Uncertainty, Doubt/fear-mongering) and offer some quick response to it. How much can publishers lie for the likes of Microsoft or VMware before those publishers perish due to a lack of credibility and, in turn, a lack of audience?

Earlier today we posted some more examples of this kind in Daily Links. Not a day goes by without several such ‘incidents’ (misinformation/disinformation).

“The real “supply chain” trouble is Microsoft and proprietary software…”In this post we highlight 3 recent patterns we’ve noticed. They are semantic lies.

Recently, a Microsoft front group called “Linux Foundation” kept using terms like “supply chain”. Years ago nobody used this term in relation to Free software and then Microsoft bought a lot of the so-called ‘supply chain’, in the form of GitHub and then NPM. Would anyone trust the integrity of code and binaries from a platform controlled by Microsoft and the NSA, whose CSO is a decades-long NSA veteran?

The real “supply chain” trouble is Microsoft and proprietary software; you can’t audit what you’re getting and it might be intentionally back-doored, taking advantage of this opacity. So why pretend this is a “FOSS” issue?

“If something was fixed or was already patched upstream before disclosure, then it is not a 0-day.”Speaking of back-doored code or executables, “backdoor” means not a backdoor anymore. Microsoft-controlled media distorted the term and kept mentioning it in false contexts. Nowadays it just means a server got compromised and then the person who took control of it installed some more stuff. But that’s malware and it says nothing about how the malware got on the system in the first place (unless there was an actual back door).

Many would say that servers can be hijacked using critical and remotely-exploitable flaws, set aside bad passwords (those are typically a human failure). But that leads us to the distortion of the definition of “zero day” (or 0-day). If something was fixed or was already patched upstream before disclosure, then it is not a 0-day. If it starts getting exploited the moment it is disclosed, then it’s a “1-day”. But looking around the Web today, we found several examples of lies to that effect. The media keeps badmouthing Zimbra, but this seems to be a way to distract from several critical Microsoft flaws, including those affecting Exchange. Those are actively being exploited, according to a very recent report. the Zimbra issue is old news (about a month old) and servers have already been patched by responsible administrators, such as my colleagues. Although it seems like the Zimbra hole might be a new one, the last patch partly addresses it. Do not forget that CISA released a list with three Microsoft holes that are actively exploited, including in Exchange, so why shift/divert to talking about Zimbra rather than Exchange? Are they trying to reinforce some false perception that moving away from Exchange would mean equally bad or even worse security?

“The scenario, as per Dan Goodin et al (even sued for defamation already, for utterly poor reporting on security), is nowhere as grim as the Microsoft Exchange situation.”What’s bothersome here is the repeated distortion of the term “zero day”. An associate told us that “‘they’ must be really worried about the advance of FOSS to spread so much dated FUD about Zimbra and other projects. One giveaway is the use of the marketing phrase “zero-day”. That used to mean an exploit that was in active use before the vendor admitted to it existing. Now it just means bug with an exploit.”

The scenario, as per Dan Goodin et al (even sued for defamation already, for utterly poor reporting on security), is nowhere as grim as the Microsoft Exchange situation. We already saw that Microsoft goes on for months and months without patching known Exchange flaws, even when it is fully informed that such flaws are actively being exploited already.

Zimbra does E-mail, so that helps distract from what Microsoft is doing, with the real zero days, the real back doors, and the real supply chain crisis. Microsoft monopolises this chain (it’s proprietary) and refuses to fix it, leaving the victims helpless. This must be intentional. Or as out associate put it, “paid-for back doors on behalf of those that pay enough, or more specifically bug doors. Those are exploitable bugs about which the payers are informed long in advance of Microsoft getting around to patching them.”

“Zimbra does E-mail, so that helps distract from what Microsoft is doing, with the real zero days, the real back doors, and the real supply chain crisis.”It’s the Windows [sic] of opportunity… Edward Snowden has already provided ample evidence of this. Microsoft keeps giving the NSA and FBI enough time to install a RAT or bootkit before the patches get deployed (too late). “And the FSB and just about any similar agency in all the other Internet-connected countries in the world,” our associate noted.

So we’re meant to think that the real crisis is Free software and Microsoft lobbyists then push for new, discriminatory laws that stigmatise "Open Source". New zero-day in Microsoft products? Unpatched for months while exploits circulate for months? So the Microsoft shills focus on the something that is “open source”… and repeat endlessly the terms which aren’t even applicable to it.

“CISA is a Microsoft reseller working out of the DHS offices,” our associated concluded, “which itself is a fraud.”

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. Links 08/02/2023: Transmission 4.0.0 Released and Mass Layoffs at Zoom

    Links for the day



  2. IRC Proceedings: Tuesday, February 07, 2023

    IRC logs for Tuesday, February 07, 2023



  3. When the Pension Vanishes

    Today we commenced a multi-part mini-series about pensions and what happens when they suddenly vanish and nobody is willing to explain where all the money went



  4. Sirius 'Open Source' Pensiongate: An Introduction

    The Sirius ‘Open Source’ series continues in the form of a mini-series about pensions; it’s part of an ongoing investigation of a deep mystery that impacts people who left the company quite a long time ago and some of the lessons herein are applicable to any worker with a pension (at times of financial uncertainties)



  5. Links 07/02/2023: Endless OS 5.0 and Voice.AI GPL Violations

    Links for the day



  6. No Doubt Microsoft Unleashed Another 'Tay', Spreading Bigotry Under the Guise of Hey Hi (AI)

    Reprinted with permission from Ryan



  7. Links 07/02/2023: Fedora 39 Development Plans Outlines

    Links for the day



  8. IRC Proceedings: Monday, February 06, 2023

    IRC logs for Monday, February 06, 2023



  9. Links 06/02/2023: Escuelas Linux 8.0 and Many Political Issues

    Links for the day



  10. Links 06/02/2023: Sparky 6.6 and IPFire 2.27 – Core Update 173

    Links for the day



  11. Taking Back Control or Seizing Autonomy Over the News Cycle (Informing People, Culling the Marketing)





  12. Reality Versus Fiction: EPO Insiders Versus EPO Web Site and UPC 'Churnalists'

    The "official" sources of the European Patent Office (EPO), as well as the sedated "media" that the EPO is bribing for further bias, cannot tell the truth about this very large institution; for proper examination of Europe's largest patent office one must pursue the interpretation by longtime veterans and insiders, who are increasingly upset and abused (they're being pressured to grant patents in violation of the charter of the EPO)



  13. Links 06/02/2023: Linux 6.2 RC7 and Fatal Earthquake

    Links for the day



  14. IRC Proceedings: Sunday, February 05, 2023

    IRC logs for Sunday, February 05, 2023



  15. Links 05/02/2023: Wayland in Bookworm and xvidtune 1.0.4

    Links for the day



  16. Links 05/02/2023: Pakistan Blocks Wikipedia, Musharraf Dies

    Links for the day



  17. IRC Proceedings: Saturday, February 04, 2023

    IRC logs for Saturday, February 04, 2023



  18. Links 04/02/2023: FOSDEM Happening and Ken Thompson in SoCal Linux Expo

    Links for the day



  19. 2023 is the Year Taxpayers' Money Goes to War and Energy Subsidies, Not Tech

    Now that a lot of powerful and omnipresent ‘tech’ (spying and policing) companies are rotting away we have golden opportunities to bring about positive change and maybe even recruit technical people for good causes



  20. Getting Back to Productive Computer Systems Would Benefit Public Health and Not Just Boost Productivity

    “Smartphoneshame” (shaming an unhealthy culture of obsession with “apps”) would potentially bring about a better, more sociable society with fewer mental health crises and higher productivity levels



  21. Links 04/02/2023: This Week in KDE and Many More Tech Layoffs

    Links for the day



  22. Dotcom Boom and Bust, Round 2

    The age of technology giants/monopolies devouring everything or military-funded (i.e. taxpayers-subsidised) surveillance/censorship tentacles, in effect privatised eyes of the state, may be ending; the United States can barely sustain that anymore and raising the debt ceiling won't solve that (buying time isn't the solution)



  23. Society Would Benefit From a Smartphoneshame Movement

    In a society plagued by blackmail, surveillance and frivolous lawsuits it is important to reconsider the notion of “smart” phone ownership; these devices give potentially authoritarian companies and governments far too much power over people (in the EU they want to introduce new legislation that would, in effect, ban Free software if it enables true privacy)



  24. IRC Proceedings: Friday, February 03, 2023

    IRC logs for Friday, February 03, 2023



  25. IRC Proceedings: Thursday, February 02, 2023

    IRC logs for Thursday, February 02, 2023



  26. Links 03/02/2023: Proton 7.0-6 Released, ScummVM 2.7 Testing

    Links for the day



  27. Links 03/02/2023: OpenSSH 9.2 and OBS Studio 29.0.1

    Links for the day



  28. Links 03/02/2023: GNU C Library 2.37

    Links for the day



  29. Sirius Finished

    Yesterday I was sent a letter approving my resignation from Sirius ‘Open Source’, two months after I had already announced that I was resigning with immediate effect; they sent an identical letter to my wife (this time, unlike before, they remembered to also change the names!!)



  30. The Collapse of Sirius in a Nutshell: How to Identify the Symptoms and Decide When to Leave

    Sirius is finished, but it's important to share the lessons learned with other people; there might be other "pretenders" out there and they need to be abandoned


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts