Bonum Certa Men Certa

For Real Security, Use CentOS -- Never RHEL -- and Run Neither on Amazon's Servers

Red Hat logo



Summary: Never run Red Hat's "Enterprise Linux", which cannot be trusted because of NSA involvement; Amazon, which pays Microsoft for RHEL and works with the CIA, should never be used for hosting

SEVERAL years ago CentOS almost died; now it's being embraced by Red Hat and one pundit from tech tabloid ZDNet is moving to CentOS Linux on the desktop [1,2].



CentOS is still in the news [3], with the CentOS project leader (Karanbir Singh) giving an interview to the Linux Foundation [4]. We trust CentOS, whereas trusting Red Hat is hard. RHEL is binary and based on news from half a decade ago, the NSA is said to be involved in the building process, as well as SUSE's, whereas CentOS is built from source (publicly visible). Microsoft and the NSA do the same thing with Windows and it's now confirmed that Windows has NSA backdoors.

Earlier this month vulnerabilities in RHEL's openssl and RHEL's gnupg [5,6], contributed even less to trust. RHEL is so standard in the industry that it would probably be simpler than other distributions to exploit; the NSA may as well have off-the-shelf exploits for all major RHEL releases, which are deployed in many countries' servers (even so-called 'rogue' countries). Based on the NSA leaks, Fedora -- not RHEL -- is being used by the NSA itself to run its spying operations (e.g. collecting radio signals from afar). Fedora is not truly binary-compatible and its source code makes secrets hard to keep.

Lastly, mind the latest of Red Hat's Fog Computing hype [7,8], including the CIA's partner Amazon that's lumped onto Red Hat [9,10] as part of a conference [11,12]. Avoid Amazon at all costs. It's a malicious trap for many reasons. Amazon also pays Microsoft for RHEL after a patent deal with Microsoft, as we pointed out years ago. Suffice to say, Microsoft's servers are as bad as Amazon's for privacy.

RHEL and its derivatives continue to be deployed in many large networks of systems [13], so it's clear why the NSA would drool over the possibility of back doors in RHEL. Watch out for that. Given the way NSA infiltrated standards bodies and other institutions, it's not impossible that there are even moles at Red Hat or Fedora. There used to be some at Microsoft (we know about those who got caught).

Red Hat's CEO is now telling his story in a Red Hat site [14] and one needs to remember who he used to work for (close to Boeing, which is primarily an army company), not just the country he is based on (hence the rules that apply to him, especially when he wishes to appeal to government contractors, DoD/Pentagon etc. which are the most lucrative contracts).

It should be noted that my Web sites are mostly running CentOS and the same goes for the host of Techrights, who focuses on security. With CentOS you can get the source code and redistribute; with Red Hat's RHEL you can't (it's sold as binary).

There is definitely a good reason to trust CentOS security more than RHEL security. As for Oracle ("Unbreakable"), well... just read Ellison's public statements in support of the NSA (never mind the company's roots and the CIA). That tells a lot.

The bottom line is, blind faith in binary distributions is a bad thing. Blind faith in NSA partners (Red Hat collaborates with the NSA not just in SELinux) is even worse.

Related/contextual items from the news:



  1. Taking the long view: Why I'm moving to CentOS Linux on the desktop


  2. Is CentOS ready for the Linux desktop?
    CentOS is a very interesting and different choice for a desktop distribution. I haven't heard of many people using it that way. Whenever somebody brings it up it's usually within the context of running a server.


  3. Fedora and CentOS Updates, Linux for Security, and Top Seven


  4. CentOS Project Leader Karanbir Singh Opens Up on Red Hat Deal
    In the 10 years since the CentOS project was launched there has been no board of directors, or legal team, or commercial backing. The developers who labored to build the community-led version of Red Hat Enterprise Linux (RHEL) worked largely unpaid (though some took a few consulting gigs on the side.) They had a few hundred dollars in their bank account to pay for event t-shirts and that was it. And the project's direction was decided based on the developers' immediate needs, not a grand vision of future technology.


  5. Red Hat: 2014:0015-01: openssl: Important Advisory
  6. Red Hat: 2014:0016-01: gnupg: Moderate Advisory


  7. Red Hat Invests in Open Source IaaS, Cloud Talent


  8. Red Hat Academy Expands Training, Includes OpenStack Coursework


  9. Red Hat Launches Test Drives on AWS
    At its annual Partner conference in Scottsdale, Arizona this week Red Hat (RHT) announced new Test Drives on Amazon Web Services (AWS) with three Red Hat partners – CITYTECH, Shadow-Soft, and Vizuri. Through the AWS Test Drive program, users can quickly and easily explore and deploy ready-made solutions built on Red Hat technologies.



  10. Why Red Hat Needs OpenStack ... And AWS
    OpenStack, the cloud's community darling, desperately needs leadership, and Red Hat seems the ideal leader. But OpenStack isn't the only needy party here. As good as Red Hat's growth has been over the last decade, it pales in comparison to that of VMware, a later entrant that has grown much faster than Red Hat. And the open source leader still trails well behind Microsoft.


  11. Google, Amazon Clouds Invade Red Hat Partner Conference
    Google Cloud Platform and Amazon Web Services executives are set to address Red Hat Partner Conference attendees on Jan. 13 in Arizona. No doubt, the keynotes will seek to ensure Linux resellers understand how to move customer workloads into the Google and AWS public clouds, respectively.


  12. 7 Surprises At Red Hat Partner Conference 2014


  13. How to deploy OSSEC across a large network of systems from RPMs


  14. Teens and their first job: How to get on the path to a happy career
    I grew up in the 1980s in Columbus, Georgia. You needed a car to get around, so I did not work until I could drive. Within months of getting my driver's license, I got my first job as a part-time computer programmer for a stockbroker.


Comments

Recent Techrights' Posts

Antenna Abuse and Gemini Abuse (Self-hosting Perils)
Perhaps all this junk is a sign of Gemini growing up
Djibouti Enters the Windows "10% Club" (Windows Was 99% in 2010)
In Africa in general Microsoft lost control
[Video] Boston Area Assange Defense (Yesterday)
It was published only hours ago
In Malta, Android/Linux Has Overtaken Microsoft Windows (According to statCounter)
statCounter milestone?
 
Microsoft Layoffs Are Still Too Frequent to Keep Abreast of and Properly (or Exhaustively) Classify
The "HR" department knows what's happening, but whistleblowers from there are rare
Bahamas Joined the "5% Windows" Club
statCounter only traces back about 1 in 20 Web requests to Windows
Links 16/07/2024: Salesforce Layoffs and Microsoft's DMARC Fail
Links for the day
Possibly Worse Than Bribes: US Politicians and Lawmakers Who Are Microsoft Shareholders
They will keep bailing out Microsoft to bail themselves out
The Software Freedom Conservancy Folks Don't Even Believe in Free Speech and They Act As Imposters (Also in the Trademark Arena/Sense)
Software Freedom Conservancy was already establishing a reputation for itself as a G(I)AFAM censor/gatekeeper
GNU/Linux Share Doubled in the United States of America (USA) in the Past 12 Months
Or so says statCounter
Even in North Korea (Democratic People's Republic Of Korea) Google Said to Dominate, Microsoft Around 1%
Google at 93.26%
[Meme] The Red Bait (Embrace... Extinguish)
They set centos on fire, then offer a (de facto) proprietary substitute for a fee
Shooting the Messenger to Spite the Message
segment of a Noam Chomsky talk
Guinea: Windows Down From 99.3% to 2.7% 'Market Share'
Guinea is not a small country
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 15, 2024
IRC logs for Monday, July 15, 2024
What's Meant by "Antenna Abuse" (Gemini)
syndication is not a monopoly in Gemini and if one doesn't condone political censorship, then one can create one's own syndication service/capsule
Microsoft Layoffs and Entire Unit Termination: Diversity, Equity, and Inclusion
What an announcement to make just before Independence Day
Links 16/07/2024: Old Computer Challenge and One Page Dungeon Contest
Links for the day
Microsoft Falls Further and Closer Towards 10% (Windows "Market Share") in Kuwait
more countries entering the "single-digit Windows" (under 10%) club
Gemini Links 15/07/2024: Antenna's Pro-Hamas Bias Revisited and Old Computer Challenge
Links for the day
[Video] Julian Assange, Over One Decade Ago, Cautioning About What the Internet Had Truly Become
video is not new
Homage to Malta
Malta is probably easy for Microsoft to bribe
IRC at 16
Logging has been used for us and against us
Links 15/07/2024: China’s Economic Problems, Boeing Under Fire
Links for the day
500 Days' Uptime Very Soon
Good luck doing that with Windows...
Windows Falls Below 20% in Tunisia
A month ago we wrote about GNU/Linux in Tunisia
Links 15/07/2024: Google Wants Wiz and Why "Sports Ruin Everything"
Links for the day
Gemini Links 15/07/2024: Old Computer Challenge and Sending Files via NNCP
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 14, 2024
IRC logs for Sunday, July 14, 2024
Debian History Harassment & Abuse culture evolution
Reprinted with permission from Daniel Pocock
Microsoft Windows Down to 23% in Spain
the rate of change is noteworthy
[Meme] It Is Not About Empowerment, It's About Optics for Bigots and Businessmen
Truth hurts
Truth is Always Truth
Desperate efforts to suppress the truth resulted in even worse chaos and some people are going to pay for it
Android Surges to New Highs in Georgia, Windows Plunges to 30% (It Was 99% in 2012)
Until 2012 almost all Web requests there came from Windows
Another Casualty of the 'GAI' Ponzi Scheme: Most of the News Cycle and News Sites
accelerated death of journalism
Empowering Predators Who Fancy Exercising Control Over Women (Using Corporate Money)
Remember this when Google talks about diversity, women etc.
GNU/Linux Continues Its Rapid Growth in July, Today We Look at Belgium
Again, a word of caution: statCounter isn't a perfect yardstick
Links 14/07/2024: Goldman Sachs Says 'Advanced' or 'Generative' Hey Hi (AI) is Just Hype, Thoughts on Negatives
Links for the day
GNOME Foundation Welcomes Dolly
It didn't work out with Molly and Holly
Links 14/07/2024: Perils for AI PC Hype Train, Further Attacks on Freedom of the Press
Links for the day
A Response to Bill Maher's Senseless Attacks on Julian Assange and Wikileaks
published a few hours ago
The List of Sites or Sources for Linux News is Getting Shorter Over Time (Despite GNU and Linux Steadily Growing in Usage)
A lack of publishing begets lack of educated, informed population (a return to Dark Ages where rulers leverage mass ignorance)
The Number of Web Servers Has Gone Down
Cloud fatigue deux?
[Meme] GNOME Foundation's Relationship With Women
Lots more coming soon, so stay tuned
The Smugness of "I'm a Journalist"
Attacking women for expressing their opinions (for example, about the abuse they received) isn't unprecedented
It Takes No Courage to Become Another Corporate Stooge
transition to spam
Why Techrights Has Just Programmatically Blacklisted ZDNet
Even their "Linux" writers are AWOL
Gemini Links 14/07/2024: The Stress of 24/7 Notifications and FOSS tools for Sipeed Tang Nano 1K
Links for the day
Windows Already Down to 10% in Lao (It was 96% a Decade and a Half Ago), Vista 11 Adoption Has Stalled
And GNU/Linux is topping a 1-year high in Loa
IRC Proceedings: Saturday, July 13, 2024
IRC logs for Saturday, July 13, 2024
Over at Tux Machines...
GNU/Linux news for the past day