The great power of lies and gullible journalists

Summary: Microsoft's partner Alert Logic is trying to label a feature of Linux a security flaw and even makes marketing buzz for it

IF A reporter or two can be bamboozled into printing a lie (digitally distributing it), this can lend some credibility/legitimacy to the lie and then it is possible that the lie will spread and be echoed in other reports. Hence the importance of this matter.

"They are trying to change perceptions around Free software security."Several journalists have already rebutted something that I debunked some days ago when I first saw some nonsense about "Grinch" with a suitable "marketing" image. Here is one rebuttal among a few:

The Grinch flaw was reported by Stephen Cody, chief security evangelist at Alert Logic. Cody alleges that the Grinch flaw enables users on a local machine to escalate privileges. Leading Linux vendor Red Hat, however, disagrees that the Grinch issue is even a bug and instead notes in a Red Hat knowledge base article that the Grinch report "incorrectly classifies expected behavior as a security issue."

The original security researcher that reported the Grinch found that if a user logs into a Linux system as the local administrator, the user could run a certain command that would enable the user to install a package, explained Josh Bressers, lead of the Red Hat Product Security Team.

"Local administrators are trusted users," Bressers told eWEEK. "This isn't something you hand out to everybody."

We believe it was Joab Jackson (IDG) who first gave a platform to the Microsoft partner (Alert Logic) that used marketing buzz and a lie against Linux, soon to be rebutted by Red Hat. I had contacted Mr. Jackson, who later told me that he posted a follow-up (or correction).

Jackson's correction may have come too late as we saw the lie spreading to a few other news sites later on (thankfully not too many sites). Here is one example of garbage 'reporting' (FUD and lies), generated by the FUD firm with with a catchy name, sort of logo etc. (generated by a Microsoft partner we might add). Apart from Jackson's piece we saw at least 3 more such articles (which came afterwards). How many are going to post a correction? How many articles will be withdrawn? How many follow-ups will be published? Tumbleweed. Silence.

It is usually Windows that has zero-days during Christmas, not GNU or Linux. There was recently other nonsense with a name, claiming to be a flaw when it was actually some other malware (potentially developed by the Russian government) that users actually have to install (not from repositories) to be infected by. It was akin to a phishing attack, but it was widely used in the press (even in IDG, Jackson's employer) to characterise GNU/Linux as insecure.

Remember what the Microsoft-connected firm did with "Heartbleed" (the name it made up with a promotional logo). It's all about marketing and hype. They are trying to change perceptions around Free software security. What matters is what people remember, not the truth. This is all about discouraging users or buyers.

A reader has alerted us about this article from Armenia . "Note the job title of the 'softer," he said. Here is the relevant portion:

Armenia’s Minister of Defense Seyran Ohanyan received Microsoft Corporation’s Regional Director for Public Safety/National Security/Defense Robert Kosla.

Joke or real? It sounds like a joke, but they are definitely not joking. Armenia talks to the NSA's biggest partner and back doors-loving company about 'security', so seeing the job title from Microsoft is truly hilarious! Microsoft is good at insecurity and lies, not security. ⬆

"Our products just aren't engineered for security."

--Brian Valentine, Microsoft executive