Linux Containers Authors: Zakia Bouachraoui, Liz McMillan, Jason Bloomberg, Yeshim Deniz, Elizabeth White

Related Topics: Linux Containers, Java IoT, Microservices Expo, ColdFusion

Linux Containers: Article

TURNER'S VIEWPOINT: The Emperor's New Clothes

TURNER'S VIEWPOINT: The Emperor's New Clothes

One of the major debates in the Open Source vs Proprietary Software debate has always been which one offers more security against intruders and other malfactors. The traditional wisdom has been that Open Source has the advantage of more eyes on the code, scouring it for vulnerabilities, while proprietary software has the advantage that hackers don't have the ability to look for security holes in the source code itself, since it is closely held.

The revelation this week that source code to major portions of two popular Microsoft operating systems are being passed throughout the Net brings this debate to an end. I, personally, have always suspected that the source code to proprietary OSes would always been available to a buyer with the right amount of money. After all, it just takes one disgruntled worker with a high-capacity USB RAM drive on his keychain to smuggle the goods out of a building. But now that millions of lines of code to Windows NT 4.0 and Windows 2000 are readily available to anyone with a modem, there can be no denial of the brutal truth.

So in light of this new world order of software, what's the new conventional wisdom? Open Source remains as it has always been, an arena where malicious forces are free to search for holes to exploit, while armies of developers busily patch and repair any problems they find. But on the other hand, Microsoft in particular is being called out for walking around naked.

It's the worst of all possible worlds for Microsoft users. They have no abilility to fix problems found in Microsoft operating systems themselves, since only Microsoft can issue patches. On the other hand, the forces of evil now have the ability to look at the actual sources and hand-craft viruses and worms to weasel into Microsoft systems. So now it will be a handful of Microsoft developers against the world.

In fact, it's even worse. Since downloading a copy of the stolen code places you in violation of the Digital Millennium Copyright Act, you can't even look at the source to see how bad the problem might be. Obviously, some Russian Mafia coder will have no such compunctions not to do it. So the guys in the White Hats are still technically left in the dark, while the Black Hats have a whole new resource to exploit.

Considering that in the era before the release of the Windows source code, Microsoft often appeared unable to keep up with the flood of exploits aimed against their operating systems, one can only imagine what the world will be like now their dirty laundry has been exposed to the light of day. Get ready for your twice-daily mandatory security patches, folks.

More Stories By James Turner

James Turner is president of Black Bear Software. James was formerly senior editor of Linux.SYS-CON.com and has also written for Wired, Christian Science Monitor, and other publications. He is currently working on his third book on open source development.

Comments (2) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

Most Recent Comments
muscle 03/23/04 01:44:42 AM EST

it's almost a ritual for me to run these patches. i've set up a cool tool to automate it across my company's platform

David Mohring 02/16/04 03:02:18 AM EST

Read Shattering Windows: Is a Disaster Lurking?

The Shatter Attack exposes inherent vulnerabilities in the overall design of Microsoft's operating system application interface . Microsoft has known about this class of vulnerability since 1994.
This has been more than long enough for Microsoft to develop a more secure alternative API and deprecate the unsecureable GDI interface. Instead Microsoft continued to develop applications using the unsecure APIs and promote their use with the Microsoft development tools for third party developers.

Bill Gates' Memo putting security as a top priorty in January 2002 ...
... was reminiscent of announcements of the old "five year plans" from the old Soviet and Maoist regimes.
http://groups.google.com/[email protected]

In May 2002, under oath at the antitrust hearing Jim Allchin, group vice president for platforms at Microsoft, stated that, because the Windows operating systems contained inherent flaws, disclosing the Windows operating system source code could damage national security and even threaten the U.S. war effort.

By the way, In February 2003, Microsoft signed a pact with Chinese officials to reveal the Windows operating system source code. Bill Gates even hinted that China will be privy to all, not just part, of the source code its government wished to inspect.

Dispite gaining more favored trading status with the USA, there remains many embargos over technology transfers which could put the US at future risk.

Either Jim Allchin lied under oath, to prevent code revelation being any part of the settlement, OR the Microsoft corporation is behaving traitorously, by exposing national security issues to foreign governments.

The exposure of Microsoft source code put users at risk because of the inherent design and implimentation flaws built into the source code.

IoT & Smart Cities Stories
The challenges of aggregating data from consumer-oriented devices, such as wearable technologies and smart thermostats, are fairly well-understood. However, there are a new set of challenges for IoT devices that generate megabytes or gigabytes of data per second. Certainly, the infrastructure will have to change, as those volumes of data will likely overwhelm the available bandwidth for aggregating the data into a central repository. Ochandarena discusses a whole new way to think about your next...
CloudEXPO | DevOpsSUMMIT | DXWorldEXPO are the world's most influential, independent events where Cloud Computing was coined and where technology buyers and vendors meet to experience and discuss the big picture of Digital Transformation and all of the strategies, tactics, and tools they need to realize their goals. Sponsors of DXWorldEXPO | CloudEXPO benefit from unmatched branding, profile building and lead generation opportunities.
All in Mobile is a place where we continually maximize their impact by fostering understanding, empathy, insights, creativity and joy. They believe that a truly useful and desirable mobile app doesn't need the brightest idea or the most advanced technology. A great product begins with understanding people. It's easy to think that customers will love your app, but can you justify it? They make sure your final app is something that users truly want and need. The only way to do this is by ...
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...
DXWorldEXPO LLC announced today that Big Data Federation to Exhibit at the 22nd International CloudEXPO, colocated with DevOpsSUMMIT and DXWorldEXPO, November 12-13, 2018 in New York City. Big Data Federation, Inc. develops and applies artificial intelligence to predict financial and economic events that matter. The company uncovers patterns and precise drivers of performance and outcomes with the aid of machine-learning algorithms, big data, and fundamental analysis. Their products are deployed...
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence. Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more busine...
Cell networks have the advantage of long-range communications, reaching an estimated 90% of the world. But cell networks such as 2G, 3G and LTE consume lots of power and were designed for connecting people. They are not optimized for low- or battery-powered devices or for IoT applications with infrequently transmitted data. Cell IoT modules that support narrow-band IoT and 4G cell networks will enable cell connectivity, device management, and app enablement for low-power wide-area network IoT. B...
The hierarchical architecture that distributes "compute" within the network specially at the edge can enable new services by harnessing emerging technologies. But Edge-Compute comes at increased cost that needs to be managed and potentially augmented by creative architecture solutions as there will always a catching-up with the capacity demands. Processing power in smartphones has enhanced YoY and there is increasingly spare compute capacity that can be potentially pooled. Uber has successfully ...
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buye...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things'). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing. IoT is not about the devices, its about the data consumed and generated. The devices are tools, mechanisms, conduits. This paper discusses the considerations when dealing with the...